codegate-ai 0.8.0 → 0.9.1

package/dist/layer2-static/detectors/dependabot-cooldown.js

@@ -0,0 +1,54 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractDependabotFacts, isGitHubDependabotPath } from "../dependabot/parser.js";
+function hasCooldown(update) {
+    const cooldown = update.cooldown;
+    if (!cooldown) {
+        return false;
+    }
+    return (typeof cooldown.defaultDays === "number" ||
+        typeof cooldown.semverMajorDays === "number" ||
+        typeof cooldown.semverMinorDays === "number" ||
+        typeof cooldown.semverPatchDays === "number");
+}
+export function detectDependabotCooldown(input) {
+    if (!isGitHubDependabotPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractDependabotFacts(input.parsed);
+    if (!facts || facts.updates.length === 0) {
+        return [];
+    }
+    const findings = [];
+    facts.updates.forEach((update, index) => {
+        if (!update.schedule || hasCooldown(update)) {
+            return;
+        }
+        const ecosystem = update.packageEcosystem ?? "unknown-ecosystem";
+        const directory = update.directory ?? "/";
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [ecosystem, directory, "schedule", "cooldown"],
+            fallbackValue: `${ecosystem} ${directory} update rule has no cooldown`,
+        });
+        findings.push({
+            rule_id: "dependabot-cooldown",
+            finding_id: `DEPENDABOT_COOLDOWN-${input.filePath}-${index}`,
+            severity: "LOW",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `updates[${index}].cooldown` },
+            description: "Dependabot update rule has no cooldown window, increasing update churn and review pressure",
+            affected_tools: ["dependabot"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-400",
+            confidence: "MEDIUM",
+            fixable: false,
+            remediation_actions: ["Add cooldown settings to pace update volume and review load"],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/dependabot-execution.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface DependabotExecutionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectDependabotExecution(input: DependabotExecutionInput): Finding[];

package/dist/layer2-static/detectors/dependabot-execution.js

@@ -0,0 +1,68 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { isGitHubDependabotPath } from "../dependabot/parser.js";
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function isExternalCodeExecutionAllowed(value) {
+    if (value === true) {
+        return true;
+    }
+    if (typeof value === "string") {
+        const normalized = value.trim().toLowerCase();
+        return normalized === "allow" || normalized === "true";
+    }
+    return false;
+}
+export function detectDependabotExecution(input) {
+    if (!isGitHubDependabotPath(input.filePath)) {
+        return [];
+    }
+    const root = asRecord(input.parsed);
+    const updates = Array.isArray(root?.updates) ? root.updates : [];
+    if (updates.length === 0) {
+        return [];
+    }
+    const findings = [];
+    updates.forEach((entry, index) => {
+        const update = asRecord(entry);
+        if (!update) {
+            return;
+        }
+        if (!isExternalCodeExecutionAllowed(update["insecure-external-code-execution"])) {
+            return;
+        }
+        const ecosystem = typeof update["package-ecosystem"] === "string"
+            ? update["package-ecosystem"]
+            : "unknown-ecosystem";
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [ecosystem, "insecure-external-code-execution", "allow"],
+            fallbackValue: `${ecosystem} enables insecure external code execution`,
+        });
+        findings.push({
+            rule_id: "dependabot-execution",
+            finding_id: `DEPENDABOT_EXECUTION-${input.filePath}-${index}`,
+            severity: "HIGH",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `updates[${index}].insecure-external-code-execution` },
+            description: "Dependabot update rule allows insecure external code execution",
+            affected_tools: ["dependabot"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-94",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Remove insecure-external-code-execution allowances and isolate registries through trusted credentials",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-anonymous-definition.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowAnonymousDefinitionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowAnonymousDefinition(input: WorkflowAnonymousDefinitionInput): Finding[];

package/dist/layer2-static/detectors/workflow-anonymous-definition.js

@@ -0,0 +1,48 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+export function detectWorkflowAnonymousDefinition(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const root = asRecord(input.parsed);
+    const name = typeof root?.name === "string" ? root.name.trim() : "";
+    if (name.length > 0) {
+        return [];
+    }
+    const evidence = buildFindingEvidence({
+        textContent: input.textContent,
+        searchTerms: ["name:"],
+        fallbackValue: "workflow has no top-level name",
+    });
+    return [
+        {
+            rule_id: "workflow-anonymous-definition",
+            finding_id: `WORKFLOW_ANONYMOUS_DEFINITION-${input.filePath}`,
+            severity: "LOW",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: "name" },
+            description: "Workflow omits a top-level name, reducing review clarity and incident traceability",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-200",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: ["Add an explicit top-level workflow name"],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        },
+    ];
+}

package/dist/layer2-static/detectors/workflow-archived-uses.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowArchivedUsesInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowArchivedUses(input: WorkflowArchivedUsesInput): Promise<Finding[]>;

package/dist/layer2-static/detectors/workflow-archived-uses.js

@@ -0,0 +1,147 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const archivedRepoCacheByFetch = new WeakMap();
+const GITHUB_API_HEADERS = {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "CodeGate",
+};
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function isExternalRepositoryUse(value) {
+    return value.startsWith("./") || value.startsWith("../") || value.startsWith("docker://");
+}
+function trimTrailingSlashes(value) {
+    return value.replace(/\/+$/u, "");
+}
+function parseRepositoryUses(value) {
+    const trimmed = value.trim();
+    if (trimmed.length === 0 || isExternalRepositoryUse(trimmed)) {
+        return null;
+    }
+    const atIndex = trimmed.lastIndexOf("@");
+    if (atIndex < 0) {
+        return null;
+    }
+    const slug = trimTrailingSlashes(trimmed.slice(0, atIndex).trim());
+    const [owner, repo] = slug.split("/");
+    if (!owner || !repo) {
+        return null;
+    }
+    return {
+        raw: trimmed,
+        owner: owner.toLowerCase(),
+        repo: repo.toLowerCase(),
+    };
+}
+async function isArchivedRepository(owner, repo) {
+    const fetchFn = globalThis.fetch;
+    if (typeof fetchFn !== "function") {
+        return false;
+    }
+    let cache = archivedRepoCacheByFetch.get(fetchFn);
+    if (!cache) {
+        cache = new Map();
+        archivedRepoCacheByFetch.set(fetchFn, cache);
+    }
+    const cacheKey = `${owner}/${repo}`;
+    const cached = cache.get(cacheKey);
+    if (cached !== undefined) {
+        return cached;
+    }
+    try {
+        const response = await fetchFn(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`, {
+            headers: GITHUB_API_HEADERS,
+        });
+        if (!response.ok) {
+            cache.set(cacheKey, false);
+            return false;
+        }
+        const payload = (await response.json());
+        const archived = Boolean(payload && typeof payload === "object" && payload.archived === true);
+        cache.set(cacheKey, archived);
+        return archived;
+    }
+    catch {
+        return false;
+    }
+}
+function gatherUsesTargets(parsed) {
+    const root = asRecord(parsed);
+    const jobsRecord = asRecord(root?.jobs);
+    if (!jobsRecord) {
+        return [];
+    }
+    const targets = [];
+    const addTarget = (uses, field) => {
+        const parsedUses = parseRepositoryUses(uses);
+        if (parsedUses) {
+            targets.push({
+                ...parsedUses,
+                field,
+            });
+        }
+    };
+    for (const [jobId, jobValue] of Object.entries(jobsRecord)) {
+        const jobRecord = asRecord(jobValue);
+        if (!jobRecord) {
+            continue;
+        }
+        if (typeof jobRecord.uses === "string") {
+            addTarget(jobRecord.uses, `jobs.${jobId}.uses`);
+        }
+        const steps = Array.isArray(jobRecord.steps) ? jobRecord.steps : [];
+        steps.forEach((step, stepIndex) => {
+            const stepRecord = asRecord(step);
+            if (stepRecord && typeof stepRecord.uses === "string") {
+                addTarget(stepRecord.uses, `jobs.${jobId}.steps[${stepIndex}].uses`);
+            }
+        });
+    }
+    return targets;
+}
+export async function detectWorkflowArchivedUses(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    if (!extractWorkflowFacts(input.parsed)) {
+        return [];
+    }
+    const targets = gatherUsesTargets(input.parsed);
+    const findings = [];
+    for (const target of targets) {
+        if (!(await isArchivedRepository(target.owner, target.repo))) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [target.raw, `${target.owner}/${target.repo}`],
+            fallbackValue: target.raw,
+        });
+        findings.push({
+            rule_id: "workflow-archived-uses",
+            finding_id: `WORKFLOW_ARCHIVED_USES-${input.filePath}-${target.field}`,
+            severity: "MEDIUM",
+            category: "CI_VULNERABLE_ACTION",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: target.field },
+            description: "Workflow action or reusable workflow comes from an archived repository",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-829",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Replace the archived repository reference with an actively maintained alternative",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-artipacked.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowArtipackedInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowArtipacked(input: WorkflowArtipackedInput): Finding[];

package/dist/layer2-static/detectors/workflow-artipacked.js

@@ -0,0 +1,62 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function isCheckoutStep(uses) {
+    return typeof uses === "string" && /^actions\/checkout(?:@.+)?$/iu.test(uses.trim());
+}
+function persistsCredentials(value) {
+    if (typeof value !== "string") {
+        return true;
+    }
+    return value.trim().toLowerCase() !== "false";
+}
+export function detectWorkflowArtipacked(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            if (!isCheckoutStep(step.uses)) {
+                return;
+            }
+            if (!persistsCredentials(step.with?.["persist-credentials"])) {
+                return;
+            }
+            const searchTerms = ["persist-credentials: true"];
+            if (step.uses) {
+                searchTerms.push(step.uses);
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms,
+                fallbackValue: "actions/checkout persists credentials on disk",
+            });
+            findings.push({
+                rule_id: "workflow-artipacked",
+                finding_id: `WORKFLOW_ARTIPACKED-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].with.persist-credentials` },
+                description: "Checkout step persists credentials on disk",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-922",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Set actions/checkout persist-credentials to false unless the workflow explicitly needs Git credentials",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-bot-conditions.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowBotConditionsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowBotConditions(input: WorkflowBotConditionsInput): Finding[];

package/dist/layer2-static/detectors/workflow-bot-conditions.js

@@ -0,0 +1,108 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const BOT_CONDITION_PATTERN = /github\.actor\s*(?:==|!=)\s*['"](?:dependabot\[bot\]|renovate\[bot\]|github-actions\[bot\])['"]/iu;
+const PRIVILEGED_RUN_TOKENS = ["publish", "deploy", "release", "npm publish", "gh release"];
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function gatherConditionalSteps(parsed) {
+    const root = asRecord(parsed);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return [];
+    }
+    const steps = [];
+    for (const [jobId, jobValue] of Object.entries(jobs)) {
+        const job = asRecord(jobValue);
+        const stepEntries = Array.isArray(job?.steps) ? job.steps : [];
+        const jobCondition = typeof job?.if === "string" ? job.if : undefined;
+        if (jobCondition) {
+            const hasPrivilegedStep = stepEntries.some((stepValue) => {
+                const step = asRecord(stepValue);
+                const run = typeof step?.run === "string" ? step.run : undefined;
+                const uses = typeof step?.uses === "string" ? step.uses : undefined;
+                return isPrivilegedStep(run, uses);
+            });
+            if (hasPrivilegedStep) {
+                steps.push({
+                    jobId,
+                    condition: jobCondition,
+                    locationField: `jobs.${jobId}.if`,
+                    run: stepEntries
+                        .map((stepValue) => asRecord(stepValue))
+                        .find((step) => step && typeof step.run === "string")?.run,
+                    uses: stepEntries
+                        .map((stepValue) => asRecord(stepValue))
+                        .find((step) => step && typeof step.uses === "string")?.uses,
+                });
+            }
+        }
+        stepEntries.forEach((stepValue, stepIndex) => {
+            const step = asRecord(stepValue);
+            if (!step || typeof step.if !== "string") {
+                return;
+            }
+            steps.push({
+                jobId,
+                stepIndex,
+                condition: step.if,
+                locationField: `jobs.${jobId}.steps[${stepIndex}].if`,
+                run: typeof step.run === "string" ? step.run : undefined,
+                uses: typeof step.uses === "string" ? step.uses : undefined,
+            });
+        });
+    }
+    return steps;
+}
+function isPrivilegedStep(run, uses) {
+    const runValue = run?.toLowerCase() ?? "";
+    if (PRIVILEGED_RUN_TOKENS.some((token) => runValue.includes(token))) {
+        return true;
+    }
+    return typeof uses === "string" && uses.trim().length > 0;
+}
+export function detectWorkflowBotConditions(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    for (const step of gatherConditionalSteps(input.parsed)) {
+        if (!BOT_CONDITION_PATTERN.test(step.condition) || !isPrivilegedStep(step.run, step.uses)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [step.condition, step.run ?? "", step.uses ?? ""],
+            fallbackValue: step.condition,
+        });
+        findings.push({
+            rule_id: "bot-conditions",
+            finding_id: `BOT_CONDITIONS-${input.filePath}-${step.locationField}`,
+            severity: "MEDIUM",
+            category: "CI_TRIGGER",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: step.locationField },
+            description: "Privileged workflow step is guarded primarily by bot-actor identity checks",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-287",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Use explicit trust-boundary checks (event type, branch protection, ref, permissions) beyond actor-name conditions",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-cache-poisoning.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowCachePoisoningInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowCachePoisoning(input: WorkflowCachePoisoningInput): Finding[];

package/dist/layer2-static/detectors/workflow-cache-poisoning.js

@@ -0,0 +1,67 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const UNTRUSTED_TRIGGERS = new Set(["pull_request", "pull_request_target", "workflow_run"]);
+function normalizeUsesSlug(value) {
+    const beforeRef = value.split("@")[0] ?? value;
+    return beforeRef.replace(/\/+$/u, "").toLowerCase();
+}
+function isCacheAction(uses) {
+    return normalizeUsesSlug(uses).startsWith("actions/cache");
+}
+function hasRestoreKeys(stepWith) {
+    const restoreKeys = stepWith?.["restore-keys"]?.trim();
+    return restoreKeys && restoreKeys.length > 0 ? restoreKeys : null;
+}
+export function detectWorkflowCachePoisoning(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const hasUntrustedTrigger = facts.triggers.some((trigger) => UNTRUSTED_TRIGGERS.has(trigger));
+    if (!hasUntrustedTrigger) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            const uses = step.uses?.trim();
+            if (!uses || !isCacheAction(uses)) {
+                return;
+            }
+            const restoreKeys = hasRestoreKeys(step.with);
+            if (!restoreKeys) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: ["restore-keys:", restoreKeys],
+                fallbackValue: restoreKeys,
+            });
+            findings.push({
+                rule_id: "workflow-cache-poisoning",
+                finding_id: `WORKFLOW_CACHE_POISONING-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].with.restore-keys` },
+                description: "Cache restore keys can enable cache poisoning on untrusted workflow triggers",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-345",
+                confidence: "MEDIUM",
+                fixable: false,
+                remediation_actions: [
+                    "Remove broad restore keys or restrict cache reuse to trusted branches and jobs",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-concurrency-limits.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowConcurrencyLimitsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowConcurrencyLimits(input: WorkflowConcurrencyLimitsInput): Finding[];