codegate-ai 0.8.0 → 0.9.0

package/dist/layer2-static/detectors/workflow-unsound-contains.js

@@ -0,0 +1,88 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const PRIVILEGED_COMMANDS = ["publish", "deploy", "release", "gh release"];
+const UNTRUSTED_CONTAINS_PATTERNS = [
+    /contains\s*\(\s*github\.event\.pull_request\.(?:title|body)/iu,
+    /contains\s*\(\s*github\.event\.comment\.body/iu,
+    /contains\s*\(\s*github\.event\.issue\.title/iu,
+];
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function gatherStepConditions(parsed) {
+    const root = asRecord(parsed);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return [];
+    }
+    const candidates = [];
+    for (const [jobId, jobValue] of Object.entries(jobs)) {
+        const job = asRecord(jobValue);
+        const steps = Array.isArray(job?.steps) ? job.steps : [];
+        steps.forEach((stepValue, stepIndex) => {
+            const step = asRecord(stepValue);
+            if (!step || typeof step.if !== "string") {
+                return;
+            }
+            candidates.push({
+                jobId,
+                stepIndex,
+                condition: step.if,
+                run: typeof step.run === "string" ? step.run : undefined,
+            });
+        });
+    }
+    return candidates;
+}
+function isUnsoundContains(condition) {
+    return UNTRUSTED_CONTAINS_PATTERNS.some((pattern) => pattern.test(condition));
+}
+function isPrivilegedStep(run) {
+    const normalized = run?.toLowerCase() ?? "";
+    return PRIVILEGED_COMMANDS.some((command) => normalized.includes(command));
+}
+export function detectWorkflowUnsoundContains(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    for (const candidate of gatherStepConditions(input.parsed)) {
+        if (!isUnsoundContains(candidate.condition) || !isPrivilegedStep(candidate.run)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [candidate.condition, candidate.run ?? ""],
+            fallbackValue: candidate.condition,
+        });
+        findings.push({
+            rule_id: "workflow-unsound-contains",
+            finding_id: `WORKFLOW_UNSOUND_CONTAINS-${input.filePath}-${candidate.jobId}-${candidate.stepIndex}`,
+            severity: "HIGH",
+            category: "CI_TRIGGER",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${candidate.jobId}.steps[${candidate.stepIndex}].if` },
+            description: "Workflow gates a privileged step with contains() over untrusted event content",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-20",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Avoid trust decisions based on contains() over untrusted titles, bodies, or comments",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-use-trusted-publishing.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUseTrustedPublishingInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUseTrustedPublishing(input: WorkflowUseTrustedPublishingInput): Finding[];

package/dist/layer2-static/detectors/workflow-use-trusted-publishing.js

@@ -0,0 +1,66 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const PUBLISH_COMMANDS = ["npm publish", "pnpm publish", "yarn npm publish", "twine upload"];
+const TOKEN_NAMES = ["NODE_AUTH_TOKEN", "NPM_TOKEN", "TWINE_USERNAME", "TWINE_PASSWORD"];
+function containsPublishCommand(value) {
+    if (!value) {
+        return false;
+    }
+    return PUBLISH_COMMANDS.some((command) => value.includes(command));
+}
+function findTokenName(textContent) {
+    for (const tokenName of TOKEN_NAMES) {
+        if (textContent.includes(tokenName)) {
+            return tokenName;
+        }
+    }
+    return null;
+}
+export function detectWorkflowUseTrustedPublishing(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const tokenName = findTokenName(input.textContent);
+    if (!tokenName) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            if (!containsPublishCommand(step.run)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [step.run ?? "", tokenName],
+                fallbackValue: step.run ?? tokenName,
+            });
+            findings.push({
+                rule_id: "workflow-use-trusted-publishing",
+                finding_id: `WORKFLOW_USE_TRUSTED_PUBLISHING-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_PERMISSIONS",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                description: "Package publication uses long-lived registry credentials instead of trusted publishing",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-798",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Switch package publishing to trusted publishing with OIDC and remove registry secrets",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/engine.d.ts

@@ -1,5 +1,6 @@
 import { type GitHookEntry } from "./detectors/git-hooks.js";
 import { type SymlinkEscapeEntry } from "./detectors/symlink.js";
+import type { AuditPersona, RuntimeMode } from "../config.js";
 import { type Finding } from "../types/finding.js";
 import type { DiscoveryFormat } from "../types/discovery.js";
 export interface StaticFileInput {
@@ -20,6 +21,13 @@ export interface StaticEngineConfig {
     rulePackPaths?: string[];
     allowedRules?: string[];
     skipRules?: string[];
+    persona?: AuditPersona;
+    runtimeMode?: RuntimeMode;
+    workflowAuditsEnabled?: boolean;
+    rulePolicies?: Record<string, {
+        disable?: boolean;
+        config?: Record<string, unknown>;
+    }>;
 }
 export interface StaticEngineInput {
     projectRoot: string;
@@ -28,4 +36,4 @@ export interface StaticEngineInput {
     hooks: GitHookEntry[];
     config: StaticEngineConfig;
 }
-export declare function runStaticEngine(input: StaticEngineInput): Finding[];
+export declare function runStaticEngine(input: StaticEngineInput): Promise<Finding[]>;