codegate-ai 0.7.0 → 0.9.0

package/dist/layer2-static/detectors/workflow-hardcoded-container-credentials.js

@@ -0,0 +1,90 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const CREDENTIAL_IN_IMAGE_PATTERNS = [/:\/\/[^/\s:@]+:[^@\s]+@/iu, /:[^@\s]+@(?!sha256:)/iu];
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function gatherImageTargets(parsed) {
+    const root = asRecord(parsed);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return [];
+    }
+    const targets = [];
+    for (const [jobId, jobValue] of Object.entries(jobs)) {
+        const job = asRecord(jobValue);
+        if (!job) {
+            continue;
+        }
+        const container = asRecord(job.container);
+        if (typeof container?.image === "string") {
+            targets.push({
+                field: `jobs.${jobId}.container.image`,
+                image: container.image,
+            });
+        }
+        const services = asRecord(job.services);
+        if (!services) {
+            continue;
+        }
+        for (const [serviceName, serviceValue] of Object.entries(services)) {
+            const service = asRecord(serviceValue);
+            if (typeof service?.image === "string") {
+                targets.push({
+                    field: `jobs.${jobId}.services.${serviceName}.image`,
+                    image: service.image,
+                });
+            }
+        }
+    }
+    return targets;
+}
+function hasEmbeddedCredentials(image) {
+    const value = image.trim();
+    return CREDENTIAL_IN_IMAGE_PATTERNS.some((pattern) => pattern.test(value));
+}
+export function detectWorkflowHardcodedContainerCredentials(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    for (const target of gatherImageTargets(input.parsed)) {
+        if (!hasEmbeddedCredentials(target.image)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [target.image, "image:"],
+            fallbackValue: target.image,
+        });
+        findings.push({
+            rule_id: "hardcoded-container-credentials",
+            finding_id: `HARDCODED_CONTAINER_CREDENTIALS-${input.filePath}-${target.field}`,
+            severity: "HIGH",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: target.field },
+            description: "Container image reference appears to embed static credentials",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-798",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Remove embedded credentials from image references and use short-lived registry auth",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-impostor-commit.d.ts

@@ -0,0 +1,9 @@
+import type { RuntimeMode } from "../../config.js";
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowImpostorCommitInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+    runtimeMode?: RuntimeMode;
+}
+export declare function detectWorkflowImpostorCommit(input: WorkflowImpostorCommitInput): Promise<Finding[]>;

package/dist/layer2-static/detectors/workflow-impostor-commit.js

@@ -0,0 +1,127 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const GITHUB_API_HEADERS = {
+    Accept: "application/vnd.github+json",
+};
+function splitOwnerRepo(slug) {
+    const firstSlash = slug.indexOf("/");
+    if (firstSlash < 0) {
+        return null;
+    }
+    const owner = slug.slice(0, firstSlash);
+    const repo = slug.slice(firstSlash + 1).split("/")[0];
+    if (!owner || !repo) {
+        return null;
+    }
+    return { owner, repo };
+}
+function isPinnedToCommit(ref) {
+    return /^[a-f0-9]{40}$/iu.test(ref.trim());
+}
+function parseRepositoryUses(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("./") || trimmed.startsWith("docker://")) {
+        return null;
+    }
+    const atIndex = trimmed.lastIndexOf("@");
+    if (atIndex < 0) {
+        return null;
+    }
+    const slug = trimmed.slice(0, atIndex).trim().replace(/\/+$/u, "").toLowerCase();
+    const ref = trimmed.slice(atIndex + 1).trim();
+    if (!slug.includes("/") || ref.length === 0) {
+        return null;
+    }
+    return { slug, ref };
+}
+function parseUsesLine(line, lineNumber) {
+    const match = line.match(/^\s*(?:-\s*)?uses:\s*([^#]+?)(?:\s*#.*)?\s*$/iu);
+    if (!match?.[1]) {
+        return null;
+    }
+    const uses = match[1].trim();
+    const usesColumn = line.indexOf("uses:");
+    return {
+        lineNumber,
+        column: usesColumn >= 0 ? usesColumn + 1 : 1,
+        rawLine: line,
+        uses,
+    };
+}
+async function fetchGitHubJson(url) {
+    try {
+        const response = await fetch(url, {
+            headers: GITHUB_API_HEADERS,
+        });
+        if (!response.ok) {
+            return null;
+        }
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+async function repositoryHasCommit(owner, repo, sha) {
+    const url = `https://api.github.com/repos/${owner}/${repo}/commits/${encodeURIComponent(sha)}`;
+    const payload = (await fetchGitHubJson(url));
+    return typeof payload?.sha === "string" && payload.sha.length > 0;
+}
+export async function detectWorkflowImpostorCommit(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    if (!extractWorkflowFacts(input.parsed)) {
+        return [];
+    }
+    const mode = input.runtimeMode ?? "offline";
+    if (mode !== "online") {
+        return [];
+    }
+    const findings = [];
+    const lines = input.textContent.split(/\r?\n/u);
+    for (const [index, line] of lines.entries()) {
+        const parsedLine = parseUsesLine(line, index + 1);
+        if (!parsedLine) {
+            continue;
+        }
+        const parsedUses = parseRepositoryUses(parsedLine.uses);
+        if (!parsedUses || !isPinnedToCommit(parsedUses.ref)) {
+            continue;
+        }
+        const ownerRepo = splitOwnerRepo(parsedUses.slug);
+        if (!ownerRepo) {
+            continue;
+        }
+        if (await repositoryHasCommit(ownerRepo.owner, ownerRepo.repo, parsedUses.ref)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [parsedLine.rawLine, parsedUses.ref, parsedUses.slug],
+            fallbackValue: parsedLine.rawLine.trim(),
+        });
+        findings.push({
+            rule_id: "workflow-impostor-commit",
+            finding_id: `WORKFLOW_IMPOSTOR_COMMIT-${input.filePath}-${index + 1}`,
+            severity: "HIGH",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { line: parsedLine.lineNumber, column: parsedLine.column },
+            description: "Pinned action commit is not present in the referenced repository",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-829",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Pin the action to a commit that exists in the referenced repository and review the upstream history before updating",
+            ],
+            evidence: evidence?.evidence ?? parsedLine.rawLine.trim(),
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-insecure-commands.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowInsecureCommandsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowInsecureCommands(input: WorkflowInsecureCommandsInput): Finding[];

package/dist/layer2-static/detectors/workflow-insecure-commands.js

@@ -0,0 +1,72 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const INSECURE_COMMAND_PATTERNS = [
+    {
+        pattern: /\b(?:curl|wget)\b[\s\S]*?\|\s*(?:sh|bash)\b/iu,
+        description: "remote download piped directly into a shell",
+    },
+    {
+        pattern: /\bbash\s*<\s*\(\s*curl\b/iu,
+        description: "process substitution executes downloaded shell content",
+    },
+    {
+        pattern: /\bsh\s*<\s*\(\s*curl\b/iu,
+        description: "process substitution executes downloaded shell content",
+    },
+];
+function findInsecureCommand(run) {
+    if (typeof run !== "string") {
+        return null;
+    }
+    for (const entry of INSECURE_COMMAND_PATTERNS) {
+        if (entry.pattern.test(run)) {
+            return { match: run, description: entry.description };
+        }
+    }
+    return null;
+}
+export function detectWorkflowInsecureCommands(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            const insecure = findInsecureCommand(step.run);
+            if (!insecure) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [insecure.match],
+                fallbackValue: insecure.match,
+            });
+            findings.push({
+                rule_id: "workflow-insecure-commands",
+                finding_id: `WORKFLOW_INSECURE_COMMANDS-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "COMMAND_EXEC",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                description: `Workflow uses ${insecure.description}`,
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-78",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Download artifacts separately, verify integrity, and run them only after review",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-known-vuln-action.d.ts

@@ -0,0 +1,8 @@
+import type { RuntimeMode } from "../../config.js";
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowKnownVulnActionInput {
+    filePath: string;
+    parsed: unknown;
+    runtimeMode?: RuntimeMode;
+}
+export declare function detectWorkflowKnownVulnAction(input: WorkflowKnownVulnActionInput): Finding[];

package/dist/layer2-static/detectors/workflow-known-vuln-action.js

@@ -0,0 +1,70 @@
+import { loadKnownVulnerableActions } from "../advisories/gha-advisory-client.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function parseRepositoryUses(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("./") || trimmed.startsWith("docker://")) {
+        return null;
+    }
+    const atIndex = trimmed.lastIndexOf("@");
+    if (atIndex < 0) {
+        return null;
+    }
+    const slug = trimmed.slice(0, atIndex).toLowerCase();
+    const ref = trimmed.slice(atIndex + 1).toLowerCase();
+    if (!slug.includes("/") || ref.length === 0) {
+        return null;
+    }
+    return { slug, ref };
+}
+export function detectWorkflowKnownVulnAction(input) {
+    if (input.runtimeMode !== "online") {
+        return [];
+    }
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const advisories = loadKnownVulnerableActions({ runtimeMode: input.runtimeMode }).advisories;
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            const uses = step.uses;
+            if (!uses) {
+                return;
+            }
+            const parsedUses = parseRepositoryUses(uses);
+            if (!parsedUses) {
+                return;
+            }
+            const vulnerableVersions = advisories[parsedUses.slug];
+            if (!vulnerableVersions || !vulnerableVersions.includes(parsedUses.ref)) {
+                return;
+            }
+            findings.push({
+                rule_id: "workflow-known-vuln-action",
+                finding_id: `WORKFLOW_KNOWN_VULN_ACTION-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_VULNERABLE_ACTION",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].uses` },
+                description: `Action ${parsedUses.slug}@${parsedUses.ref} is listed in known vulnerable references`,
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-937",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Upgrade to a non-vulnerable action release and pin to a reviewed commit SHA",
+                ],
+                evidence: uses,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-misfeature.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowMisfeatureInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowMisfeature(input: WorkflowMisfeatureInput): Finding[];

package/dist/layer2-static/detectors/workflow-misfeature.js

@@ -0,0 +1,101 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const SECURITY_TOKENS = [
+    "codeql",
+    "security",
+    "sast",
+    "secret",
+    "dependency review",
+    "npm audit",
+    "trivy",
+];
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function isContinueOnErrorEnabled(value) {
+    if (value === true) {
+        return true;
+    }
+    return typeof value === "string" && value.trim().toLowerCase() === "true";
+}
+function isSecurityStep(candidate) {
+    const combined = [candidate.name, candidate.run, candidate.uses]
+        .filter((value) => typeof value === "string")
+        .join(" ")
+        .toLowerCase();
+    return SECURITY_TOKENS.some((token) => combined.includes(token));
+}
+function gatherCandidates(parsed) {
+    const root = asRecord(parsed);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return [];
+    }
+    const candidates = [];
+    for (const [jobId, jobValue] of Object.entries(jobs)) {
+        const job = asRecord(jobValue);
+        const steps = Array.isArray(job?.steps) ? job.steps : [];
+        steps.forEach((stepValue, stepIndex) => {
+            const step = asRecord(stepValue);
+            if (!step) {
+                return;
+            }
+            candidates.push({
+                jobId,
+                stepIndex,
+                name: typeof step.name === "string" ? step.name : undefined,
+                run: typeof step.run === "string" ? step.run : undefined,
+                uses: typeof step.uses === "string" ? step.uses : undefined,
+                continueOnError: isContinueOnErrorEnabled(step["continue-on-error"]),
+            });
+        });
+    }
+    return candidates;
+}
+export function detectWorkflowMisfeature(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    for (const candidate of gatherCandidates(input.parsed)) {
+        if (!candidate.continueOnError || !isSecurityStep(candidate)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: ["continue-on-error: true", candidate.run ?? "", candidate.name ?? ""],
+            fallbackValue: "security step continues on error",
+        });
+        findings.push({
+            rule_id: "workflow-misfeature",
+            finding_id: `WORKFLOW_MISFEATURE-${input.filePath}-${candidate.jobId}-${candidate.stepIndex}`,
+            severity: "MEDIUM",
+            category: "CI_TRIGGER",
+            layer: "L2",
+            file_path: input.filePath,
+            location: {
+                field: `jobs.${candidate.jobId}.steps[${candidate.stepIndex}].continue-on-error`,
+            },
+            description: "Security-relevant step is configured with continue-on-error, which can hide failed checks",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-703",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Remove continue-on-error from security-critical steps or split non-blocking diagnostics into separate jobs",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-obfuscation.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowObfuscationInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowObfuscation(input: WorkflowObfuscationInput): Finding[];

package/dist/layer2-static/detectors/workflow-obfuscation.js

@@ -0,0 +1,79 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const OBFUSCATION_PATTERNS = [
+    {
+        pattern: /\bbase64\s+-d\b/iu,
+        description: "runtime decoding of base64-encoded payload data",
+    },
+    {
+        pattern: /\bbase64\s+-d\b[\s\S]*\|\s*(?:bash|sh)\b/iu,
+        description: "base64-decoded payload piped into a shell",
+    },
+    {
+        pattern: /\beval\b[\s\S]*\$\([^)]+base64[^)]*\)/iu,
+        description: "eval executes command substitution that decodes base64 content",
+    },
+    {
+        pattern: /\bprintf\b[\s\S]*\\x[0-9a-f]{2}/iu,
+        description: "hex-encoded shell payload reconstruction",
+    },
+];
+function detectObfuscation(run) {
+    if (!run) {
+        return null;
+    }
+    for (const entry of OBFUSCATION_PATTERNS) {
+        if (entry.pattern.test(run)) {
+            return {
+                run,
+                description: entry.description,
+            };
+        }
+    }
+    return null;
+}
+export function detectWorkflowObfuscation(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            const match = detectObfuscation(step.run);
+            if (!match) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [match.run, "base64", "eval"],
+                fallbackValue: match.run,
+            });
+            findings.push({
+                rule_id: "workflow-obfuscation",
+                finding_id: `WORKFLOW_OBFUSCATION-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "COMMAND_EXEC",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                description: `Workflow run step uses obfuscated command execution (${match.description})`,
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-506",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Replace obfuscated command pipelines with explicit, reviewable commands and integrity checks",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-overprovisioned-secrets.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowOverprovisionedSecretsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowOverprovisionedSecrets(input: WorkflowOverprovisionedSecretsInput): Finding[];

package/dist/layer2-static/detectors/workflow-overprovisioned-secrets.js

@@ -0,0 +1,81 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const FULL_SECRETS_SERIALIZATION = /\btojson\s*\(\s*secrets\s*\)/iu;
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function appendPath(base, segment) {
+    if (typeof segment === "number") {
+        return `${base}[${segment}]`;
+    }
+    return base.length > 0 ? `${base}.${segment}` : segment;
+}
+function findSerializedSecrets(value, path) {
+    if (typeof value === "string") {
+        return FULL_SECRETS_SERIALIZATION.test(value) ? { path, value } : null;
+    }
+    if (Array.isArray(value)) {
+        for (let index = 0; index < value.length; index += 1) {
+            const found = findSerializedSecrets(value[index], appendPath(path, index));
+            if (found) {
+                return found;
+            }
+        }
+        return null;
+    }
+    const record = asRecord(value);
+    if (!record) {
+        return null;
+    }
+    for (const [key, child] of Object.entries(record)) {
+        const found = findSerializedSecrets(child, appendPath(path, key));
+        if (found) {
+            return found;
+        }
+    }
+    return null;
+}
+export function detectWorkflowOverprovisionedSecrets(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const found = findSerializedSecrets(input.parsed, "");
+    if (!found) {
+        return [];
+    }
+    const evidence = buildFindingEvidence({
+        textContent: input.textContent,
+        searchTerms: [found.value, "toJSON(secrets)", "toJson(secrets)"],
+        fallbackValue: found.value,
+    });
+    return [
+        {
+            rule_id: "workflow-overprovisioned-secrets",
+            finding_id: `WORKFLOW_OVERPROVISIONED_SECRETS-${input.filePath}`,
+            severity: "HIGH",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: found.path },
+            description: "Workflow serializes the entire secrets context",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-200",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Reference only the specific secrets each step needs instead of serializing the full secrets context",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        },
+    ];
+}

package/dist/layer2-static/detectors/workflow-ref-confusion.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowRefConfusionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowRefConfusion(input: WorkflowRefConfusionInput): Finding[];