codegate-ai 0.8.0 → 0.9.0

package/dist/layer2-static/detectors/workflow-superfluous-actions.js

@@ -0,0 +1,70 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function normalizeUses(value) {
+    return value.trim().toLowerCase();
+}
+function isExternalUses(value) {
+    const normalized = value.trim();
+    return (normalized.length > 0 &&
+        !normalized.startsWith("./") &&
+        !normalized.startsWith("../") &&
+        !normalized.startsWith("docker://"));
+}
+export function detectWorkflowSuperfluousActions(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        const usesCounts = new Map();
+        job.steps.forEach((step, stepIndex) => {
+            const uses = step.uses?.trim();
+            if (!uses || !isExternalUses(uses)) {
+                return;
+            }
+            const key = normalizeUses(uses);
+            const current = usesCounts.get(key);
+            if (!current) {
+                usesCounts.set(key, { count: 1, firstStep: stepIndex, rawUses: uses });
+                return;
+            }
+            current.count += 1;
+        });
+        for (const [key, value] of usesCounts.entries()) {
+            if (value.count < 2) {
+                continue;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [value.rawUses],
+                fallbackValue: `${value.rawUses} repeated ${value.count} times`,
+            });
+            findings.push({
+                rule_id: "workflow-superfluous-actions",
+                finding_id: `WORKFLOW_SUPERFLUOUS_ACTIONS-${input.filePath}-${jobIndex}-${key}`,
+                severity: "LOW",
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${value.firstStep}].uses` },
+                description: "Workflow repeats the same external action in a single job",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-1059",
+                confidence: "MEDIUM",
+                fixable: false,
+                remediation_actions: [
+                    "Remove duplicate external action invocations unless repetition is explicitly required",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        }
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-template-injection.d.ts

@@ -0,0 +1,6 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowTemplateInjectionInput {
+    filePath: string;
+    parsed: unknown;
+}
+export declare function detectWorkflowTemplateInjection(input: WorkflowTemplateInjectionInput): Finding[];

package/dist/layer2-static/detectors/workflow-template-injection.js

@@ -0,0 +1,94 @@
+import sinkMap from "../workflow/injection-sinks.json" with { type: "json" };
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const UNTRUSTED_TRIGGERS = new Set([
+    "pull_request",
+    "pull_request_target",
+    "issue_comment",
+    "discussion_comment",
+    "workflow_run",
+]);
+function hasTemplateExpression(value) {
+    return typeof value === "string" && value.includes("${{");
+}
+function normalizeUsesSlug(value) {
+    const beforeRef = value.split("@")[0] ?? value;
+    return beforeRef.replace(/\/+$/u, "").toLowerCase();
+}
+export function detectWorkflowTemplateInjection(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const hasUntrustedTrigger = facts.triggers.some((trigger) => UNTRUSTED_TRIGGERS.has(trigger));
+    if (!hasUntrustedTrigger) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            if (hasTemplateExpression(step.run)) {
+                findings.push({
+                    rule_id: "workflow-template-injection",
+                    finding_id: `WORKFLOW_TEMPLATE_INJECTION-RUN-${input.filePath}-${jobIndex}-${stepIndex}`,
+                    severity: "HIGH",
+                    category: "CI_TEMPLATE_INJECTION",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                    description: "Template expression in run step may allow untrusted input to reach shell execution",
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-94",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: [
+                        "Move untrusted template expressions into validated environment variables before execution",
+                    ],
+                    evidence: step.run ?? null,
+                    suppressed: false,
+                });
+            }
+            const uses = step.uses?.trim();
+            if (!uses || !step.with) {
+                return;
+            }
+            const slug = normalizeUsesSlug(uses);
+            const sinkFields = sinkMap[slug];
+            if (!sinkFields || sinkFields.length === 0) {
+                return;
+            }
+            for (const sinkField of sinkFields) {
+                const sinkValue = step.with[sinkField];
+                if (!hasTemplateExpression(sinkValue)) {
+                    continue;
+                }
+                findings.push({
+                    rule_id: "workflow-template-injection",
+                    finding_id: `WORKFLOW_TEMPLATE_INJECTION-SINK-${input.filePath}-${jobIndex}-${stepIndex}-${sinkField}`,
+                    severity: "HIGH",
+                    category: "CI_TEMPLATE_INJECTION",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].with.${sinkField}` },
+                    description: "Template expression reaches an action input known to execute code or evaluate scripts",
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-94",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: [
+                        "Avoid passing untrusted template expressions into code execution sink inputs",
+                    ],
+                    evidence: sinkValue,
+                    suppressed: false,
+                });
+            }
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-undocumented-permissions.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUndocumentedPermissionsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUndocumentedPermissions(input: WorkflowUndocumentedPermissionsInput): Finding[];

package/dist/layer2-static/detectors/workflow-undocumented-permissions.js

@@ -0,0 +1,101 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function isWritePermission(value) {
+    if (typeof value === "string") {
+        return value === "write" || value === "write-all";
+    }
+    return false;
+}
+function lineContaining(textContent, term) {
+    const lines = textContent.split(/\r?\n/u);
+    for (const line of lines) {
+        if (line.includes(term)) {
+            return line;
+        }
+    }
+    return null;
+}
+function hasLineComment(textContent, term) {
+    const line = lineContaining(textContent, term);
+    return line ? line.includes("#") : false;
+}
+function pushPermissionFinding(findings, input, field, evidenceTerm, description, permissionValue) {
+    const evidence = buildFindingEvidence({
+        textContent: input.textContent,
+        searchTerms: [evidenceTerm, permissionValue],
+        fallbackValue: evidenceTerm,
+    });
+    findings.push({
+        rule_id: "workflow-undocumented-permissions",
+        finding_id: `WORKFLOW_UNDOCUMENTED_PERMISSIONS-${input.filePath}-${field}`,
+        severity: "HIGH",
+        category: "CI_PERMISSIONS",
+        layer: "L2",
+        file_path: input.filePath,
+        location: { field },
+        description,
+        affected_tools: ["github-actions"],
+        cve: null,
+        owasp: ["ASI02"],
+        cwe: "CWE-732",
+        confidence: "MEDIUM",
+        fixable: false,
+        remediation_actions: [
+            "Document why elevated permissions are required or reduce the permission scope",
+        ],
+        evidence: evidence?.evidence ?? null,
+        suppressed: false,
+    });
+}
+export function detectWorkflowUndocumentedPermissions(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    if (typeof facts.workflowPermissions === "string") {
+        const value = facts.workflowPermissions.trim().toLowerCase();
+        if ((value === "write-all" || value === "write") &&
+            !hasLineComment(input.textContent, "permissions:")) {
+            pushPermissionFinding(findings, input, "permissions", `permissions: ${facts.workflowPermissions}`, "Workflow defines elevated permissions without documenting why they are needed", `permissions: ${facts.workflowPermissions}`);
+        }
+    }
+    else if (facts.workflowPermissions && typeof facts.workflowPermissions === "object") {
+        for (const [scope, value] of Object.entries(facts.workflowPermissions)) {
+            if (!isWritePermission(value)) {
+                continue;
+            }
+            const term = `${scope}: ${value}`;
+            if (hasLineComment(input.textContent, term)) {
+                continue;
+            }
+            pushPermissionFinding(findings, input, `permissions.${scope}`, term, "Workflow defines elevated permissions without documenting why they are needed", term);
+        }
+    }
+    facts.jobs.forEach((job) => {
+        if (typeof job.permissions === "string") {
+            const value = job.permissions.trim().toLowerCase();
+            if (value === "write-all" && !hasLineComment(input.textContent, "permissions:")) {
+                pushPermissionFinding(findings, input, `jobs.${job.id}.permissions`, `permissions: ${job.permissions}`, "Job defines elevated permissions without documenting why they are needed", `permissions: ${job.permissions}`);
+            }
+            return;
+        }
+        if (!job.permissions || typeof job.permissions !== "object") {
+            return;
+        }
+        for (const [scope, value] of Object.entries(job.permissions)) {
+            if (!isWritePermission(value)) {
+                continue;
+            }
+            const term = `${scope}: ${value}`;
+            if (hasLineComment(input.textContent, term)) {
+                continue;
+            }
+            pushPermissionFinding(findings, input, `jobs.${job.id}.permissions.${scope}`, term, "Job defines elevated permissions without documenting why they are needed", term);
+        }
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-unpinned-images.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnpinnedImagesInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnpinnedImages(input: WorkflowUnpinnedImagesInput): Finding[];

package/dist/layer2-static/detectors/workflow-unpinned-images.js

@@ -0,0 +1,108 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const SHA256_DIGEST_RE = /@sha256:[a-f0-9]{64}$/iu;
+const MUTABLE_LATEST_TAG = "latest";
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function getImageTag(image) {
+    const trimmed = image.trim();
+    if (trimmed.length === 0 || trimmed.includes("@")) {
+        return null;
+    }
+    const lastSlash = trimmed.lastIndexOf("/");
+    const lastColon = trimmed.lastIndexOf(":");
+    if (lastColon <= lastSlash) {
+        return null;
+    }
+    const tag = trimmed.slice(lastColon + 1).trim();
+    return tag.length > 0 ? tag : null;
+}
+function isShaPinned(image) {
+    return SHA256_DIGEST_RE.test(image.trim());
+}
+function gatherImageTargets(parsed) {
+    const root = asRecord(parsed);
+    const jobsRecord = asRecord(root?.jobs);
+    if (!jobsRecord) {
+        return [];
+    }
+    const targets = [];
+    for (const [jobId, jobValue] of Object.entries(jobsRecord)) {
+        const jobRecord = asRecord(jobValue);
+        if (!jobRecord) {
+            continue;
+        }
+        const containerRecord = asRecord(jobRecord.container);
+        if (typeof containerRecord?.image === "string") {
+            targets.push({
+                field: `jobs.${jobId}.container.image`,
+                image: containerRecord.image,
+            });
+        }
+        const servicesRecord = asRecord(jobRecord.services);
+        if (servicesRecord) {
+            for (const [serviceName, serviceValue] of Object.entries(servicesRecord)) {
+                const serviceRecord = asRecord(serviceValue);
+                if (typeof serviceRecord?.image === "string") {
+                    targets.push({
+                        field: `jobs.${jobId}.services.${serviceName}.image`,
+                        image: serviceRecord.image,
+                    });
+                }
+            }
+        }
+    }
+    return targets;
+}
+export function detectWorkflowUnpinnedImages(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    if (!extractWorkflowFacts(input.parsed)) {
+        return [];
+    }
+    const findings = [];
+    for (const target of gatherImageTargets(input.parsed)) {
+        const trimmedImage = target.image.trim();
+        if (trimmedImage.length === 0 || isShaPinned(trimmedImage)) {
+            continue;
+        }
+        const tag = getImageTag(trimmedImage);
+        if (tag !== null && tag !== MUTABLE_LATEST_TAG) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [trimmedImage, "image:"],
+            fallbackValue: trimmedImage,
+        });
+        findings.push({
+            rule_id: "workflow-unpinned-images",
+            finding_id: `WORKFLOW_UNPINNED_IMAGES-${input.filePath}-${target.field}`,
+            severity: "HIGH",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: target.field },
+            description: tag === MUTABLE_LATEST_TAG
+                ? "Workflow container image uses the mutable latest tag"
+                : "Workflow container image is not pinned to a SHA256 digest",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-829",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Pin container images to immutable sha256 digests instead of mutable tags",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-unpinned-uses.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnpinnedUsesInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnpinnedUses(input: WorkflowUnpinnedUsesInput): Finding[];

package/dist/layer2-static/detectors/workflow-unpinned-uses.js

@@ -0,0 +1,60 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function isPinnedToCommit(ref) {
+    return /^[a-f0-9]{40}$/iu.test(ref.trim());
+}
+function isRepositoryUses(value) {
+    return /^[a-z0-9._-]+\/[a-z0-9._-]+(?:\/[^@]+)?@[^\s]+$/iu.test(value.trim());
+}
+export function detectWorkflowUnpinnedUses(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            const uses = step.uses?.trim();
+            if (!uses || uses.startsWith("./") || uses.startsWith("docker://")) {
+                return;
+            }
+            if (!isRepositoryUses(uses)) {
+                return;
+            }
+            const ref = uses.split("@").slice(1).join("@").trim();
+            if (ref.length === 0 || isPinnedToCommit(ref)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [uses],
+                fallbackValue: `uses: ${uses}`,
+            });
+            findings.push({
+                rule_id: "workflow-unpinned-uses",
+                finding_id: `WORKFLOW_UNPINNED_USES-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].uses` },
+                description: "Workflow action reference is not pinned to an immutable commit hash",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-829",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Pin external actions to a full commit SHA and track tag intent in comments",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-unredacted-secrets.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnredactedSecretsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnredactedSecrets(input: WorkflowUnredactedSecretsInput): Finding[];

package/dist/layer2-static/detectors/workflow-unredacted-secrets.js

@@ -0,0 +1,92 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const SECRET_KEY_PATTERN = /(token|password|secret|api[_-]?key|private[_-]?key|access[_-]?key)/iu;
+const REDACTED_VALUE_PATTERN = /^\s*\$\{\{\s*secrets\.[^}]+\}\}\s*$/iu;
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function collectEnvSecrets(envValue, baseField, candidates) {
+    const env = asRecord(envValue);
+    if (!env) {
+        return;
+    }
+    for (const [key, value] of Object.entries(env)) {
+        if (!SECRET_KEY_PATTERN.test(key) || typeof value !== "string") {
+            continue;
+        }
+        const trimmed = value.trim();
+        if (trimmed.length < 8 || REDACTED_VALUE_PATTERN.test(trimmed)) {
+            continue;
+        }
+        candidates.push({
+            field: `${baseField}.${key}`,
+            key,
+            value: trimmed,
+        });
+    }
+}
+function gatherSecretCandidates(parsed) {
+    const root = asRecord(parsed);
+    const candidates = [];
+    collectEnvSecrets(root?.env, "env", candidates);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return candidates;
+    }
+    for (const [jobId, jobValue] of Object.entries(jobs)) {
+        const job = asRecord(jobValue);
+        if (!job) {
+            continue;
+        }
+        collectEnvSecrets(job.env, `jobs.${jobId}.env`, candidates);
+        const steps = Array.isArray(job.steps) ? job.steps : [];
+        steps.forEach((stepValue, stepIndex) => {
+            const step = asRecord(stepValue);
+            if (!step) {
+                return;
+            }
+            collectEnvSecrets(step.env, `jobs.${jobId}.steps[${stepIndex}].env`, candidates);
+        });
+    }
+    return candidates;
+}
+export function detectWorkflowUnredactedSecrets(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    return gatherSecretCandidates(input.parsed).map((candidate) => {
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [candidate.key, candidate.value],
+            fallbackValue: `${candidate.key} set to plaintext value`,
+        });
+        return {
+            rule_id: "unredacted-secrets",
+            finding_id: `UNREDACTED_SECRETS-${input.filePath}-${candidate.field}`,
+            severity: "HIGH",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: candidate.field },
+            description: "Workflow exposes a plaintext secret-like value in environment configuration",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-798",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Move secret material to GitHub encrypted secrets and reference it via ${{ secrets.* }}",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        };
+    });
+}

package/dist/layer2-static/detectors/workflow-unsound-condition.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnsoundConditionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnsoundCondition(input: WorkflowUnsoundConditionInput): Finding[];

package/dist/layer2-static/detectors/workflow-unsound-condition.js

@@ -0,0 +1,90 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const SENSITIVE_COMMANDS = ["publish", "deploy", "release", "push"];
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function gatherStepConditions(parsed) {
+    const root = asRecord(parsed);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return [];
+    }
+    const candidates = [];
+    for (const [jobId, jobValue] of Object.entries(jobs)) {
+        const job = asRecord(jobValue);
+        const steps = Array.isArray(job?.steps) ? job.steps : [];
+        steps.forEach((stepValue, stepIndex) => {
+            const step = asRecord(stepValue);
+            const condition = typeof step?.if === "string" ? step.if : undefined;
+            if (!condition) {
+                return;
+            }
+            candidates.push({
+                jobId,
+                stepIndex,
+                condition,
+                run: typeof step?.run === "string" ? step.run : undefined,
+                uses: typeof step?.uses === "string" ? step.uses : undefined,
+            });
+        });
+    }
+    return candidates;
+}
+function isAlwaysCondition(condition) {
+    const normalized = condition.toLowerCase();
+    return normalized.includes("always()");
+}
+function isSensitiveExecution(run, uses) {
+    const runValue = run?.toLowerCase() ?? "";
+    if (SENSITIVE_COMMANDS.some((token) => runValue.includes(token))) {
+        return true;
+    }
+    return typeof uses === "string" && uses.trim().length > 0;
+}
+export function detectWorkflowUnsoundCondition(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    for (const candidate of gatherStepConditions(input.parsed)) {
+        if (!isAlwaysCondition(candidate.condition) ||
+            !isSensitiveExecution(candidate.run, candidate.uses)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [candidate.condition, candidate.run ?? "", candidate.uses ?? ""],
+            fallbackValue: candidate.condition,
+        });
+        findings.push({
+            rule_id: "workflow-unsound-condition",
+            finding_id: `WORKFLOW_UNSOUND_CONDITION-${input.filePath}-${candidate.jobId}-${candidate.stepIndex}`,
+            severity: "MEDIUM",
+            category: "CI_TRIGGER",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${candidate.jobId}.steps[${candidate.stepIndex}].if` },
+            description: "Workflow uses always() on a sensitive step, which can bypass expected failure gating",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-754",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Replace always() with explicit success and trust-boundary checks for sensitive steps",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-unsound-contains.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnsoundContainsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnsoundContains(input: WorkflowUnsoundContainsInput): Finding[];