codegate-ai 0.7.0 → 0.9.0

package/dist/layer2-static/detectors/workflow-stale-action-refs.js

@@ -0,0 +1,178 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const staleActionCacheByFetch = new WeakMap();
+const GITHUB_API_HEADERS = {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "CodeGate",
+};
+const MAX_TAG_PAGES = 10;
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function isExternalRepositoryUse(value) {
+    return value.startsWith("./") || value.startsWith("../") || value.startsWith("docker://");
+}
+function trimTrailingSlashes(value) {
+    return value.replace(/\/+$/u, "");
+}
+function parseRepositoryUses(value) {
+    const trimmed = value.trim();
+    if (trimmed.length === 0 || isExternalRepositoryUse(trimmed)) {
+        return null;
+    }
+    const atIndex = trimmed.lastIndexOf("@");
+    if (atIndex < 0) {
+        return null;
+    }
+    const slug = trimTrailingSlashes(trimmed.slice(0, atIndex).trim());
+    const ref = trimmed.slice(atIndex + 1).trim();
+    const [owner, repo] = slug.split("/");
+    if (!owner || !repo || ref.length === 0) {
+        return null;
+    }
+    return {
+        raw: trimmed,
+        owner: owner.toLowerCase(),
+        repo: repo.toLowerCase(),
+        ref,
+    };
+}
+function isCommitSha(ref) {
+    return /^[a-f0-9]{40}$/iu.test(ref.trim());
+}
+async function commitPointsToTag(owner, repo, ref) {
+    const fetchFn = globalThis.fetch;
+    if (typeof fetchFn !== "function") {
+        return false;
+    }
+    let cache = staleActionCacheByFetch.get(fetchFn);
+    if (!cache) {
+        cache = new Map();
+        staleActionCacheByFetch.set(fetchFn, cache);
+    }
+    const normalizedRef = ref.toLowerCase();
+    const cacheKey = `${owner}/${repo}@${normalizedRef}`;
+    const cached = cache.get(cacheKey);
+    if (cached !== undefined) {
+        return cached;
+    }
+    try {
+        for (let page = 1; page <= MAX_TAG_PAGES; page += 1) {
+            const url = new URL(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/tags`);
+            url.searchParams.set("per_page", "100");
+            url.searchParams.set("page", String(page));
+            const response = await fetchFn(url, {
+                headers: GITHUB_API_HEADERS,
+            });
+            if (!response.ok) {
+                cache.set(cacheKey, false);
+                return false;
+            }
+            const payload = (await response.json());
+            if (!Array.isArray(payload)) {
+                cache.set(cacheKey, false);
+                return false;
+            }
+            for (const tag of payload) {
+                const tagRecord = asRecord(tag);
+                const commitRecord = asRecord(tagRecord?.commit);
+                const tagSha = typeof commitRecord?.sha === "string" ? commitRecord.sha : undefined;
+                if (tagSha && tagSha.toLowerCase() === normalizedRef) {
+                    cache.set(cacheKey, true);
+                    return true;
+                }
+            }
+            const linkHeader = response.headers.get("link") ?? "";
+            if (!linkHeader.includes('rel="next"') || payload.length < 100) {
+                break;
+            }
+        }
+    }
+    catch {
+        return false;
+    }
+    cache.set(cacheKey, false);
+    return false;
+}
+function gatherUsesTargets(parsed) {
+    const root = asRecord(parsed);
+    const jobsRecord = asRecord(root?.jobs);
+    if (!jobsRecord) {
+        return [];
+    }
+    const targets = [];
+    const addTarget = (uses, field) => {
+        const parsedUses = parseRepositoryUses(uses);
+        if (parsedUses) {
+            targets.push({
+                ...parsedUses,
+                field,
+            });
+        }
+    };
+    for (const [jobId, jobValue] of Object.entries(jobsRecord)) {
+        const jobRecord = asRecord(jobValue);
+        if (!jobRecord) {
+            continue;
+        }
+        if (typeof jobRecord.uses === "string") {
+            addTarget(jobRecord.uses, `jobs.${jobId}.uses`);
+        }
+        const steps = Array.isArray(jobRecord.steps) ? jobRecord.steps : [];
+        steps.forEach((step, stepIndex) => {
+            const stepRecord = asRecord(step);
+            if (stepRecord && typeof stepRecord.uses === "string") {
+                addTarget(stepRecord.uses, `jobs.${jobId}.steps[${stepIndex}].uses`);
+            }
+        });
+    }
+    return targets;
+}
+export async function detectWorkflowStaleActionRefs(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    if (!extractWorkflowFacts(input.parsed)) {
+        return [];
+    }
+    const targets = gatherUsesTargets(input.parsed);
+    const findings = [];
+    for (const target of targets) {
+        if (!isCommitSha(target.ref)) {
+            continue;
+        }
+        if (await commitPointsToTag(target.owner, target.repo, target.ref)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [target.raw, target.ref],
+            fallbackValue: target.raw,
+        });
+        findings.push({
+            rule_id: "workflow-stale-action-refs",
+            finding_id: `WORKFLOW_STALE_ACTION_REFS-${input.filePath}-${target.field}`,
+            severity: "LOW",
+            category: "CI_VULNERABLE_ACTION",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: target.field },
+            description: "Workflow action reference pins a commit hash that does not resolve to a tag",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-829",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Pin the action to a commit hash that corresponds to a release tag, or document why the raw commit is required",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-superfluous-actions.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowSuperfluousActionsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowSuperfluousActions(input: WorkflowSuperfluousActionsInput): Finding[];

package/dist/layer2-static/detectors/workflow-superfluous-actions.js

@@ -0,0 +1,70 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function normalizeUses(value) {
+    return value.trim().toLowerCase();
+}
+function isExternalUses(value) {
+    const normalized = value.trim();
+    return (normalized.length > 0 &&
+        !normalized.startsWith("./") &&
+        !normalized.startsWith("../") &&
+        !normalized.startsWith("docker://"));
+}
+export function detectWorkflowSuperfluousActions(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        const usesCounts = new Map();
+        job.steps.forEach((step, stepIndex) => {
+            const uses = step.uses?.trim();
+            if (!uses || !isExternalUses(uses)) {
+                return;
+            }
+            const key = normalizeUses(uses);
+            const current = usesCounts.get(key);
+            if (!current) {
+                usesCounts.set(key, { count: 1, firstStep: stepIndex, rawUses: uses });
+                return;
+            }
+            current.count += 1;
+        });
+        for (const [key, value] of usesCounts.entries()) {
+            if (value.count < 2) {
+                continue;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [value.rawUses],
+                fallbackValue: `${value.rawUses} repeated ${value.count} times`,
+            });
+            findings.push({
+                rule_id: "workflow-superfluous-actions",
+                finding_id: `WORKFLOW_SUPERFLUOUS_ACTIONS-${input.filePath}-${jobIndex}-${key}`,
+                severity: "LOW",
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${value.firstStep}].uses` },
+                description: "Workflow repeats the same external action in a single job",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-1059",
+                confidence: "MEDIUM",
+                fixable: false,
+                remediation_actions: [
+                    "Remove duplicate external action invocations unless repetition is explicitly required",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        }
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-template-injection.d.ts

@@ -0,0 +1,6 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowTemplateInjectionInput {
+    filePath: string;
+    parsed: unknown;
+}
+export declare function detectWorkflowTemplateInjection(input: WorkflowTemplateInjectionInput): Finding[];

package/dist/layer2-static/detectors/workflow-template-injection.js

@@ -0,0 +1,94 @@
+import sinkMap from "../workflow/injection-sinks.json" with { type: "json" };
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const UNTRUSTED_TRIGGERS = new Set([
+    "pull_request",
+    "pull_request_target",
+    "issue_comment",
+    "discussion_comment",
+    "workflow_run",
+]);
+function hasTemplateExpression(value) {
+    return typeof value === "string" && value.includes("${{");
+}
+function normalizeUsesSlug(value) {
+    const beforeRef = value.split("@")[0] ?? value;
+    return beforeRef.replace(/\/+$/u, "").toLowerCase();
+}
+export function detectWorkflowTemplateInjection(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const hasUntrustedTrigger = facts.triggers.some((trigger) => UNTRUSTED_TRIGGERS.has(trigger));
+    if (!hasUntrustedTrigger) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            if (hasTemplateExpression(step.run)) {
+                findings.push({
+                    rule_id: "workflow-template-injection",
+                    finding_id: `WORKFLOW_TEMPLATE_INJECTION-RUN-${input.filePath}-${jobIndex}-${stepIndex}`,
+                    severity: "HIGH",
+                    category: "CI_TEMPLATE_INJECTION",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                    description: "Template expression in run step may allow untrusted input to reach shell execution",
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-94",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: [
+                        "Move untrusted template expressions into validated environment variables before execution",
+                    ],
+                    evidence: step.run ?? null,
+                    suppressed: false,
+                });
+            }
+            const uses = step.uses?.trim();
+            if (!uses || !step.with) {
+                return;
+            }
+            const slug = normalizeUsesSlug(uses);
+            const sinkFields = sinkMap[slug];
+            if (!sinkFields || sinkFields.length === 0) {
+                return;
+            }
+            for (const sinkField of sinkFields) {
+                const sinkValue = step.with[sinkField];
+                if (!hasTemplateExpression(sinkValue)) {
+                    continue;
+                }
+                findings.push({
+                    rule_id: "workflow-template-injection",
+                    finding_id: `WORKFLOW_TEMPLATE_INJECTION-SINK-${input.filePath}-${jobIndex}-${stepIndex}-${sinkField}`,
+                    severity: "HIGH",
+                    category: "CI_TEMPLATE_INJECTION",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].with.${sinkField}` },
+                    description: "Template expression reaches an action input known to execute code or evaluate scripts",
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-94",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: [
+                        "Avoid passing untrusted template expressions into code execution sink inputs",
+                    ],
+                    evidence: sinkValue,
+                    suppressed: false,
+                });
+            }
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-undocumented-permissions.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUndocumentedPermissionsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUndocumentedPermissions(input: WorkflowUndocumentedPermissionsInput): Finding[];

package/dist/layer2-static/detectors/workflow-undocumented-permissions.js

@@ -0,0 +1,101 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function isWritePermission(value) {
+    if (typeof value === "string") {
+        return value === "write" || value === "write-all";
+    }
+    return false;
+}
+function lineContaining(textContent, term) {
+    const lines = textContent.split(/\r?\n/u);
+    for (const line of lines) {
+        if (line.includes(term)) {
+            return line;
+        }
+    }
+    return null;
+}
+function hasLineComment(textContent, term) {
+    const line = lineContaining(textContent, term);
+    return line ? line.includes("#") : false;
+}
+function pushPermissionFinding(findings, input, field, evidenceTerm, description, permissionValue) {
+    const evidence = buildFindingEvidence({
+        textContent: input.textContent,
+        searchTerms: [evidenceTerm, permissionValue],
+        fallbackValue: evidenceTerm,
+    });
+    findings.push({
+        rule_id: "workflow-undocumented-permissions",
+        finding_id: `WORKFLOW_UNDOCUMENTED_PERMISSIONS-${input.filePath}-${field}`,
+        severity: "HIGH",
+        category: "CI_PERMISSIONS",
+        layer: "L2",
+        file_path: input.filePath,
+        location: { field },
+        description,
+        affected_tools: ["github-actions"],
+        cve: null,
+        owasp: ["ASI02"],
+        cwe: "CWE-732",
+        confidence: "MEDIUM",
+        fixable: false,
+        remediation_actions: [
+            "Document why elevated permissions are required or reduce the permission scope",
+        ],
+        evidence: evidence?.evidence ?? null,
+        suppressed: false,
+    });
+}
+export function detectWorkflowUndocumentedPermissions(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    if (typeof facts.workflowPermissions === "string") {
+        const value = facts.workflowPermissions.trim().toLowerCase();
+        if ((value === "write-all" || value === "write") &&
+            !hasLineComment(input.textContent, "permissions:")) {
+            pushPermissionFinding(findings, input, "permissions", `permissions: ${facts.workflowPermissions}`, "Workflow defines elevated permissions without documenting why they are needed", `permissions: ${facts.workflowPermissions}`);
+        }
+    }
+    else if (facts.workflowPermissions && typeof facts.workflowPermissions === "object") {
+        for (const [scope, value] of Object.entries(facts.workflowPermissions)) {
+            if (!isWritePermission(value)) {
+                continue;
+            }
+            const term = `${scope}: ${value}`;
+            if (hasLineComment(input.textContent, term)) {
+                continue;
+            }
+            pushPermissionFinding(findings, input, `permissions.${scope}`, term, "Workflow defines elevated permissions without documenting why they are needed", term);
+        }
+    }
+    facts.jobs.forEach((job) => {
+        if (typeof job.permissions === "string") {
+            const value = job.permissions.trim().toLowerCase();
+            if (value === "write-all" && !hasLineComment(input.textContent, "permissions:")) {
+                pushPermissionFinding(findings, input, `jobs.${job.id}.permissions`, `permissions: ${job.permissions}`, "Job defines elevated permissions without documenting why they are needed", `permissions: ${job.permissions}`);
+            }
+            return;
+        }
+        if (!job.permissions || typeof job.permissions !== "object") {
+            return;
+        }
+        for (const [scope, value] of Object.entries(job.permissions)) {
+            if (!isWritePermission(value)) {
+                continue;
+            }
+            const term = `${scope}: ${value}`;
+            if (hasLineComment(input.textContent, term)) {
+                continue;
+            }
+            pushPermissionFinding(findings, input, `jobs.${job.id}.permissions.${scope}`, term, "Job defines elevated permissions without documenting why they are needed", term);
+        }
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-unpinned-images.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnpinnedImagesInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnpinnedImages(input: WorkflowUnpinnedImagesInput): Finding[];

package/dist/layer2-static/detectors/workflow-unpinned-images.js

@@ -0,0 +1,108 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const SHA256_DIGEST_RE = /@sha256:[a-f0-9]{64}$/iu;
+const MUTABLE_LATEST_TAG = "latest";
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function getImageTag(image) {
+    const trimmed = image.trim();
+    if (trimmed.length === 0 || trimmed.includes("@")) {
+        return null;
+    }
+    const lastSlash = trimmed.lastIndexOf("/");
+    const lastColon = trimmed.lastIndexOf(":");
+    if (lastColon <= lastSlash) {
+        return null;
+    }
+    const tag = trimmed.slice(lastColon + 1).trim();
+    return tag.length > 0 ? tag : null;
+}
+function isShaPinned(image) {
+    return SHA256_DIGEST_RE.test(image.trim());
+}
+function gatherImageTargets(parsed) {
+    const root = asRecord(parsed);
+    const jobsRecord = asRecord(root?.jobs);
+    if (!jobsRecord) {
+        return [];
+    }
+    const targets = [];
+    for (const [jobId, jobValue] of Object.entries(jobsRecord)) {
+        const jobRecord = asRecord(jobValue);
+        if (!jobRecord) {
+            continue;
+        }
+        const containerRecord = asRecord(jobRecord.container);
+        if (typeof containerRecord?.image === "string") {
+            targets.push({
+                field: `jobs.${jobId}.container.image`,
+                image: containerRecord.image,
+            });
+        }
+        const servicesRecord = asRecord(jobRecord.services);
+        if (servicesRecord) {
+            for (const [serviceName, serviceValue] of Object.entries(servicesRecord)) {
+                const serviceRecord = asRecord(serviceValue);
+                if (typeof serviceRecord?.image === "string") {
+                    targets.push({
+                        field: `jobs.${jobId}.services.${serviceName}.image`,
+                        image: serviceRecord.image,
+                    });
+                }
+            }
+        }
+    }
+    return targets;
+}
+export function detectWorkflowUnpinnedImages(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    if (!extractWorkflowFacts(input.parsed)) {
+        return [];
+    }
+    const findings = [];
+    for (const target of gatherImageTargets(input.parsed)) {
+        const trimmedImage = target.image.trim();
+        if (trimmedImage.length === 0 || isShaPinned(trimmedImage)) {
+            continue;
+        }
+        const tag = getImageTag(trimmedImage);
+        if (tag !== null && tag !== MUTABLE_LATEST_TAG) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [trimmedImage, "image:"],
+            fallbackValue: trimmedImage,
+        });
+        findings.push({
+            rule_id: "workflow-unpinned-images",
+            finding_id: `WORKFLOW_UNPINNED_IMAGES-${input.filePath}-${target.field}`,
+            severity: "HIGH",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: target.field },
+            description: tag === MUTABLE_LATEST_TAG
+                ? "Workflow container image uses the mutable latest tag"
+                : "Workflow container image is not pinned to a SHA256 digest",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-829",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Pin container images to immutable sha256 digests instead of mutable tags",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-unpinned-uses.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnpinnedUsesInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnpinnedUses(input: WorkflowUnpinnedUsesInput): Finding[];

package/dist/layer2-static/detectors/workflow-unpinned-uses.js

@@ -0,0 +1,60 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function isPinnedToCommit(ref) {
+    return /^[a-f0-9]{40}$/iu.test(ref.trim());
+}
+function isRepositoryUses(value) {
+    return /^[a-z0-9._-]+\/[a-z0-9._-]+(?:\/[^@]+)?@[^\s]+$/iu.test(value.trim());
+}
+export function detectWorkflowUnpinnedUses(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            const uses = step.uses?.trim();
+            if (!uses || uses.startsWith("./") || uses.startsWith("docker://")) {
+                return;
+            }
+            if (!isRepositoryUses(uses)) {
+                return;
+            }
+            const ref = uses.split("@").slice(1).join("@").trim();
+            if (ref.length === 0 || isPinnedToCommit(ref)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [uses],
+                fallbackValue: `uses: ${uses}`,
+            });
+            findings.push({
+                rule_id: "workflow-unpinned-uses",
+                finding_id: `WORKFLOW_UNPINNED_USES-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].uses` },
+                description: "Workflow action reference is not pinned to an immutable commit hash",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-829",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Pin external actions to a full commit SHA and track tag intent in comments",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-unredacted-secrets.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnredactedSecretsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnredactedSecrets(input: WorkflowUnredactedSecretsInput): Finding[];