codegate-ai 0.7.0 → 0.9.0

package/dist/layer2-static/detectors/workflow-unredacted-secrets.js

@@ -0,0 +1,92 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const SECRET_KEY_PATTERN = /(token|password|secret|api[_-]?key|private[_-]?key|access[_-]?key)/iu;
+const REDACTED_VALUE_PATTERN = /^\s*\$\{\{\s*secrets\.[^}]+\}\}\s*$/iu;
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function collectEnvSecrets(envValue, baseField, candidates) {
+    const env = asRecord(envValue);
+    if (!env) {
+        return;
+    }
+    for (const [key, value] of Object.entries(env)) {
+        if (!SECRET_KEY_PATTERN.test(key) || typeof value !== "string") {
+            continue;
+        }
+        const trimmed = value.trim();
+        if (trimmed.length < 8 || REDACTED_VALUE_PATTERN.test(trimmed)) {
+            continue;
+        }
+        candidates.push({
+            field: `${baseField}.${key}`,
+            key,
+            value: trimmed,
+        });
+    }
+}
+function gatherSecretCandidates(parsed) {
+    const root = asRecord(parsed);
+    const candidates = [];
+    collectEnvSecrets(root?.env, "env", candidates);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return candidates;
+    }
+    for (const [jobId, jobValue] of Object.entries(jobs)) {
+        const job = asRecord(jobValue);
+        if (!job) {
+            continue;
+        }
+        collectEnvSecrets(job.env, `jobs.${jobId}.env`, candidates);
+        const steps = Array.isArray(job.steps) ? job.steps : [];
+        steps.forEach((stepValue, stepIndex) => {
+            const step = asRecord(stepValue);
+            if (!step) {
+                return;
+            }
+            collectEnvSecrets(step.env, `jobs.${jobId}.steps[${stepIndex}].env`, candidates);
+        });
+    }
+    return candidates;
+}
+export function detectWorkflowUnredactedSecrets(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    return gatherSecretCandidates(input.parsed).map((candidate) => {
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [candidate.key, candidate.value],
+            fallbackValue: `${candidate.key} set to plaintext value`,
+        });
+        return {
+            rule_id: "unredacted-secrets",
+            finding_id: `UNREDACTED_SECRETS-${input.filePath}-${candidate.field}`,
+            severity: "HIGH",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: candidate.field },
+            description: "Workflow exposes a plaintext secret-like value in environment configuration",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-798",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Move secret material to GitHub encrypted secrets and reference it via ${{ secrets.* }}",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        };
+    });
+}

package/dist/layer2-static/detectors/workflow-unsound-condition.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnsoundConditionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnsoundCondition(input: WorkflowUnsoundConditionInput): Finding[];

package/dist/layer2-static/detectors/workflow-unsound-condition.js

@@ -0,0 +1,90 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const SENSITIVE_COMMANDS = ["publish", "deploy", "release", "push"];
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function gatherStepConditions(parsed) {
+    const root = asRecord(parsed);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return [];
+    }
+    const candidates = [];
+    for (const [jobId, jobValue] of Object.entries(jobs)) {
+        const job = asRecord(jobValue);
+        const steps = Array.isArray(job?.steps) ? job.steps : [];
+        steps.forEach((stepValue, stepIndex) => {
+            const step = asRecord(stepValue);
+            const condition = typeof step?.if === "string" ? step.if : undefined;
+            if (!condition) {
+                return;
+            }
+            candidates.push({
+                jobId,
+                stepIndex,
+                condition,
+                run: typeof step?.run === "string" ? step.run : undefined,
+                uses: typeof step?.uses === "string" ? step.uses : undefined,
+            });
+        });
+    }
+    return candidates;
+}
+function isAlwaysCondition(condition) {
+    const normalized = condition.toLowerCase();
+    return normalized.includes("always()");
+}
+function isSensitiveExecution(run, uses) {
+    const runValue = run?.toLowerCase() ?? "";
+    if (SENSITIVE_COMMANDS.some((token) => runValue.includes(token))) {
+        return true;
+    }
+    return typeof uses === "string" && uses.trim().length > 0;
+}
+export function detectWorkflowUnsoundCondition(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    for (const candidate of gatherStepConditions(input.parsed)) {
+        if (!isAlwaysCondition(candidate.condition) ||
+            !isSensitiveExecution(candidate.run, candidate.uses)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [candidate.condition, candidate.run ?? "", candidate.uses ?? ""],
+            fallbackValue: candidate.condition,
+        });
+        findings.push({
+            rule_id: "workflow-unsound-condition",
+            finding_id: `WORKFLOW_UNSOUND_CONDITION-${input.filePath}-${candidate.jobId}-${candidate.stepIndex}`,
+            severity: "MEDIUM",
+            category: "CI_TRIGGER",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${candidate.jobId}.steps[${candidate.stepIndex}].if` },
+            description: "Workflow uses always() on a sensitive step, which can bypass expected failure gating",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-754",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Replace always() with explicit success and trust-boundary checks for sensitive steps",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-unsound-contains.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnsoundContainsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnsoundContains(input: WorkflowUnsoundContainsInput): Finding[];

package/dist/layer2-static/detectors/workflow-unsound-contains.js

@@ -0,0 +1,88 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const PRIVILEGED_COMMANDS = ["publish", "deploy", "release", "gh release"];
+const UNTRUSTED_CONTAINS_PATTERNS = [
+    /contains\s*\(\s*github\.event\.pull_request\.(?:title|body)/iu,
+    /contains\s*\(\s*github\.event\.comment\.body/iu,
+    /contains\s*\(\s*github\.event\.issue\.title/iu,
+];
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function gatherStepConditions(parsed) {
+    const root = asRecord(parsed);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return [];
+    }
+    const candidates = [];
+    for (const [jobId, jobValue] of Object.entries(jobs)) {
+        const job = asRecord(jobValue);
+        const steps = Array.isArray(job?.steps) ? job.steps : [];
+        steps.forEach((stepValue, stepIndex) => {
+            const step = asRecord(stepValue);
+            if (!step || typeof step.if !== "string") {
+                return;
+            }
+            candidates.push({
+                jobId,
+                stepIndex,
+                condition: step.if,
+                run: typeof step.run === "string" ? step.run : undefined,
+            });
+        });
+    }
+    return candidates;
+}
+function isUnsoundContains(condition) {
+    return UNTRUSTED_CONTAINS_PATTERNS.some((pattern) => pattern.test(condition));
+}
+function isPrivilegedStep(run) {
+    const normalized = run?.toLowerCase() ?? "";
+    return PRIVILEGED_COMMANDS.some((command) => normalized.includes(command));
+}
+export function detectWorkflowUnsoundContains(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    for (const candidate of gatherStepConditions(input.parsed)) {
+        if (!isUnsoundContains(candidate.condition) || !isPrivilegedStep(candidate.run)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [candidate.condition, candidate.run ?? ""],
+            fallbackValue: candidate.condition,
+        });
+        findings.push({
+            rule_id: "workflow-unsound-contains",
+            finding_id: `WORKFLOW_UNSOUND_CONTAINS-${input.filePath}-${candidate.jobId}-${candidate.stepIndex}`,
+            severity: "HIGH",
+            category: "CI_TRIGGER",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${candidate.jobId}.steps[${candidate.stepIndex}].if` },
+            description: "Workflow gates a privileged step with contains() over untrusted event content",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-20",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Avoid trust decisions based on contains() over untrusted titles, bodies, or comments",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-use-trusted-publishing.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUseTrustedPublishingInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUseTrustedPublishing(input: WorkflowUseTrustedPublishingInput): Finding[];

package/dist/layer2-static/detectors/workflow-use-trusted-publishing.js

@@ -0,0 +1,66 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const PUBLISH_COMMANDS = ["npm publish", "pnpm publish", "yarn npm publish", "twine upload"];
+const TOKEN_NAMES = ["NODE_AUTH_TOKEN", "NPM_TOKEN", "TWINE_USERNAME", "TWINE_PASSWORD"];
+function containsPublishCommand(value) {
+    if (!value) {
+        return false;
+    }
+    return PUBLISH_COMMANDS.some((command) => value.includes(command));
+}
+function findTokenName(textContent) {
+    for (const tokenName of TOKEN_NAMES) {
+        if (textContent.includes(tokenName)) {
+            return tokenName;
+        }
+    }
+    return null;
+}
+export function detectWorkflowUseTrustedPublishing(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const tokenName = findTokenName(input.textContent);
+    if (!tokenName) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            if (!containsPublishCommand(step.run)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [step.run ?? "", tokenName],
+                fallbackValue: step.run ?? tokenName,
+            });
+            findings.push({
+                rule_id: "workflow-use-trusted-publishing",
+                finding_id: `WORKFLOW_USE_TRUSTED_PUBLISHING-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_PERMISSIONS",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                description: "Package publication uses long-lived registry credentials instead of trusted publishing",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-798",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Switch package publishing to trusted publishing with OIDC and remove registry secrets",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/engine.d.ts

@@ -1,6 +1,7 @@
 import { type GitHookEntry } from "./detectors/git-hooks.js";
 import { type SymlinkEscapeEntry } from "./detectors/symlink.js";
-import type { Finding } from "../types/finding.js";
+import type { AuditPersona, RuntimeMode } from "../config.js";
+import { type Finding } from "../types/finding.js";
 import type { DiscoveryFormat } from "../types/discovery.js";
 export interface StaticFileInput {
     filePath: string;
@@ -17,6 +18,16 @@ export interface StaticEngineConfig {
     trustedApiDomains: string[];
     unicodeAnalysis: boolean;
     checkIdeSettings: boolean;
+    rulePackPaths?: string[];
+    allowedRules?: string[];
+    skipRules?: string[];
+    persona?: AuditPersona;
+    runtimeMode?: RuntimeMode;
+    workflowAuditsEnabled?: boolean;
+    rulePolicies?: Record<string, {
+        disable?: boolean;
+        config?: Record<string, unknown>;
+    }>;
 }
 export interface StaticEngineInput {
     projectRoot: string;
@@ -25,4 +36,4 @@ export interface StaticEngineInput {
     hooks: GitHookEntry[];
     config: StaticEngineConfig;
 }
-export declare function runStaticEngine(input: StaticEngineInput): Finding[];
+export declare function runStaticEngine(input: StaticEngineInput): Promise<Finding[]>;