codegate-ai 0.8.0 → 0.9.0

package/dist/layer2-static/detectors/workflow-concurrency-limits.js

@@ -0,0 +1,76 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function hasRiskyTrigger(triggers) {
+    return triggers.some((trigger) => trigger === "pull_request_target" ||
+        trigger === "workflow_run" ||
+        trigger === "issue_comment");
+}
+function hasWorkflowConcurrency(parsed) {
+    const root = asRecord(parsed);
+    const concurrency = root?.concurrency;
+    if (typeof concurrency === "string") {
+        return concurrency.trim().length > 0;
+    }
+    return asRecord(concurrency) !== null;
+}
+function hasAnyJobConcurrency(parsed) {
+    const root = asRecord(parsed);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return false;
+    }
+    return Object.values(jobs).some((jobValue) => {
+        const job = asRecord(jobValue);
+        const concurrency = job?.concurrency;
+        if (typeof concurrency === "string") {
+            return concurrency.trim().length > 0;
+        }
+        return asRecord(concurrency) !== null;
+    });
+}
+export function detectWorkflowConcurrencyLimits(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts || !hasRiskyTrigger(facts.triggers)) {
+        return [];
+    }
+    if (hasWorkflowConcurrency(input.parsed) || hasAnyJobConcurrency(input.parsed)) {
+        return [];
+    }
+    const evidence = buildFindingEvidence({
+        textContent: input.textContent,
+        searchTerms: ["pull_request_target", "workflow_run", "issue_comment", "concurrency"],
+        fallbackValue: "risky trigger without concurrency limits",
+    });
+    return [
+        {
+            rule_id: "workflow-concurrency-limits",
+            finding_id: `WORKFLOW_CONCURRENCY_LIMITS-${input.filePath}`,
+            severity: "MEDIUM",
+            category: "CI_TRIGGER",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: "concurrency" },
+            description: "Workflow uses risky triggers without concurrency controls, increasing race and replay risk",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-362",
+            confidence: "MEDIUM",
+            fixable: false,
+            remediation_actions: [
+                "Define workflow- or job-level concurrency groups with cancel-in-progress controls",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        },
+    ];
+}

package/dist/layer2-static/detectors/workflow-dangerous-triggers.d.ts

@@ -0,0 +1,6 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowDangerousTriggersInput {
+    filePath: string;
+    parsed: unknown;
+}
+export declare function detectWorkflowDangerousTriggers(input: WorkflowDangerousTriggersInput): Finding[];

package/dist/layer2-static/detectors/workflow-dangerous-triggers.js

@@ -0,0 +1,38 @@
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const DANGEROUS_TRIGGERS = new Set(["pull_request_target", "workflow_run"]);
+export function detectWorkflowDangerousTriggers(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const triggers = facts.triggers.filter((trigger) => DANGEROUS_TRIGGERS.has(trigger));
+    if (triggers.length === 0) {
+        return [];
+    }
+    return [
+        {
+            rule_id: "workflow-dangerous-triggers",
+            finding_id: `WORKFLOW_DANGEROUS_TRIGGERS-${input.filePath}`,
+            severity: "HIGH",
+            category: "CI_TRIGGER",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: "on" },
+            description: `Workflow uses high-risk trigger(s): ${triggers.join(", ")}`,
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-693",
+            confidence: "MEDIUM",
+            fixable: false,
+            remediation_actions: [
+                "Restrict trigger conditions and avoid running untrusted pull request data in privileged contexts",
+            ],
+            evidence: triggers.join(", "),
+            suppressed: false,
+        },
+    ];
+}

package/dist/layer2-static/detectors/workflow-excessive-permissions.d.ts

@@ -0,0 +1,6 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowExcessivePermissionsInput {
+    filePath: string;
+    parsed: unknown;
+}
+export declare function detectWorkflowExcessivePermissions(input: WorkflowExcessivePermissionsInput): Finding[];

package/dist/layer2-static/detectors/workflow-excessive-permissions.js

@@ -0,0 +1,65 @@
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function hasWritePermission(value) {
+    if (typeof value === "string") {
+        return value === "write-all";
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    return Object.values(value).some((permission) => permission === "write");
+}
+export function detectWorkflowExcessivePermissions(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    if (hasWritePermission(facts.workflowPermissions)) {
+        findings.push({
+            rule_id: "workflow-excessive-permissions",
+            finding_id: `WORKFLOW_EXCESSIVE_PERMISSIONS-WORKFLOW-${input.filePath}`,
+            severity: "HIGH",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: "permissions" },
+            description: "Workflow defines overly broad write permissions",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-732",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: ["Scope GITHUB_TOKEN permissions to least privilege"],
+            evidence: typeof facts.workflowPermissions === "string" ? facts.workflowPermissions : null,
+            suppressed: false,
+        });
+    }
+    facts.jobs.forEach((job, index) => {
+        if (!hasWritePermission(job.permissions)) {
+            return;
+        }
+        findings.push({
+            rule_id: "workflow-excessive-permissions",
+            finding_id: `WORKFLOW_EXCESSIVE_PERMISSIONS-JOB-${input.filePath}-${index}`,
+            severity: "HIGH",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${job.id}.permissions` },
+            description: "Job defines overly broad write permissions",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-732",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: ["Reduce job-level permissions to required read scopes"],
+            suppressed: false,
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-forbidden-uses.d.ts

@@ -0,0 +1,12 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowForbiddenUsesRuleConfig {
+    allow?: string[];
+    deny?: string[];
+}
+export interface WorkflowForbiddenUsesInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+    config?: WorkflowForbiddenUsesRuleConfig;
+}
+export declare function detectWorkflowForbiddenUses(input: WorkflowForbiddenUsesInput): Finding[];

package/dist/layer2-static/detectors/workflow-forbidden-uses.js

@@ -0,0 +1,148 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function normalizePattern(value) {
+    return value.replaceAll("\\", "/").trim().toLowerCase();
+}
+function globToRegExp(glob) {
+    const pattern = normalizePattern(glob);
+    if (pattern.length === 0) {
+        return /^$/;
+    }
+    let regex = "^";
+    for (let index = 0; index < pattern.length; index += 1) {
+        const char = pattern[index];
+        if (char === "*") {
+            if (pattern[index + 1] === "*") {
+                regex += ".*";
+                index += 1;
+            }
+            else {
+                regex += "[^/]*";
+            }
+            continue;
+        }
+        if (char === "?") {
+            regex += "[^/]";
+            continue;
+        }
+        regex += char.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+    }
+    regex += "$";
+    return new RegExp(regex);
+}
+function compilePatterns(patterns) {
+    return patterns.map((pattern) => globToRegExp(pattern));
+}
+function matchesRepositoryPattern(value, pattern) {
+    return pattern.test(value.toLowerCase());
+}
+function parseRepositoryUses(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("./") || trimmed.startsWith("docker://")) {
+        return null;
+    }
+    const atIndex = trimmed.lastIndexOf("@");
+    if (atIndex < 0) {
+        return null;
+    }
+    const slug = trimmed.slice(0, atIndex).trim().replace(/\/+$/u, "").toLowerCase();
+    const ref = trimmed
+        .slice(atIndex + 1)
+        .trim()
+        .toLowerCase();
+    if (slug.length === 0 || !slug.includes("/") || ref.length === 0) {
+        return null;
+    }
+    return { slug, ref };
+}
+function getForbiddenPolicy(config) {
+    const allow = config?.allow?.filter((pattern) => pattern.trim().length > 0) ?? [];
+    const deny = config?.deny?.filter((pattern) => pattern.trim().length > 0) ?? [];
+    const allowPatterns = compilePatterns(allow);
+    const denyPatterns = compilePatterns(deny);
+    if (allow.length > 0) {
+        return {
+            mode: "allow",
+            allow: allowPatterns,
+            deny: denyPatterns,
+        };
+    }
+    if (deny.length > 0) {
+        return {
+            mode: "deny",
+            allow: [],
+            deny: denyPatterns,
+        };
+    }
+    return null;
+}
+function isForbidden(uses, policy) {
+    const parsed = parseRepositoryUses(uses);
+    if (!parsed) {
+        return false;
+    }
+    if (policy.deny.some((pattern) => matchesRepositoryPattern(parsed.slug, pattern))) {
+        return true;
+    }
+    if (policy.mode === "allow" &&
+        !policy.allow.some((pattern) => matchesRepositoryPattern(parsed.slug, pattern))) {
+        return true;
+    }
+    return false;
+}
+export function detectWorkflowForbiddenUses(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const policy = getForbiddenPolicy(input.config);
+    if (!policy) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            const uses = step.uses?.trim();
+            if (!uses) {
+                return;
+            }
+            if (!isForbidden(uses, policy)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [uses],
+                fallbackValue: `uses: ${uses}`,
+            });
+            findings.push({
+                rule_id: "workflow-forbidden-uses",
+                finding_id: `WORKFLOW_FORBIDDEN_USES-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].uses` },
+                description: policy.mode === "allow"
+                    ? "Workflow uses repository action outside the configured allowlist"
+                    : "Workflow uses repository action matching the configured denylist",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-829",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    policy.mode === "allow"
+                        ? "Add the action to the allowlist only if it is explicitly trusted"
+                        : "Remove the action or move it to an allowlist-only policy if it is trusted",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-github-env.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowGithubEnvInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowGithubEnv(input: WorkflowGithubEnvInput): Finding[];

package/dist/layer2-static/detectors/workflow-github-env.js

@@ -0,0 +1,49 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function writesToGithubEnv(run) {
+    return typeof run === "string" && />>\s*["']?\$?\{?GITHUB_ENV\}?/iu.test(run);
+}
+export function detectWorkflowGithubEnv(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            if (!writesToGithubEnv(step.run)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [step.run ?? "", "GITHUB_ENV"],
+                fallbackValue: step.run ?? "write to GITHUB_ENV",
+            });
+            findings.push({
+                rule_id: "workflow-github-env",
+                finding_id: `WORKFLOW_GITHUB_ENV-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                description: "Run step writes to GITHUB_ENV",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-94",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Avoid writing attacker-controlled values to GITHUB_ENV and prefer validated environment variables",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-hardcoded-container-credentials.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowHardcodedContainerCredentialsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowHardcodedContainerCredentials(input: WorkflowHardcodedContainerCredentialsInput): Finding[];

package/dist/layer2-static/detectors/workflow-hardcoded-container-credentials.js

@@ -0,0 +1,90 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const CREDENTIAL_IN_IMAGE_PATTERNS = [/:\/\/[^/\s:@]+:[^@\s]+@/iu, /:[^@\s]+@(?!sha256:)/iu];
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function gatherImageTargets(parsed) {
+    const root = asRecord(parsed);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return [];
+    }
+    const targets = [];
+    for (const [jobId, jobValue] of Object.entries(jobs)) {
+        const job = asRecord(jobValue);
+        if (!job) {
+            continue;
+        }
+        const container = asRecord(job.container);
+        if (typeof container?.image === "string") {
+            targets.push({
+                field: `jobs.${jobId}.container.image`,
+                image: container.image,
+            });
+        }
+        const services = asRecord(job.services);
+        if (!services) {
+            continue;
+        }
+        for (const [serviceName, serviceValue] of Object.entries(services)) {
+            const service = asRecord(serviceValue);
+            if (typeof service?.image === "string") {
+                targets.push({
+                    field: `jobs.${jobId}.services.${serviceName}.image`,
+                    image: service.image,
+                });
+            }
+        }
+    }
+    return targets;
+}
+function hasEmbeddedCredentials(image) {
+    const value = image.trim();
+    return CREDENTIAL_IN_IMAGE_PATTERNS.some((pattern) => pattern.test(value));
+}
+export function detectWorkflowHardcodedContainerCredentials(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    for (const target of gatherImageTargets(input.parsed)) {
+        if (!hasEmbeddedCredentials(target.image)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [target.image, "image:"],
+            fallbackValue: target.image,
+        });
+        findings.push({
+            rule_id: "hardcoded-container-credentials",
+            finding_id: `HARDCODED_CONTAINER_CREDENTIALS-${input.filePath}-${target.field}`,
+            severity: "HIGH",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: target.field },
+            description: "Container image reference appears to embed static credentials",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-798",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Remove embedded credentials from image references and use short-lived registry auth",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-impostor-commit.d.ts

@@ -0,0 +1,9 @@
+import type { RuntimeMode } from "../../config.js";
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowImpostorCommitInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+    runtimeMode?: RuntimeMode;
+}
+export declare function detectWorkflowImpostorCommit(input: WorkflowImpostorCommitInput): Promise<Finding[]>;

package/dist/layer2-static/detectors/workflow-impostor-commit.js

@@ -0,0 +1,127 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const GITHUB_API_HEADERS = {
+    Accept: "application/vnd.github+json",
+};
+function splitOwnerRepo(slug) {
+    const firstSlash = slug.indexOf("/");
+    if (firstSlash < 0) {
+        return null;
+    }
+    const owner = slug.slice(0, firstSlash);
+    const repo = slug.slice(firstSlash + 1).split("/")[0];
+    if (!owner || !repo) {
+        return null;
+    }
+    return { owner, repo };
+}
+function isPinnedToCommit(ref) {
+    return /^[a-f0-9]{40}$/iu.test(ref.trim());
+}
+function parseRepositoryUses(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("./") || trimmed.startsWith("docker://")) {
+        return null;
+    }
+    const atIndex = trimmed.lastIndexOf("@");
+    if (atIndex < 0) {
+        return null;
+    }
+    const slug = trimmed.slice(0, atIndex).trim().replace(/\/+$/u, "").toLowerCase();
+    const ref = trimmed.slice(atIndex + 1).trim();
+    if (!slug.includes("/") || ref.length === 0) {
+        return null;
+    }
+    return { slug, ref };
+}
+function parseUsesLine(line, lineNumber) {
+    const match = line.match(/^\s*(?:-\s*)?uses:\s*([^#]+?)(?:\s*#.*)?\s*$/iu);
+    if (!match?.[1]) {
+        return null;
+    }
+    const uses = match[1].trim();
+    const usesColumn = line.indexOf("uses:");
+    return {
+        lineNumber,
+        column: usesColumn >= 0 ? usesColumn + 1 : 1,
+        rawLine: line,
+        uses,
+    };
+}
+async function fetchGitHubJson(url) {
+    try {
+        const response = await fetch(url, {
+            headers: GITHUB_API_HEADERS,
+        });
+        if (!response.ok) {
+            return null;
+        }
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+async function repositoryHasCommit(owner, repo, sha) {
+    const url = `https://api.github.com/repos/${owner}/${repo}/commits/${encodeURIComponent(sha)}`;
+    const payload = (await fetchGitHubJson(url));
+    return typeof payload?.sha === "string" && payload.sha.length > 0;
+}
+export async function detectWorkflowImpostorCommit(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    if (!extractWorkflowFacts(input.parsed)) {
+        return [];
+    }
+    const mode = input.runtimeMode ?? "offline";
+    if (mode !== "online") {
+        return [];
+    }
+    const findings = [];
+    const lines = input.textContent.split(/\r?\n/u);
+    for (const [index, line] of lines.entries()) {
+        const parsedLine = parseUsesLine(line, index + 1);
+        if (!parsedLine) {
+            continue;
+        }
+        const parsedUses = parseRepositoryUses(parsedLine.uses);
+        if (!parsedUses || !isPinnedToCommit(parsedUses.ref)) {
+            continue;
+        }
+        const ownerRepo = splitOwnerRepo(parsedUses.slug);
+        if (!ownerRepo) {
+            continue;
+        }
+        if (await repositoryHasCommit(ownerRepo.owner, ownerRepo.repo, parsedUses.ref)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [parsedLine.rawLine, parsedUses.ref, parsedUses.slug],
+            fallbackValue: parsedLine.rawLine.trim(),
+        });
+        findings.push({
+            rule_id: "workflow-impostor-commit",
+            finding_id: `WORKFLOW_IMPOSTOR_COMMIT-${input.filePath}-${index + 1}`,
+            severity: "HIGH",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { line: parsedLine.lineNumber, column: parsedLine.column },
+            description: "Pinned action commit is not present in the referenced repository",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-829",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Pin the action to a commit that exists in the referenced repository and review the upstream history before updating",
+            ],
+            evidence: evidence?.evidence ?? parsedLine.rawLine.trim(),
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-insecure-commands.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowInsecureCommandsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowInsecureCommands(input: WorkflowInsecureCommandsInput): Finding[];