codegate-ai 0.9.0 → 0.10.0

package/dist/layer2-static/detectors/dependabot-auto-merge.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface DependabotAutoMergeInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectDependabotAutoMerge(input: DependabotAutoMergeInput): Finding[];

package/dist/layer2-static/detectors/dependabot-auto-merge.js

@@ -0,0 +1,118 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const MERGE_COMMAND_PATTERN = /\b(gh\s+pr\s+merge|gh\s+pr\s+review|gh\s+api\s+[^#\n]*\/pulls\/[^#\n]*\/merge)\b/iu;
+const MERGE_ACTIONS = new Set([
+    "ahmadnassri/action-dependabot-auto-merge",
+    "hmarr/auto-approve-action",
+    "fastify/github-action-merge-dependabot",
+    "ad-m/github-push-action",
+    "peter-evans/create-pull-request",
+]);
+function normalizeUses(value) {
+    if (!value) {
+        return null;
+    }
+    const normalized = value.trim().toLowerCase();
+    if (normalized.length === 0) {
+        return null;
+    }
+    const atIndex = normalized.indexOf("@");
+    return atIndex === -1 ? normalized : normalized.slice(0, atIndex);
+}
+function hasDependabotActorConstraint(condition) {
+    if (!condition) {
+        return false;
+    }
+    const normalized = condition.toLowerCase();
+    return (normalized.includes("dependabot[bot]") ||
+        normalized.includes("dependabot-preview[bot]") ||
+        normalized.includes("github.actor") ||
+        normalized.includes("github.triggering_actor"));
+}
+function hasStrictRepoBoundary(condition) {
+    if (!condition) {
+        return false;
+    }
+    const normalized = condition.toLowerCase();
+    return (normalized.includes("github.repository == github.event.pull_request.head.repo.full_name") ||
+        normalized.includes("github.event.pull_request.head.repo.fork == false") ||
+        normalized.includes("github.event.pull_request.user.login") ||
+        normalized.includes("github.ref == 'refs/heads/main'") ||
+        normalized.includes("github.base_ref == 'main'"));
+}
+function isRiskyTrigger(trigger) {
+    const normalized = trigger.trim().toLowerCase();
+    return normalized === "pull_request_target" || normalized === "workflow_run";
+}
+export function detectDependabotAutoMerge(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const riskyTrigger = facts.triggers.find((trigger) => isRiskyTrigger(trigger));
+    if (!riskyTrigger) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            const mergesByCommand = Boolean(step.run && MERGE_COMMAND_PATTERN.test(step.run));
+            const mergesByAction = (() => {
+                const normalizedUses = normalizeUses(step.uses);
+                return normalizedUses ? MERGE_ACTIONS.has(normalizedUses) : false;
+            })();
+            if (!mergesByCommand && !mergesByAction) {
+                return;
+            }
+            const mergedCondition = step.if ?? job.if;
+            if (!hasDependabotActorConstraint(mergedCondition)) {
+                return;
+            }
+            if (hasStrictRepoBoundary(mergedCondition)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [
+                    "pull_request_target",
+                    "dependabot[bot]",
+                    "gh pr merge",
+                    step.uses ?? "",
+                    step.run ?? "",
+                ],
+                fallbackValue: `${job.id} auto-merge flow uses weak bot-only gating`,
+            });
+            findings.push({
+                rule_id: "dependabot-auto-merge",
+                finding_id: `DEPENDABOT_AUTO_MERGE-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: riskyTrigger === "pull_request_target" ? "HIGH" : "MEDIUM",
+                category: "CI_TRIGGER",
+                layer: "L2",
+                file_path: input.filePath,
+                location: {
+                    field: step.run
+                        ? `jobs.${job.id}.steps[${stepIndex}].run`
+                        : `jobs.${job.id}.steps[${stepIndex}].uses`,
+                },
+                description: "Dependabot auto-merge flow relies on weak actor-only conditions in a privileged trigger context",
+                affected_tools: ["github-actions", "dependabot"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-285",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Require strict repository boundary checks before executing auto-merge operations",
+                    "Avoid pull_request_target auto-merge flows unless actor, repo, and branch checks are explicit",
+                    "Prefer dedicated Dependabot metadata and permission-check actions before merge approval",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-artifact-trust-chain.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowArtifactTrustChainInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowArtifactTrustChain(input: WorkflowArtifactTrustChainInput): Finding[];

package/dist/layer2-static/detectors/workflow-artifact-trust-chain.js

@@ -0,0 +1,89 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { collectArtifactTransferEdges, collectUntrustedReachableJobIds, } from "../workflow/analysis.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function hasWritePermission(value) {
+    if (typeof value === "string") {
+        return value.trim().toLowerCase() === "write-all";
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    return Object.values(value).some((permission) => typeof permission === "string" && permission.trim().toLowerCase() === "write");
+}
+function hasInheritedSecrets(secrets) {
+    return typeof secrets === "string" && secrets.trim().toLowerCase() === "inherit";
+}
+function hasExecutableRunStep(jobSteps) {
+    return jobSteps.some((step) => typeof step.run === "string" && step.run.trim().length > 0);
+}
+export function detectWorkflowArtifactTrustChain(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const untrustedJobIds = collectUntrustedReachableJobIds(facts);
+    if (untrustedJobIds.size === 0) {
+        return [];
+    }
+    const workflowHasWritePermissions = hasWritePermission(facts.workflowPermissions);
+    const jobsById = new Map(facts.jobs.map((job) => [job.id, job]));
+    const findings = [];
+    const dedupe = new Set();
+    for (const edge of collectArtifactTransferEdges(facts)) {
+        if (!untrustedJobIds.has(edge.producerJobId)) {
+            continue;
+        }
+        const consumerJob = jobsById.get(edge.consumerJobId);
+        if (!consumerJob) {
+            continue;
+        }
+        const consumerPrivileged = workflowHasWritePermissions ||
+            hasWritePermission(consumerJob.permissions) ||
+            hasInheritedSecrets(consumerJob.secrets);
+        if (!consumerPrivileged || !hasExecutableRunStep(consumerJob.steps)) {
+            continue;
+        }
+        const dedupeKey = `${edge.producerJobId}|${edge.consumerJobId}|${edge.artifactName}`;
+        if (dedupe.has(dedupeKey)) {
+            continue;
+        }
+        dedupe.add(dedupeKey);
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [
+                "actions/upload-artifact",
+                "actions/download-artifact",
+                edge.artifactName,
+                "pull_request",
+            ],
+            fallbackValue: `${edge.consumerJobId} consumes artifact ${edge.artifactName} from untrusted producer ${edge.producerJobId}`,
+        });
+        findings.push({
+            rule_id: "workflow-artifact-trust-chain",
+            finding_id: `WORKFLOW_ARTIFACT_TRUST_CHAIN-${input.filePath}-${edge.producerJobId}-${edge.consumerJobId}-${edge.artifactName}`,
+            severity: edge.consumerDownloadsAll ? "CRITICAL" : "HIGH",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${edge.consumerJobId}.steps[${edge.consumerStepIndex}]` },
+            description: "Privileged job executes after downloading artifacts produced in an untrusted workflow path",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-829",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Separate untrusted artifact production from privileged execution jobs",
+                "Require integrity verification before consuming downloaded artifacts",
+                "Avoid executing downloaded artifacts in jobs with write tokens or inherited secrets",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-call-boundary.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowCallBoundaryInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowCallBoundary(input: WorkflowCallBoundaryInput): Finding[];

package/dist/layer2-static/detectors/workflow-call-boundary.js

@@ -0,0 +1,92 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowCallBoundaryContext } from "../workflow/analysis.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function collectExpressionKeys(textContent, prefix) {
+    const keys = new Set();
+    const pattern = new RegExp(`${prefix}\\.([a-zA-Z0-9_-]+)`, "giu");
+    for (const match of textContent.matchAll(pattern)) {
+        const key = match[1]?.trim();
+        if (!key) {
+            continue;
+        }
+        keys.add(key);
+    }
+    return keys;
+}
+export function detectWorkflowCallBoundary(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const boundary = extractWorkflowCallBoundaryContext(input.parsed, facts);
+    if (!boundary.hasWorkflowCall) {
+        return [];
+    }
+    const declaredInputs = new Set(boundary.declaredInputKeys);
+    const declaredSecrets = new Set(boundary.declaredSecretKeys);
+    const referencedInputs = collectExpressionKeys(input.textContent, "inputs");
+    const referencedSecrets = collectExpressionKeys(input.textContent, "secrets");
+    const undeclaredInputs = Array.from(referencedInputs).filter((key) => !declaredInputs.has(key));
+    const undeclaredSecrets = Array.from(referencedSecrets).filter((key) => !declaredSecrets.has(key));
+    const findings = [];
+    for (const inputKey of undeclaredInputs) {
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [`inputs.${inputKey}`, "workflow_call"],
+            fallbackValue: `workflow_call references undeclared input ${inputKey}`,
+        });
+        findings.push({
+            rule_id: "workflow-call-boundary",
+            finding_id: `WORKFLOW_CALL_BOUNDARY-INPUT-${input.filePath}-${inputKey}`,
+            severity: "HIGH",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: "on.workflow_call.inputs" },
+            description: `workflow_call references undeclared input '${inputKey}'`,
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-20",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                `Declare input '${inputKey}' under on.workflow_call.inputs with explicit type and required policy`,
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    for (const secretKey of undeclaredSecrets) {
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [`secrets.${secretKey}`, "workflow_call"],
+            fallbackValue: `workflow_call references undeclared secret ${secretKey}`,
+        });
+        findings.push({
+            rule_id: "workflow-call-boundary",
+            finding_id: `WORKFLOW_CALL_BOUNDARY-SECRET-${input.filePath}-${secretKey}`,
+            severity: "HIGH",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: "on.workflow_call.secrets" },
+            description: `workflow_call references undeclared secret '${secretKey}'`,
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-862",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                `Declare secret '${secretKey}' under on.workflow_call.secrets and pass only required values from callers`,
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-dynamic-matrix-injection.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowDynamicMatrixInjectionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowDynamicMatrixInjection(input: WorkflowDynamicMatrixInjectionInput): Finding[];

package/dist/layer2-static/detectors/workflow-dynamic-matrix-injection.js

@@ -0,0 +1,149 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { collectUntrustedReachableJobIds } from "../workflow/analysis.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const MATRIX_REFERENCE_PATTERN = /\$\{\{\s*matrix\.[^}]+\}\}/iu;
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function isUntrustedDynamicMatrixExpression(value) {
+    const normalized = value.toLowerCase();
+    if (!normalized.includes("${{")) {
+        return false;
+    }
+    const untrustedEventRefs = [
+        "github.event.pull_request.",
+        "github.event.issue.",
+        "github.event.comment.",
+        "github.event.review.",
+        "github.event.discussion.",
+        "github.event.head_commit.",
+    ];
+    return untrustedEventRefs.some((ref) => normalized.includes(ref));
+}
+function isStaticFromJsonExpression(value) {
+    const normalized = value.toLowerCase().replace(/\s+/gu, "");
+    return (normalized.includes("fromjson('") ||
+        normalized.includes('fromjson("') ||
+        normalized.includes("fromjson(`"));
+}
+function hasMatrixAllowListValidation(condition) {
+    if (!condition) {
+        return false;
+    }
+    const normalized = condition.toLowerCase();
+    return normalized.includes("contains(fromjson(") && normalized.includes("matrix.");
+}
+export function detectWorkflowDynamicMatrixInjection(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const root = asRecord(input.parsed);
+    const jobsRecord = root ? asRecord(root.jobs) : null;
+    if (!jobsRecord) {
+        return [];
+    }
+    const reachableJobIds = collectUntrustedReachableJobIds(facts);
+    if (reachableJobIds.size === 0) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        if (!reachableJobIds.has(job.id)) {
+            return;
+        }
+        const rawJob = asRecord(jobsRecord[job.id]);
+        if (!rawJob) {
+            return;
+        }
+        const strategyRecord = asRecord(rawJob.strategy);
+        const matrixExpression = strategyRecord ? asString(strategyRecord.matrix) : undefined;
+        if (!matrixExpression || !isUntrustedDynamicMatrixExpression(matrixExpression)) {
+            return;
+        }
+        if (isStaticFromJsonExpression(matrixExpression) &&
+            !matrixExpression.includes("github.event.")) {
+            return;
+        }
+        const hasAllowList = hasMatrixAllowListValidation(job.if);
+        const severity = hasAllowList ? "MEDIUM" : "HIGH";
+        const matrixEvidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: ["strategy:", "matrix:", "fromJSON", "github.event"],
+            fallbackValue: `${job.id} strategy.matrix is built from untrusted event data`,
+        });
+        findings.push({
+            rule_id: "workflow-dynamic-matrix-injection",
+            finding_id: `WORKFLOW_DYNAMIC_MATRIX_INJECTION-${input.filePath}-${jobIndex}`,
+            severity,
+            category: "CI_TEMPLATE_INJECTION",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${job.id}.strategy.matrix` },
+            description: "Workflow strategy.matrix is derived from untrusted event payload content",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-94",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Avoid building strategy.matrix from attacker-controlled event fields",
+                "Use static allow-list matrices or validate and sanitize dynamic matrix payloads",
+                "Do not interpolate untrusted matrix values directly into shell commands",
+            ],
+            metadata: {
+                risk_tags: [hasAllowList ? "allow-list-guard" : "no-allow-list-guard"],
+                origin: "workflow-audit",
+            },
+            evidence: matrixEvidence?.evidence ?? null,
+            suppressed: false,
+        });
+        job.steps.forEach((step, stepIndex) => {
+            if (!step.run || !MATRIX_REFERENCE_PATTERN.test(step.run)) {
+                return;
+            }
+            const runEvidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [step.run],
+                fallbackValue: `${job.id} run step interpolates matrix value in shell command`,
+            });
+            findings.push({
+                rule_id: "workflow-dynamic-matrix-injection",
+                finding_id: `WORKFLOW_DYNAMIC_MATRIX_INJECTION_RUN-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity,
+                category: "CI_TEMPLATE_INJECTION",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                description: "Workflow run step interpolates dynamic matrix values sourced from untrusted event data",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-94",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Validate matrix values against explicit allow-lists before shell interpolation",
+                    "Move untrusted values into strictly validated variables before command execution",
+                ],
+                metadata: {
+                    risk_tags: [hasAllowList ? "allow-list-guard" : "no-allow-list-guard"],
+                    origin: "workflow-audit",
+                },
+                evidence: runEvidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-local-action-mutation.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowLocalActionMutationInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowLocalActionMutation(input: WorkflowLocalActionMutationInput): Finding[];

package/dist/layer2-static/detectors/workflow-local-action-mutation.js

@@ -0,0 +1,125 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { collectUntrustedReachableJobIds } from "../workflow/analysis.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function hasWritePermission(value) {
+    if (typeof value === "string") {
+        return value.trim().toLowerCase() === "write-all";
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    return Object.values(value).some((permission) => {
+        if (typeof permission !== "string") {
+            return false;
+        }
+        return permission.trim().toLowerCase() === "write";
+    });
+}
+function hasIdTokenWrite(value) {
+    if (typeof value === "string") {
+        return value.trim().toLowerCase() === "write-all";
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const idTokenPermission = value["id-token"];
+    return (typeof idTokenPermission === "string" && idTokenPermission.trim().toLowerCase() === "write");
+}
+function hasInheritedSecrets(secrets) {
+    return typeof secrets === "string" && secrets.trim().toLowerCase() === "inherit";
+}
+function isLocalUsesReference(value) {
+    if (!value) {
+        return false;
+    }
+    const normalized = value.trim();
+    return normalized.startsWith("./") || normalized.startsWith(".\\");
+}
+export function detectWorkflowLocalActionMutation(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const reachableJobIds = collectUntrustedReachableJobIds(facts);
+    if (reachableJobIds.size === 0) {
+        return [];
+    }
+    const findings = [];
+    const workflowPrivileged = hasWritePermission(facts.workflowPermissions) || hasIdTokenWrite(facts.workflowPermissions);
+    facts.jobs.forEach((job, jobIndex) => {
+        if (!reachableJobIds.has(job.id)) {
+            return;
+        }
+        const jobPrivileged = workflowPrivileged ||
+            hasWritePermission(job.permissions) ||
+            hasIdTokenWrite(job.permissions) ||
+            hasInheritedSecrets(job.secrets);
+        const severity = jobPrivileged ? "HIGH" : "MEDIUM";
+        if (isLocalUsesReference(job.uses)) {
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [job.uses ?? "", "uses: ./", "pull_request_target"],
+                fallbackValue: `${job.id} invokes local reusable workflow in untrusted context`,
+            });
+            findings.push({
+                rule_id: "workflow-local-action-mutation",
+                finding_id: `WORKFLOW_LOCAL_ACTION_MUTATION-JOB-${input.filePath}-${jobIndex}`,
+                severity,
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.uses` },
+                description: "Untrusted workflow path executes a local reusable workflow reference that can be mutated by pull request content",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-494",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Avoid executing local reusable workflows from untrusted trigger contexts",
+                    "Move privileged operations to immutable pinned actions or trusted workflow_call boundaries",
+                    "Use read-only contexts when local action references are unavoidable",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        }
+        job.steps.forEach((step, stepIndex) => {
+            if (!isLocalUsesReference(step.uses)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [step.uses ?? "", "uses: ./", "pull_request_target"],
+                fallbackValue: `${job.id} executes mutable local action from untrusted context`,
+            });
+            findings.push({
+                rule_id: "workflow-local-action-mutation",
+                finding_id: `WORKFLOW_LOCAL_ACTION_MUTATION-STEP-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity,
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].uses` },
+                description: "Untrusted workflow path executes a local action reference that can be modified by the same pull request",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-494",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Avoid local action execution in untrusted trigger workflows with privileged permissions",
+                    "Pin to immutable third-party actions or split untrusted and privileged jobs",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-oidc-untrusted-context.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowOidcUntrustedContextInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowOidcUntrustedContext(input: WorkflowOidcUntrustedContextInput): Finding[];