codegate-ai 0.9.1 → 0.10.0

package/dist/layer2-static/workflow/analysis.js

@@ -0,0 +1,201 @@
+const UNTRUSTED_TRIGGER_SET = new Set([
+    "pull_request",
+    "pull_request_target",
+    "workflow_run",
+    "issue_comment",
+    "pull_request_review_comment",
+    "discussion_comment",
+]);
+const BOT_ONLY_CONDITION_PATTERNS = [
+    /github\.actor\s*==\s*['"]dependabot\[bot\]['"]/iu,
+    /github\.actor\s*==\s*['"]github-actions\[bot\]['"]/iu,
+    /github\.event\.pull_request\.head\.repo\.fork\s*==\s*false/iu,
+];
+const UPLOAD_ARTIFACT_ACTIONS = new Set([
+    "actions/upload-artifact",
+    "actions/upload-artifact/merge",
+]);
+const DOWNLOAD_ARTIFACT_ACTIONS = new Set(["actions/download-artifact"]);
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function normalizeUses(uses) {
+    if (!uses) {
+        return null;
+    }
+    const trimmed = uses.trim().toLowerCase();
+    if (trimmed.length === 0) {
+        return null;
+    }
+    const atIndex = trimmed.indexOf("@");
+    if (atIndex === -1) {
+        return trimmed;
+    }
+    return trimmed.slice(0, atIndex);
+}
+function isWorkflowTriggerUntrusted(trigger) {
+    return UNTRUSTED_TRIGGER_SET.has(trigger.trim().toLowerCase());
+}
+function isUntrustedRestrictedCondition(condition) {
+    if (!condition) {
+        return false;
+    }
+    return BOT_ONLY_CONDITION_PATTERNS.some((pattern) => pattern.test(condition));
+}
+function normalizeArtifactName(value) {
+    if (!value) {
+        return null;
+    }
+    const normalized = value.trim();
+    return normalized.length > 0 ? normalized : null;
+}
+export function buildWorkflowNeedsGraph(facts) {
+    return new Map(facts.jobs.map((job) => [job.id, [...job.needs]]));
+}
+export function collectTransitiveDependencies(facts, seedJobIds) {
+    const graph = buildWorkflowNeedsGraph(facts);
+    const visited = new Set();
+    const queue = [...seedJobIds];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (!current) {
+            continue;
+        }
+        const dependencies = graph.get(current) ?? [];
+        for (const dependency of dependencies) {
+            if (visited.has(dependency)) {
+                continue;
+            }
+            visited.add(dependency);
+            queue.push(dependency);
+        }
+    }
+    return visited;
+}
+export function collectTransitiveDependents(facts, seedJobIds) {
+    const reverseGraph = new Map();
+    for (const job of facts.jobs) {
+        for (const dependency of job.needs) {
+            const dependents = reverseGraph.get(dependency) ?? [];
+            dependents.push(job.id);
+            reverseGraph.set(dependency, dependents);
+        }
+    }
+    const visited = new Set();
+    const queue = [...seedJobIds];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (!current) {
+            continue;
+        }
+        const dependents = reverseGraph.get(current) ?? [];
+        for (const dependent of dependents) {
+            if (visited.has(dependent)) {
+                continue;
+            }
+            visited.add(dependent);
+            queue.push(dependent);
+        }
+    }
+    return visited;
+}
+export function collectArtifactTransferEdges(facts) {
+    const producersByArtifact = new Map();
+    const edges = [];
+    const dedupe = new Set();
+    for (const job of facts.jobs) {
+        for (const [stepIndex, step] of job.steps.entries()) {
+            const normalizedUses = normalizeUses(step.uses);
+            if (!normalizedUses || !UPLOAD_ARTIFACT_ACTIONS.has(normalizedUses)) {
+                continue;
+            }
+            const artifactName = normalizeArtifactName(step.with?.name) ?? "__unnamed__";
+            const producers = producersByArtifact.get(artifactName) ?? [];
+            producers.push({ jobId: job.id, stepIndex });
+            producersByArtifact.set(artifactName, producers);
+        }
+    }
+    for (const job of facts.jobs) {
+        for (const [stepIndex, step] of job.steps.entries()) {
+            const normalizedUses = normalizeUses(step.uses);
+            if (!normalizedUses || !DOWNLOAD_ARTIFACT_ACTIONS.has(normalizedUses)) {
+                continue;
+            }
+            const requestedName = normalizeArtifactName(step.with?.name);
+            const consumerDownloadsAll = !requestedName;
+            const artifactNames = requestedName
+                ? [requestedName]
+                : Array.from(producersByArtifact.keys());
+            for (const artifactName of artifactNames) {
+                const producers = producersByArtifact.get(artifactName) ?? [];
+                for (const producer of producers) {
+                    const key = [
+                        artifactName,
+                        producer.jobId,
+                        producer.stepIndex,
+                        job.id,
+                        stepIndex,
+                        consumerDownloadsAll ? "all" : "named",
+                    ].join("|");
+                    if (dedupe.has(key)) {
+                        continue;
+                    }
+                    dedupe.add(key);
+                    edges.push({
+                        artifactName,
+                        producerJobId: producer.jobId,
+                        producerStepIndex: producer.stepIndex,
+                        consumerJobId: job.id,
+                        consumerStepIndex: stepIndex,
+                        consumerDownloadsAll,
+                    });
+                }
+            }
+        }
+    }
+    return edges;
+}
+export function collectUntrustedReachableJobIds(facts) {
+    const hasUntrustedTrigger = facts.triggers.some((trigger) => isWorkflowTriggerUntrusted(trigger));
+    if (!hasUntrustedTrigger) {
+        return new Set();
+    }
+    return new Set(facts.jobs.filter((job) => !isUntrustedRestrictedCondition(job.if)).map((job) => job.id));
+}
+export function extractWorkflowCallBoundaryContext(parsed, facts) {
+    const root = asRecord(parsed);
+    const onRecord = root ? asRecord(root.on) : null;
+    const workflowCall = onRecord ? asRecord(onRecord.workflow_call) : null;
+    const inputsRecord = workflowCall ? asRecord(workflowCall.inputs) : null;
+    const declaredInputKeys = inputsRecord ? Object.keys(inputsRecord) : [];
+    const requiredInputKeys = inputsRecord
+        ? Object.entries(inputsRecord)
+            .filter(([, value]) => asRecord(value)?.required === true)
+            .map(([key]) => key)
+        : [];
+    const secretsRecord = workflowCall ? asRecord(workflowCall.secrets) : null;
+    const declaredSecretKeys = secretsRecord ? Object.keys(secretsRecord) : [];
+    const requiredSecretKeys = secretsRecord
+        ? Object.entries(secretsRecord)
+            .filter(([, value]) => asRecord(value)?.required === true)
+            .map(([key]) => key)
+        : [];
+    const jobsWithInheritedSecrets = facts.jobs
+        .filter((job) => typeof job.secrets === "string" && job.secrets.trim().toLowerCase() === "inherit")
+        .map((job) => job.id);
+    const jobsCallingReusableWorkflow = facts.jobs
+        .filter((job) => typeof job.uses === "string" && job.uses.trim().length > 0)
+        .map((job) => job.id);
+    return {
+        hasWorkflowCall: workflowCall !== null,
+        declaredInputKeys,
+        requiredInputKeys,
+        declaredSecretKeys,
+        requiredSecretKeys,
+        jobsWithInheritedSecrets,
+        jobsCallingReusableWorkflow,
+    };
+}

package/dist/layer2-static/workflow/parser.js

@@ -7,6 +7,29 @@ function asRecord(value) {
 function asString(value) {
     return typeof value === "string" ? value : undefined;
 }
+function toStringMap(value) {
+    const record = asRecord(value);
+    if (!record) {
+        return undefined;
+    }
+    const entries = {};
+    for (const [key, entry] of Object.entries(record)) {
+        if (typeof entry === "string") {
+            entries[key] = entry;
+        }
+    }
+    return Object.keys(entries).length > 0 ? entries : undefined;
+}
+function extractNeeds(value) {
+    if (typeof value === "string") {
+        const normalized = value.trim();
+        return normalized.length > 0 ? [normalized] : [];
+    }
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
+}
 function normalizeWorkflowPath(value) {
     return value.replaceAll("\\", "/");
 }
@@ -31,19 +54,11 @@ function extractStepFacts(step) {
     if (!stepRecord) {
         return null;
     }
-    const withValues = asRecord(stepRecord.with);
-    const withEntries = {};
-    if (withValues) {
-        for (const [key, value] of Object.entries(withValues)) {
-            if (typeof value === "string") {
-                withEntries[key] = value;
-            }
-        }
-    }
     const stepFacts = {
+        if: asString(stepRecord.if),
         uses: asString(stepRecord.uses),
         run: asString(stepRecord.run),
-        with: Object.keys(withEntries).length > 0 ? withEntries : undefined,
+        with: toStringMap(stepRecord.with),
     };
     if (!stepFacts.uses && !stepFacts.run) {
         return null;
@@ -61,6 +76,11 @@ function extractJobFacts(id, value) {
         .filter((step) => step !== null);
     return {
         id,
+        if: asString(jobRecord.if),
+        uses: asString(jobRecord.uses),
+        with: toStringMap(jobRecord.with),
+        needs: extractNeeds(jobRecord.needs),
+        secrets: jobRecord.secrets,
         permissions: jobRecord.permissions,
         steps,
     };

package/dist/layer2-static/workflow/types.d.ts

@@ -1,10 +1,16 @@
 export interface WorkflowStepFacts {
+    if?: string;
     uses?: string;
     run?: string;
     with?: Record<string, string>;
 }
 export interface WorkflowJobFacts {
     id: string;
+    if?: string;
+    uses?: string;
+    with?: Record<string, string>;
+    needs: string[];
+    secrets?: unknown;
     permissions?: unknown;
     steps: WorkflowStepFacts[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",