codegate-ai 0.9.1 → 0.11.0

package/dist/layer2-static/detectors/workflow-pr-target-checkout-head.js

@@ -0,0 +1,99 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { collectUntrustedReachableJobIds } from "../workflow/analysis.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function hasWritePermission(value) {
+    if (typeof value === "string") {
+        return value.trim().toLowerCase() === "write-all";
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    return Object.values(value).some((permission) => {
+        if (typeof permission !== "string") {
+            return false;
+        }
+        return permission.trim().toLowerCase() === "write";
+    });
+}
+function isCheckoutStep(uses) {
+    if (!uses) {
+        return false;
+    }
+    return /^actions\/checkout(?:@.+)?$/iu.test(uses.trim());
+}
+function isRiskyCheckoutRef(ref) {
+    if (!ref) {
+        return false;
+    }
+    const normalized = ref.toLowerCase();
+    return (normalized.includes("github.event.pull_request.head.") || normalized.includes("github.head_ref"));
+}
+function hasInheritedSecrets(secrets) {
+    return typeof secrets === "string" && secrets.trim().toLowerCase() === "inherit";
+}
+export function detectWorkflowPrTargetCheckoutHead(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const hasPullRequestTarget = facts.triggers.some((trigger) => trigger.trim().toLowerCase() === "pull_request_target");
+    if (!hasPullRequestTarget) {
+        return [];
+    }
+    const reachableJobIds = collectUntrustedReachableJobIds(facts);
+    if (reachableJobIds.size === 0) {
+        return [];
+    }
+    const findings = [];
+    const workflowPrivileged = hasWritePermission(facts.workflowPermissions);
+    facts.jobs.forEach((job, jobIndex) => {
+        if (!reachableJobIds.has(job.id)) {
+            return;
+        }
+        const jobPrivileged = workflowPrivileged || hasWritePermission(job.permissions) || hasInheritedSecrets(job.secrets);
+        job.steps.forEach((step, stepIndex) => {
+            if (!isCheckoutStep(step.uses)) {
+                return;
+            }
+            if (!isRiskyCheckoutRef(step.with?.ref)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [
+                    "pull_request_target",
+                    "actions/checkout",
+                    step.with?.ref ?? "github.event.pull_request.head",
+                ],
+                fallbackValue: "pull_request_target workflow checks out untrusted PR head ref",
+            });
+            findings.push({
+                rule_id: "workflow-pr-target-checkout-head",
+                finding_id: `WORKFLOW_PR_TARGET_CHECKOUT_HEAD-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: jobPrivileged ? "CRITICAL" : "HIGH",
+                category: "CI_TRIGGER",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].with.ref` },
+                description: "pull_request_target job checks out pull request head ref, enabling untrusted code execution in privileged context",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-284",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Avoid checking out pull request head refs in pull_request_target workflows",
+                    "Use pull_request for untrusted code validation and keep privileged operations isolated",
+                    "Enforce least-privilege token scopes and avoid inherited secrets for untrusted paths",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-secret-exfiltration.d.ts

@@ -0,0 +1,8 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowSecretExfiltrationInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+    trustedApiDomains: string[];
+}
+export declare function detectWorkflowSecretExfiltration(input: WorkflowSecretExfiltrationInput): Finding[];

package/dist/layer2-static/detectors/workflow-secret-exfiltration.js

@@ -0,0 +1,97 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const OUTBOUND_COMMAND_PATTERN = /\b(curl|wget|invoke-webrequest|httpie)\b/iu;
+const SECRET_REFERENCE_PATTERN = /\$\{\{\s*secrets\.([a-zA-Z0-9_]+)\s*\}\}/giu;
+const URL_PATTERN = /https?:\/\/[^\s"')]+/giu;
+function extractSecretReferences(value) {
+    const references = new Set();
+    for (const match of value.matchAll(SECRET_REFERENCE_PATTERN)) {
+        const key = match[1]?.trim();
+        if (!key) {
+            continue;
+        }
+        references.add(key);
+    }
+    return Array.from(references);
+}
+function extractUrls(value) {
+    return Array.from(value.matchAll(URL_PATTERN), (match) => match[0] ?? "").filter(Boolean);
+}
+function isTrustedHost(hostname, trustedApiDomains) {
+    const normalizedHost = hostname.toLowerCase();
+    return trustedApiDomains.some((domain) => {
+        const normalizedDomain = domain.toLowerCase();
+        return normalizedHost === normalizedDomain || normalizedHost.endsWith(`.${normalizedDomain}`);
+    });
+}
+function hasOnlyTrustedUrls(run, trustedApiDomains) {
+    const urls = extractUrls(run);
+    if (urls.length === 0) {
+        return false;
+    }
+    return urls.every((url) => {
+        try {
+            const parsed = new URL(url);
+            return isTrustedHost(parsed.hostname, trustedApiDomains);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+export function detectWorkflowSecretExfiltration(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            if (!step.run || !OUTBOUND_COMMAND_PATTERN.test(step.run)) {
+                return;
+            }
+            const referencedSecrets = extractSecretReferences(step.run);
+            if (referencedSecrets.length === 0) {
+                return;
+            }
+            if (hasOnlyTrustedUrls(step.run, input.trustedApiDomains)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: ["secrets.", "curl", "wget", "http://", "https://"],
+                fallbackValue: `${job.id} step references secrets in outbound network command`,
+            });
+            findings.push({
+                rule_id: "workflow-secret-exfiltration",
+                finding_id: `WORKFLOW_SECRET_EXFILTRATION-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "CRITICAL",
+                category: "CI_PERMISSIONS",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                description: "Workflow step sends secret context through outbound network command",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-200",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Avoid sending secrets through outbound shell commands",
+                    "Use trusted first-party actions with scoped credentials instead of ad-hoc exfil-prone scripts",
+                    "Restrict outbound domains and sanitize command arguments in privileged workflows",
+                ],
+                metadata: {
+                    referenced_secrets: referencedSecrets,
+                },
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/engine.js

@@ -41,6 +41,14 @@ import { detectDependabotExecution } from "./detectors/dependabot-execution.js";
 import { detectWorkflowHardcodedContainerCredentials } from "./detectors/workflow-hardcoded-container-credentials.js";
 import { detectWorkflowUnredactedSecrets } from "./detectors/workflow-unredacted-secrets.js";
 import { detectWorkflowBotConditions } from "./detectors/workflow-bot-conditions.js";
+import { detectWorkflowPrTargetCheckoutHead } from "./detectors/workflow-pr-target-checkout-head.js";
+import { detectWorkflowArtifactTrustChain } from "./detectors/workflow-artifact-trust-chain.js";
+import { detectWorkflowCallBoundary } from "./detectors/workflow-call-boundary.js";
+import { detectWorkflowSecretExfiltration } from "./detectors/workflow-secret-exfiltration.js";
+import { detectWorkflowOidcUntrustedContext } from "./detectors/workflow-oidc-untrusted-context.js";
+import { detectWorkflowDynamicMatrixInjection } from "./detectors/workflow-dynamic-matrix-injection.js";
+import { detectDependabotAutoMerge } from "./detectors/dependabot-auto-merge.js";
+import { detectWorkflowLocalActionMutation } from "./detectors/workflow-local-action-mutation.js";
 import { filterRegisteredAudits } from "./audits/registry.js";
 import { FINDING_CATEGORIES } from "../types/finding.js";
 import { buildFindingEvidence } from "./evidence.js";
@@ -536,6 +544,87 @@ function buildFileAudits() {
                 })
                 : [],
         },
+        {
+            id: "workflow-pr-target-checkout-head",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowPrTargetCheckoutHead({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-artifact-trust-chain",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowArtifactTrustChain({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-call-boundary",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowCallBoundary({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-secret-exfiltration",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowSecretExfiltration({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                    trustedApiDomains: input.config.trustedApiDomains,
+                })
+                : [],
+        },
+        {
+            id: "workflow-oidc-untrusted-context",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowOidcUntrustedContext({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-dynamic-matrix-injection",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowDynamicMatrixInjection({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "dependabot-auto-merge",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectDependabotAutoMerge({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-local-action-mutation",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowLocalActionMutation({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
         {
             id: "hardcoded-container-credentials",
             run: ({ file, input }) => input.config.workflowAuditsEnabled

package/dist/layer2-static/workflow/analysis.d.ts

@@ -0,0 +1,24 @@
+import type { WorkflowFacts } from "./types.js";
+export interface WorkflowArtifactTransferEdge {
+    artifactName: string;
+    producerJobId: string;
+    producerStepIndex: number;
+    consumerJobId: string;
+    consumerStepIndex: number;
+    consumerDownloadsAll: boolean;
+}
+export interface WorkflowCallBoundaryContext {
+    hasWorkflowCall: boolean;
+    declaredInputKeys: string[];
+    requiredInputKeys: string[];
+    declaredSecretKeys: string[];
+    requiredSecretKeys: string[];
+    jobsWithInheritedSecrets: string[];
+    jobsCallingReusableWorkflow: string[];
+}
+export declare function buildWorkflowNeedsGraph(facts: WorkflowFacts): Map<string, string[]>;
+export declare function collectTransitiveDependencies(facts: WorkflowFacts, seedJobIds: Iterable<string>): Set<string>;
+export declare function collectTransitiveDependents(facts: WorkflowFacts, seedJobIds: Iterable<string>): Set<string>;
+export declare function collectArtifactTransferEdges(facts: WorkflowFacts): WorkflowArtifactTransferEdge[];
+export declare function collectUntrustedReachableJobIds(facts: WorkflowFacts): Set<string>;
+export declare function extractWorkflowCallBoundaryContext(parsed: unknown, facts: WorkflowFacts): WorkflowCallBoundaryContext;

package/dist/layer2-static/workflow/analysis.js

@@ -0,0 +1,201 @@
+const UNTRUSTED_TRIGGER_SET = new Set([
+    "pull_request",
+    "pull_request_target",
+    "workflow_run",
+    "issue_comment",
+    "pull_request_review_comment",
+    "discussion_comment",
+]);
+const BOT_ONLY_CONDITION_PATTERNS = [
+    /github\.actor\s*==\s*['"]dependabot\[bot\]['"]/iu,
+    /github\.actor\s*==\s*['"]github-actions\[bot\]['"]/iu,
+    /github\.event\.pull_request\.head\.repo\.fork\s*==\s*false/iu,
+];
+const UPLOAD_ARTIFACT_ACTIONS = new Set([
+    "actions/upload-artifact",
+    "actions/upload-artifact/merge",
+]);
+const DOWNLOAD_ARTIFACT_ACTIONS = new Set(["actions/download-artifact"]);
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function normalizeUses(uses) {
+    if (!uses) {
+        return null;
+    }
+    const trimmed = uses.trim().toLowerCase();
+    if (trimmed.length === 0) {
+        return null;
+    }
+    const atIndex = trimmed.indexOf("@");
+    if (atIndex === -1) {
+        return trimmed;
+    }
+    return trimmed.slice(0, atIndex);
+}
+function isWorkflowTriggerUntrusted(trigger) {
+    return UNTRUSTED_TRIGGER_SET.has(trigger.trim().toLowerCase());
+}
+function isUntrustedRestrictedCondition(condition) {
+    if (!condition) {
+        return false;
+    }
+    return BOT_ONLY_CONDITION_PATTERNS.some((pattern) => pattern.test(condition));
+}
+function normalizeArtifactName(value) {
+    if (!value) {
+        return null;
+    }
+    const normalized = value.trim();
+    return normalized.length > 0 ? normalized : null;
+}
+export function buildWorkflowNeedsGraph(facts) {
+    return new Map(facts.jobs.map((job) => [job.id, [...job.needs]]));
+}
+export function collectTransitiveDependencies(facts, seedJobIds) {
+    const graph = buildWorkflowNeedsGraph(facts);
+    const visited = new Set();
+    const queue = [...seedJobIds];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (!current) {
+            continue;
+        }
+        const dependencies = graph.get(current) ?? [];
+        for (const dependency of dependencies) {
+            if (visited.has(dependency)) {
+                continue;
+            }
+            visited.add(dependency);
+            queue.push(dependency);
+        }
+    }
+    return visited;
+}
+export function collectTransitiveDependents(facts, seedJobIds) {
+    const reverseGraph = new Map();
+    for (const job of facts.jobs) {
+        for (const dependency of job.needs) {
+            const dependents = reverseGraph.get(dependency) ?? [];
+            dependents.push(job.id);
+            reverseGraph.set(dependency, dependents);
+        }
+    }
+    const visited = new Set();
+    const queue = [...seedJobIds];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (!current) {
+            continue;
+        }
+        const dependents = reverseGraph.get(current) ?? [];
+        for (const dependent of dependents) {
+            if (visited.has(dependent)) {
+                continue;
+            }
+            visited.add(dependent);
+            queue.push(dependent);
+        }
+    }
+    return visited;
+}
+export function collectArtifactTransferEdges(facts) {
+    const producersByArtifact = new Map();
+    const edges = [];
+    const dedupe = new Set();
+    for (const job of facts.jobs) {
+        for (const [stepIndex, step] of job.steps.entries()) {
+            const normalizedUses = normalizeUses(step.uses);
+            if (!normalizedUses || !UPLOAD_ARTIFACT_ACTIONS.has(normalizedUses)) {
+                continue;
+            }
+            const artifactName = normalizeArtifactName(step.with?.name) ?? "__unnamed__";
+            const producers = producersByArtifact.get(artifactName) ?? [];
+            producers.push({ jobId: job.id, stepIndex });
+            producersByArtifact.set(artifactName, producers);
+        }
+    }
+    for (const job of facts.jobs) {
+        for (const [stepIndex, step] of job.steps.entries()) {
+            const normalizedUses = normalizeUses(step.uses);
+            if (!normalizedUses || !DOWNLOAD_ARTIFACT_ACTIONS.has(normalizedUses)) {
+                continue;
+            }
+            const requestedName = normalizeArtifactName(step.with?.name);
+            const consumerDownloadsAll = !requestedName;
+            const artifactNames = requestedName
+                ? [requestedName]
+                : Array.from(producersByArtifact.keys());
+            for (const artifactName of artifactNames) {
+                const producers = producersByArtifact.get(artifactName) ?? [];
+                for (const producer of producers) {
+                    const key = [
+                        artifactName,
+                        producer.jobId,
+                        producer.stepIndex,
+                        job.id,
+                        stepIndex,
+                        consumerDownloadsAll ? "all" : "named",
+                    ].join("|");
+                    if (dedupe.has(key)) {
+                        continue;
+                    }
+                    dedupe.add(key);
+                    edges.push({
+                        artifactName,
+                        producerJobId: producer.jobId,
+                        producerStepIndex: producer.stepIndex,
+                        consumerJobId: job.id,
+                        consumerStepIndex: stepIndex,
+                        consumerDownloadsAll,
+                    });
+                }
+            }
+        }
+    }
+    return edges;
+}
+export function collectUntrustedReachableJobIds(facts) {
+    const hasUntrustedTrigger = facts.triggers.some((trigger) => isWorkflowTriggerUntrusted(trigger));
+    if (!hasUntrustedTrigger) {
+        return new Set();
+    }
+    return new Set(facts.jobs.filter((job) => !isUntrustedRestrictedCondition(job.if)).map((job) => job.id));
+}
+export function extractWorkflowCallBoundaryContext(parsed, facts) {
+    const root = asRecord(parsed);
+    const onRecord = root ? asRecord(root.on) : null;
+    const workflowCall = onRecord ? asRecord(onRecord.workflow_call) : null;
+    const inputsRecord = workflowCall ? asRecord(workflowCall.inputs) : null;
+    const declaredInputKeys = inputsRecord ? Object.keys(inputsRecord) : [];
+    const requiredInputKeys = inputsRecord
+        ? Object.entries(inputsRecord)
+            .filter(([, value]) => asRecord(value)?.required === true)
+            .map(([key]) => key)
+        : [];
+    const secretsRecord = workflowCall ? asRecord(workflowCall.secrets) : null;
+    const declaredSecretKeys = secretsRecord ? Object.keys(secretsRecord) : [];
+    const requiredSecretKeys = secretsRecord
+        ? Object.entries(secretsRecord)
+            .filter(([, value]) => asRecord(value)?.required === true)
+            .map(([key]) => key)
+        : [];
+    const jobsWithInheritedSecrets = facts.jobs
+        .filter((job) => typeof job.secrets === "string" && job.secrets.trim().toLowerCase() === "inherit")
+        .map((job) => job.id);
+    const jobsCallingReusableWorkflow = facts.jobs
+        .filter((job) => typeof job.uses === "string" && job.uses.trim().length > 0)
+        .map((job) => job.id);
+    return {
+        hasWorkflowCall: workflowCall !== null,
+        declaredInputKeys,
+        requiredInputKeys,
+        declaredSecretKeys,
+        requiredSecretKeys,
+        jobsWithInheritedSecrets,
+        jobsCallingReusableWorkflow,
+    };
+}

package/dist/layer2-static/workflow/parser.js

@@ -7,6 +7,29 @@ function asRecord(value) {
 function asString(value) {
     return typeof value === "string" ? value : undefined;
 }
+function toStringMap(value) {
+    const record = asRecord(value);
+    if (!record) {
+        return undefined;
+    }
+    const entries = {};
+    for (const [key, entry] of Object.entries(record)) {
+        if (typeof entry === "string") {
+            entries[key] = entry;
+        }
+    }
+    return Object.keys(entries).length > 0 ? entries : undefined;
+}
+function extractNeeds(value) {
+    if (typeof value === "string") {
+        const normalized = value.trim();
+        return normalized.length > 0 ? [normalized] : [];
+    }
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
+}
 function normalizeWorkflowPath(value) {
     return value.replaceAll("\\", "/");
 }
@@ -31,19 +54,11 @@ function extractStepFacts(step) {
     if (!stepRecord) {
         return null;
     }
-    const withValues = asRecord(stepRecord.with);
-    const withEntries = {};
-    if (withValues) {
-        for (const [key, value] of Object.entries(withValues)) {
-            if (typeof value === "string") {
-                withEntries[key] = value;
-            }
-        }
-    }
     const stepFacts = {
+        if: asString(stepRecord.if),
         uses: asString(stepRecord.uses),
         run: asString(stepRecord.run),
-        with: Object.keys(withEntries).length > 0 ? withEntries : undefined,
+        with: toStringMap(stepRecord.with),
     };
     if (!stepFacts.uses && !stepFacts.run) {
         return null;
@@ -61,6 +76,11 @@ function extractJobFacts(id, value) {
         .filter((step) => step !== null);
     return {
         id,
+        if: asString(jobRecord.if),
+        uses: asString(jobRecord.uses),
+        with: toStringMap(jobRecord.with),
+        needs: extractNeeds(jobRecord.needs),
+        secrets: jobRecord.secrets,
         permissions: jobRecord.permissions,
         steps,
     };

package/dist/layer2-static/workflow/types.d.ts

@@ -1,10 +1,16 @@
 export interface WorkflowStepFacts {
+    if?: string;
     uses?: string;
     run?: string;
     with?: Record<string, string>;
 }
 export interface WorkflowJobFacts {
     id: string;
+    if?: string;
+    uses?: string;
+    with?: Record<string, string>;
+    needs: string[];
+    secrets?: unknown;
     permissions?: unknown;
     steps: WorkflowStepFacts[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",