eslint-plugin-github-actions-2 1.0.0

package/dist/rules/no-invalid-workflow-call-output-value.js

@@ -0,0 +1,99 @@
+import { getGithubExpressionBodies, getReferencedContextRoots, } from "../_internal/github-expressions.js";
+import { getMappingPair, getMappingValueAsMapping, getScalarStringValue, getWorkflowRoot, unwrapYamlValue, } from "../_internal/workflow-yaml.js";
+/** Match reusable workflow output mappings to job outputs. */
+const jobsOutputReferencePattern = /jobs\.[A-Z_a-z][\w-]*\.outputs\.[A-Z_a-z][\w-]*/;
+/** Allowed expression contexts for `on.workflow_call.outputs.*.value`. */
+const allowedWorkflowCallOutputContexts = new Set([
+    "github",
+    "inputs",
+    "jobs",
+    "vars",
+]);
+/** Determine whether a scalar value reads at least one declared job output. */
+const hasJobsOutputReference = (value) => getGithubExpressionBodies(value).some((expression) => jobsOutputReferencePattern.test(expression));
+/** Rule implementation for validating reusable workflow output values. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const onMapping = getMappingValueAsMapping(root, "on");
+                if (onMapping === null) {
+                    return;
+                }
+                const workflowCallMapping = unwrapYamlValue(getMappingPair(onMapping, "workflow_call")?.value ?? null);
+                if (workflowCallMapping?.type !== "YAMLMapping") {
+                    return;
+                }
+                const outputsMapping = getMappingValueAsMapping(workflowCallMapping, "outputs");
+                if (outputsMapping === null) {
+                    return;
+                }
+                for (const pair of outputsMapping.pairs) {
+                    const outputId = getScalarStringValue(pair.key);
+                    const outputMapping = unwrapYamlValue(pair.value);
+                    if (outputId === null ||
+                        outputMapping?.type !== "YAMLMapping") {
+                        continue;
+                    }
+                    const valuePair = getMappingPair(outputMapping, "value");
+                    const value = getScalarStringValue(valuePair?.value ?? null);
+                    if (valuePair === null ||
+                        value === null ||
+                        value.trim().length === 0) {
+                        continue;
+                    }
+                    const disallowedContexts = getReferencedContextRoots(value).filter((contextRoot) => !allowedWorkflowCallOutputContexts.has(contextRoot));
+                    if (disallowedContexts.length > 0) {
+                        context.report({
+                            data: {
+                                contexts: disallowedContexts.join(", "),
+                                outputId,
+                            },
+                            messageId: "invalidContext",
+                            node: (valuePair.value ??
+                                valuePair),
+                        });
+                        continue;
+                    }
+                    if (!hasJobsOutputReference(value)) {
+                        context.report({
+                            data: {
+                                outputId,
+                            },
+                            messageId: "missingJobOutputReference",
+                            node: (valuePair.value ??
+                                valuePair),
+                        });
+                    }
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.recommended",
+                "github-actions.configs.strict",
+            ],
+            description: "disallow `workflow_call` output values that use unavailable contexts or fail to map from `jobs.<job_id>.outputs.<output_name>`.",
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R040",
+            ruleNumber: 40,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-invalid-workflow-call-output-value",
+        },
+        messages: {
+            invalidContext: "`workflow_call` output '{{outputId}}' uses unsupported context access in `value` ({{contexts}}). Reusable workflow output values may only reference `github`, `jobs`, `vars`, and `inputs`.",
+            missingJobOutputReference: "`workflow_call` output '{{outputId}}' must map `value` from a job output such as `jobs.build.outputs.artifact`.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-invalid-workflow-call-output-value.js.map

package/dist/rules/no-invalid-workflow-call-output-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-invalid-workflow-call-output-value.js","sourceRoot":"","sources":["../../src/rules/no-invalid-workflow-call-output-value.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,yBAAyB,EACzB,yBAAyB,GAC5B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,8DAA8D;AAC9D,MAAM,0BAA0B,GAC5B,iDAAiD,CAAC;AAEtD,0EAA0E;AAC1E,MAAM,iCAAiC,GAAwB,IAAI,GAAG,CAAC;IACnE,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;CACT,CAAC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,CAAC,KAAa,EAAW,EAAE,CACtD,yBAAyB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CACjD,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAC9C,CAAC;AAEN,0EAA0E;AAC1E,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAEvD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO;gBACX,CAAC;gBAED,MAAM,mBAAmB,GAAG,eAAe,CACvC,cAAc,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,KAAK,IAAI,IAAI,CAC5D,CAAC;gBAEF,IAAI,mBAAmB,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;oBAC9C,OAAO;gBACX,CAAC;gBAED,MAAM,cAAc,GAAG,wBAAwB,CAC3C,mBAAmB,EACnB,SAAS,CACZ,CAAC;gBAEF,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;oBAC1B,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;oBACtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAChD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAElD,IACI,QAAQ,KAAK,IAAI;wBACjB,aAAa,EAAE,IAAI,KAAK,aAAa,EACvC,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;oBACzD,MAAM,KAAK,GAAG,oBAAoB,CAC9B,SAAS,EAAE,KAAK,IAAI,IAAI,CAC3B,CAAC;oBAEF,IACI,SAAS,KAAK,IAAI;wBAClB,KAAK,KAAK,IAAI;wBACd,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC3B,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,kBAAkB,GAAG,yBAAyB,CAChD,KAAK,CACR,CAAC,MAAM,CACJ,CAAC,WAAW,EAAE,EAAE,CACZ,CAAC,iCAAiC,CAAC,GAAG,CAAC,WAAW,CAAC,CAC1D,CAAC;oBAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,MAAM,CAAC;4BACX,IAAI,EAAE;gCACF,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gCACvC,QAAQ;6BACX;4BACD,SAAS,EAAE,gBAAgB;4BAC3B,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK;gCAClB,SAAS,CAAyB;yBACzC,CAAC,CAAC;wBAEH,SAAS;oBACb,CAAC;oBAED,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACjC,OAAO,CAAC,MAAM,CAAC;4BACX,IAAI,EAAE;gCACF,QAAQ;6BACX;4BACD,SAAS,EAAE,2BAA2B;4BACtC,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK;gCAClB,SAAS,CAAyB;yBACzC,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,oCAAoC;gBACpC,+BAA+B;aAClC;YACD,WAAW,EACP,iIAAiI;YACrI,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,8GAA8G;SACtH;QACD,QAAQ,EAAE;YACN,cAAc,EACV,6LAA6L;YACjM,yBAAyB,EACrB,iHAAiH;SACxH;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-path-separators-in-template-icon-name.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow path separators in workflow-template `iconName` values.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for icon path-separator checks. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-path-separators-in-template-icon-name.d.ts.map

package/dist/rules/no-path-separators-in-template-icon-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-path-separators-in-template-icon-name.d.ts","sourceRoot":"","sources":["../../src/rules/no-path-separators-in-template-icon-name.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAQnC,0DAA0D;AAC1D,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA0DhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-path-separators-in-template-icon-name.js

@@ -0,0 +1,52 @@
+import { isWorkflowTemplatePropertiesFile } from "../_internal/lint-targets.js";
+import { getWorkflowTemplatePropertiesRoot, getWorkflowTemplateStringProperty, } from "../_internal/workflow-template-properties.js";
+/** Rule implementation for icon path-separator checks. */
+const rule = {
+    create(context) {
+        return {
+            Program(node) {
+                if (!isWorkflowTemplatePropertiesFile(context.filename)) {
+                    return;
+                }
+                const root = getWorkflowTemplatePropertiesRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const iconName = getWorkflowTemplateStringProperty(root, "iconName");
+                if (iconName === null ||
+                    (!iconName.includes("/") && !iconName.includes("\\"))) {
+                    return;
+                }
+                context.report({
+                    data: {
+                        iconName,
+                    },
+                    messageId: "iconNameContainsPathSeparator",
+                    node: node,
+                });
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.workflowTemplateProperties",
+                "github-actions.configs.workflowTemplates",
+                "github-actions.configs.all",
+            ],
+            description: "disallow path separators in workflow-template `iconName` values.",
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R064",
+            ruleNumber: 64,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-path-separators-in-template-icon-name",
+        },
+        messages: {
+            iconNameContainsPathSeparator: "Template `iconName` '{{iconName}}' should be a plain icon token, not a path.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-path-separators-in-template-icon-name.js.map

package/dist/rules/no-path-separators-in-template-icon-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-path-separators-in-template-icon-name.js","sourceRoot":"","sources":["../../src/rules/no-path-separators-in-template-icon-name.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EACH,iCAAiC,EACjC,iCAAiC,GACpC,MAAM,8CAA8C,CAAC;AAEtD,0DAA0D;AAC1D,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO,CAAC,IAAI;gBACR,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtD,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;gBAExD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,QAAQ,GAAG,iCAAiC,CAC9C,IAAI,EACJ,UAAU,CACb,CAAC;gBAEF,IACI,QAAQ,KAAK,IAAI;oBACjB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EACvD,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,IAAI,EAAE;wBACF,QAAQ;qBACX;oBACD,SAAS,EAAE,+BAA+B;oBAC1C,IAAI,EAAE,IAA4B;iBACrC,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,mDAAmD;gBACnD,0CAA0C;gBAC1C,4BAA4B;aAC/B;YACD,WAAW,EACP,kEAAkE;YACtE,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,iHAAiH;SACzH;QACD,QAAQ,EAAE;YACN,6BAA6B,EACzB,8EAA8E;SACrF;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-post-if-without-post.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow `runs.post-if` when `runs.post` is not declared.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for invalid `runs.post-if` usage. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-post-if-without-post.d.ts.map

package/dist/rules/no-post-if-without-post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-post-if-without-post.d.ts","sourceRoot":"","sources":["../../src/rules/no-post-if-without-post.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AASnC,4DAA4D;AAC5D,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAwDhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-post-if-without-post.js

@@ -0,0 +1,52 @@
+import { isActionMetadataFile } from "../_internal/lint-targets.js";
+import { getMappingPair, getMappingValueAsMapping, getWorkflowRoot, } from "../_internal/workflow-yaml.js";
+/** Rule implementation for invalid `runs.post-if` usage. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                if (!isActionMetadataFile(context.filename)) {
+                    return;
+                }
+                const root = getWorkflowRoot(context);
+                const runsMapping = root === null
+                    ? null
+                    : getMappingValueAsMapping(root, "runs");
+                if (runsMapping === null) {
+                    return;
+                }
+                const postIfPair = getMappingPair(runsMapping, "post-if");
+                if (postIfPair === null ||
+                    getMappingPair(runsMapping, "post")) {
+                    return;
+                }
+                context.report({
+                    messageId: "postIfWithoutPost",
+                    node: (postIfPair.value ??
+                        postIfPair),
+                });
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.actionMetadata",
+                "github-actions.configs.all",
+            ],
+            description: "disallow `runs.post-if` when `runs.post` is not configured in action metadata.",
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R046",
+            ruleNumber: 46,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-post-if-without-post",
+        },
+        messages: {
+            postIfWithoutPost: "`runs.post-if` is set, but `runs.post` is missing. Remove `post-if` or add `post`.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-post-if-without-post.js.map

package/dist/rules/no-post-if-without-post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-post-if-without-post.js","sourceRoot":"","sources":["../../src/rules/no-post-if-without-post.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,4DAA4D;AAC5D,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM,WAAW,GACb,IAAI,KAAK,IAAI;oBACT,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAEjD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;oBACvB,OAAO;gBACX,CAAC;gBAED,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBAE1D,IACI,UAAU,KAAK,IAAI;oBACnB,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,EACrC,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,mBAAmB;oBAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK;wBACnB,UAAU,CAAyB;iBAC1C,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,uCAAuC;gBACvC,4BAA4B;aAC/B;YACD,WAAW,EACP,gFAAgF;YACpF,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,gGAAgG;SACxG;QACD,QAAQ,EAAE;YACN,iBAAiB,EACb,oFAAoF;SAC3F;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-pr-head-checkout-in-pull-request-target.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @packageDocumentation
+ * Disallow checking out pull-request head content in `pull_request_target` workflows.
+ */
+import type { Rule } from "eslint";
+/**
+ * Rule implementation for disallowing pull-request head checkouts in
+ * pull_request_target.
+ */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-pr-head-checkout-in-pull-request-target.d.ts.map

package/dist/rules/no-pr-head-checkout-in-pull-request-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-pr-head-checkout-in-pull-request-target.d.ts","sourceRoot":"","sources":["../../src/rules/no-pr-head-checkout-in-pull-request-target.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAsBnC;;;GAGG;AACH,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA0GhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-pr-head-checkout-in-pull-request-target.js

@@ -0,0 +1,89 @@
+import { getMappingPair, getMappingValueAsMapping, getMappingValueAsSequence, getScalarStringValue, getWorkflowEventNames, getWorkflowJobs, getWorkflowRoot, unwrapYamlValue, } from "../_internal/workflow-yaml.js";
+/** Detect `actions/checkout` references. */
+const isCheckoutActionReference = (reference) => reference.startsWith("actions/checkout@");
+/** Detect risky PR-head references in checkout parameters. */
+const hasPullRequestHeadReference = (value) => /\bgithub\.head_ref\b/u.test(value) ||
+    /\bgithub\.event\.pull_request\.head\./u.test(value);
+/**
+ * Rule implementation for disallowing pull-request head checkouts in
+ * pull_request_target.
+ */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const eventNames = getWorkflowEventNames(root);
+                if (!eventNames.has("pull_request_target")) {
+                    return;
+                }
+                for (const job of getWorkflowJobs(root)) {
+                    const stepsSequence = getMappingValueAsSequence(job.mapping, "steps");
+                    if (stepsSequence === null) {
+                        continue;
+                    }
+                    for (const entry of stepsSequence.entries) {
+                        const stepMapping = unwrapYamlValue(entry);
+                        if (stepMapping?.type !== "YAMLMapping") {
+                            continue;
+                        }
+                        const usesPair = getMappingPair(stepMapping, "uses");
+                        const usesReference = getScalarStringValue(usesPair?.value ?? null);
+                        if (usesPair === null ||
+                            usesReference === null ||
+                            !isCheckoutActionReference(usesReference)) {
+                            continue;
+                        }
+                        const withMapping = getMappingValueAsMapping(stepMapping, "with");
+                        if (withMapping === null) {
+                            continue;
+                        }
+                        for (const key of ["ref", "repository"]) {
+                            const optionPair = getMappingPair(withMapping, key);
+                            const optionValue = getScalarStringValue(optionPair?.value ?? null);
+                            if (optionPair === null ||
+                                optionValue === null ||
+                                !hasPullRequestHeadReference(optionValue)) {
+                                continue;
+                            }
+                            context.report({
+                                data: {
+                                    jobId: job.id,
+                                    key,
+                                },
+                                messageId: "pullRequestHeadCheckout",
+                                node: (optionPair.value ??
+                                    optionPair),
+                            });
+                        }
+                    }
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.security",
+                "github-actions.configs.strict",
+            ],
+            description: "disallow `actions/checkout` configurations in `pull_request_target` workflows that fetch pull request head refs, SHAs, or repositories into a privileged run.",
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R030",
+            ruleNumber: 30,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-pr-head-checkout-in-pull-request-target",
+        },
+        messages: {
+            pullRequestHeadCheckout: "Job '{{jobId}}' uses `actions/checkout` with `with.{{key}}` pointing at pull request head content inside a `pull_request_target` workflow. Avoid checking out untrusted PR head code in this privileged trigger.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-pr-head-checkout-in-pull-request-target.js.map

package/dist/rules/no-pr-head-checkout-in-pull-request-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-pr-head-checkout-in-pull-request-target.js","sourceRoot":"","sources":["../../src/rules/no-pr-head-checkout-in-pull-request-target.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,4CAA4C;AAC5C,MAAM,yBAAyB,GAAG,CAAC,SAAiB,EAAW,EAAE,CAC7D,SAAS,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAE9C,8DAA8D;AAC9D,MAAM,2BAA2B,GAAG,CAAC,KAAa,EAAW,EAAE,CAC3D,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;IACnC,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEzD;;;GAGG;AACH,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBAE/C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;oBACzC,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,MAAM,aAAa,GAAG,yBAAyB,CAC3C,GAAG,CAAC,OAAO,EACX,OAAO,CACV,CAAC;oBAEF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;wBACzB,SAAS;oBACb,CAAC;oBAED,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;wBACxC,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;wBAE3C,IAAI,WAAW,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;4BACtC,SAAS;wBACb,CAAC;wBAED,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;wBACrD,MAAM,aAAa,GAAG,oBAAoB,CACtC,QAAQ,EAAE,KAAK,IAAI,IAAI,CAC1B,CAAC;wBAEF,IACI,QAAQ,KAAK,IAAI;4BACjB,aAAa,KAAK,IAAI;4BACtB,CAAC,yBAAyB,CAAC,aAAa,CAAC,EAC3C,CAAC;4BACC,SAAS;wBACb,CAAC;wBAED,MAAM,WAAW,GAAG,wBAAwB,CACxC,WAAW,EACX,MAAM,CACT,CAAC;wBAEF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;4BACvB,SAAS;wBACb,CAAC;wBAED,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAU,EAAE,CAAC;4BAC/C,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;4BACpD,MAAM,WAAW,GAAG,oBAAoB,CACpC,UAAU,EAAE,KAAK,IAAI,IAAI,CAC5B,CAAC;4BAEF,IACI,UAAU,KAAK,IAAI;gCACnB,WAAW,KAAK,IAAI;gCACpB,CAAC,2BAA2B,CAAC,WAAW,CAAC,EAC3C,CAAC;gCACC,SAAS;4BACb,CAAC;4BAED,OAAO,CAAC,MAAM,CAAC;gCACX,IAAI,EAAE;oCACF,KAAK,EAAE,GAAG,CAAC,EAAE;oCACb,GAAG;iCACN;gCACD,SAAS,EAAE,yBAAyB;gCACpC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK;oCACnB,UAAU,CAAyB;6BAC1C,CAAC,CAAC;wBACP,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,iCAAiC;gBACjC,+BAA+B;aAClC;YACD,WAAW,EACP,+JAA+J;YACnK,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,mHAAmH;SAC3H;QACD,QAAQ,EAAE;YACN,uBAAuB,EACnB,kNAAkN;SACzN;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-pre-if-without-pre.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow `runs.pre-if` when `runs.pre` is not declared.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for invalid `runs.pre-if` usage. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-pre-if-without-pre.d.ts.map

package/dist/rules/no-pre-if-without-pre.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-pre-if-without-pre.d.ts","sourceRoot":"","sources":["../../src/rules/no-pre-if-without-pre.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AASnC,2DAA2D;AAC3D,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAqDhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-pre-if-without-pre.js

@@ -0,0 +1,51 @@
+import { isActionMetadataFile } from "../_internal/lint-targets.js";
+import { getMappingPair, getMappingValueAsMapping, getWorkflowRoot, } from "../_internal/workflow-yaml.js";
+/** Rule implementation for invalid `runs.pre-if` usage. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                if (!isActionMetadataFile(context.filename)) {
+                    return;
+                }
+                const root = getWorkflowRoot(context);
+                const runsMapping = root === null
+                    ? null
+                    : getMappingValueAsMapping(root, "runs");
+                if (runsMapping === null) {
+                    return;
+                }
+                const preIfPair = getMappingPair(runsMapping, "pre-if");
+                if (preIfPair === null || getMappingPair(runsMapping, "pre")) {
+                    return;
+                }
+                context.report({
+                    messageId: "preIfWithoutPre",
+                    node: (preIfPair.value ??
+                        preIfPair),
+                });
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.actionMetadata",
+                "github-actions.configs.all",
+            ],
+            description: "disallow `runs.pre-if` when `runs.pre` is not configured in action metadata.",
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R045",
+            ruleNumber: 45,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-pre-if-without-pre",
+        },
+        messages: {
+            preIfWithoutPre: "`runs.pre-if` is set, but `runs.pre` is missing. Remove `pre-if` or add `pre`.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-pre-if-without-pre.js.map

package/dist/rules/no-pre-if-without-pre.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-pre-if-without-pre.js","sourceRoot":"","sources":["../../src/rules/no-pre-if-without-pre.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,2DAA2D;AAC3D,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM,WAAW,GACb,IAAI,KAAK,IAAI;oBACT,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAEjD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;oBACvB,OAAO;gBACX,CAAC;gBAED,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBAExD,IAAI,SAAS,KAAK,IAAI,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC3D,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK;wBAClB,SAAS,CAAyB;iBACzC,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,uCAAuC;gBACvC,4BAA4B;aAC/B;YACD,WAAW,EACP,8EAA8E;YAClF,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,8FAA8F;SACtG;QACD,QAAQ,EAAE;YACN,eAAe,EACX,gFAAgF;SACvF;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-required-input-with-default.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow action inputs that are both required and defaulted.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for contradictory action input definitions. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-required-input-with-default.d.ts.map

package/dist/rules/no-required-input-with-default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-required-input-with-default.d.ts","sourceRoot":"","sources":["../../src/rules/no-required-input-with-default.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAWnC,sEAAsE;AACtE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAiFhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-required-input-with-default.js

@@ -0,0 +1,68 @@
+import { isActionMetadataFile } from "../_internal/lint-targets.js";
+import { getMappingPair, getMappingValueAsMapping, getScalarStringValue, getWorkflowRoot, unwrapYamlValue, } from "../_internal/workflow-yaml.js";
+/** Rule implementation for contradictory action input definitions. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                if (!isActionMetadataFile(context.filename)) {
+                    return;
+                }
+                const root = getWorkflowRoot(context);
+                const inputsMapping = root === null
+                    ? null
+                    : getMappingValueAsMapping(root, "inputs");
+                if (inputsMapping === null) {
+                    return;
+                }
+                for (const pair of inputsMapping.pairs) {
+                    const inputId = getScalarStringValue(pair.key);
+                    const inputMapping = unwrapYamlValue(pair.value);
+                    if (inputId === null ||
+                        inputMapping?.type !== "YAMLMapping") {
+                        continue;
+                    }
+                    const requiredPair = getMappingPair(inputMapping, "required");
+                    const defaultPair = getMappingPair(inputMapping, "default");
+                    if (requiredPair === null || defaultPair === null) {
+                        continue;
+                    }
+                    const requiredValue = unwrapYamlValue(requiredPair.value);
+                    if (requiredValue?.type !== "YAMLScalar" ||
+                        requiredValue.value !== true) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            inputId,
+                        },
+                        messageId: "requiredInputWithDefault",
+                        node: (defaultPair.value ??
+                            defaultPair),
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.actionMetadata",
+                "github-actions.configs.all",
+            ],
+            description: "disallow action inputs that set both `required: true` and `default`.",
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R047",
+            ruleNumber: 47,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-required-input-with-default",
+        },
+        messages: {
+            requiredInputWithDefault: "Input '{{inputId}}' sets both `required: true` and `default`, which is contradictory for action callers.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-required-input-with-default.js.map

package/dist/rules/no-required-input-with-default.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-required-input-with-default.js","sourceRoot":"","sources":["../../src/rules/no-required-input-with-default.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,sEAAsE;AACtE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM,aAAa,GACf,IAAI,KAAK,IAAI;oBACT,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAEnD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;oBACzB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;oBACrC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC/C,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAEjD,IACI,OAAO,KAAK,IAAI;wBAChB,YAAY,EAAE,IAAI,KAAK,aAAa,EACtC,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,YAAY,GAAG,cAAc,CAC/B,YAAY,EACZ,UAAU,CACb,CAAC;oBACF,MAAM,WAAW,GAAG,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;oBAE5D,IAAI,YAAY,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;wBAChD,SAAS;oBACb,CAAC;oBAED,MAAM,aAAa,GAAG,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;oBAE1D,IACI,aAAa,EAAE,IAAI,KAAK,YAAY;wBACpC,aAAa,CAAC,KAAK,KAAK,IAAI,EAC9B,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,OAAO;yBACV;wBACD,SAAS,EAAE,0BAA0B;wBACrC,IAAI,EAAE,CAAC,WAAW,CAAC,KAAK;4BACpB,WAAW,CAAyB;qBAC3C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,uCAAuC;gBACvC,4BAA4B;aAC/B;YACD,WAAW,EACP,sEAAsE;YAC1E,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,uGAAuG;SAC/G;QACD,QAAQ,EAAE;YACN,wBAAwB,EACpB,0GAA0G;SACjH;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-secrets-in-if.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow direct secret references in `if` conditionals.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for disallowing direct secret usage in `if` conditionals. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-secrets-in-if.d.ts.map

package/dist/rules/no-secrets-in-if.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-secrets-in-if.d.ts","sourceRoot":"","sources":["../../src/rules/no-secrets-in-if.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAwCnC,oFAAoF;AACpF,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA0FhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-secrets-in-if.js

@@ -0,0 +1,84 @@
+import { getMappingPair, getMappingValueAsSequence, getScalarStringValue, getWorkflowJobs, getWorkflowRoot, unwrapYamlValue, } from "../_internal/workflow-yaml.js";
+/** Direct secret-access patterns that GitHub discourages in `if` conditionals. */
+const directSecretsPatterns = [
+    /\bsecrets\.\w+\b/u,
+    /\bsecrets\[["'][^"'\]]+["']\]/u,
+];
+/**
+ * Determine whether an `if` expression directly references the `secrets`
+ * context.
+ */
+const hasDirectSecretsReference = (expression) => directSecretsPatterns.some((pattern) => pattern.test(expression));
+/** Report a direct-secrets conditional reference. */
+const reportDirectSecretsConditional = (context, ifPair, scope) => {
+    context.report({
+        data: {
+            scope,
+        },
+        messageId: "directSecretsInIf",
+        node: ifPair.value,
+    });
+};
+/** Rule implementation for disallowing direct secret usage in `if` conditionals. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const job of getWorkflowJobs(root)) {
+                    const jobIfPair = getMappingPair(job.mapping, "if");
+                    const jobIfExpression = getScalarStringValue(jobIfPair?.value ?? null);
+                    if (jobIfPair !== null &&
+                        jobIfExpression !== null &&
+                        hasDirectSecretsReference(jobIfExpression)) {
+                        reportDirectSecretsConditional(context, jobIfPair, `job '${job.id}'`);
+                    }
+                    const stepsSequence = getMappingValueAsSequence(job.mapping, "steps");
+                    if (stepsSequence === null) {
+                        continue;
+                    }
+                    for (const entry of stepsSequence.entries) {
+                        const stepMapping = unwrapYamlValue(entry);
+                        if (stepMapping?.type !== "YAMLMapping") {
+                            continue;
+                        }
+                        const stepIfPair = getMappingPair(stepMapping, "if");
+                        const stepIfExpression = getScalarStringValue(stepIfPair?.value ?? null);
+                        if (stepIfPair === null ||
+                            stepIfExpression === null ||
+                            !hasDirectSecretsReference(stepIfExpression)) {
+                            continue;
+                        }
+                        reportDirectSecretsConditional(context, stepIfPair, `a step in job '${job.id}'`);
+                    }
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.recommended",
+                "github-actions.configs.security",
+                "github-actions.configs.strict",
+            ],
+            description: "disallow direct `secrets.*` references in job and step `if` conditionals; move secret values into `env` first and condition on that instead.",
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R027",
+            ruleNumber: 27,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-secrets-in-if",
+        },
+        messages: {
+            directSecretsInIf: "Do not reference `secrets` directly in {{scope}} `if` conditionals. Assign the secret to `env` first, then check the environment variable.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-secrets-in-if.js.map

package/dist/rules/no-secrets-in-if.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-secrets-in-if.js","sourceRoot":"","sources":["../../src/rules/no-secrets-in-if.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,MAAM,qBAAqB,GAAG;IAC1B,mBAAmB;IACnB,gCAAgC;CAC1B,CAAC;AAEX;;;GAGG;AACH,MAAM,yBAAyB,GAAG,CAAC,UAAkB,EAAW,EAAE,CAC9D,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AAEtE,qDAAqD;AACrD,MAAM,8BAA8B,GAAG,CACnC,OAAmC,EACnC,MAA8B,EAC9B,KAAa,EACT,EAAE;IACN,OAAO,CAAC,MAAM,CAAC;QACX,IAAI,EAAE;YACF,KAAK;SACR;QACD,SAAS,EAAE,mBAAmB;QAC9B,IAAI,EAAE,MAAM,CAAC,KAA6B;KAC7C,CAAC,CAAC;AACP,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBACpD,MAAM,eAAe,GAAG,oBAAoB,CACxC,SAAS,EAAE,KAAK,IAAI,IAAI,CAC3B,CAAC;oBAEF,IACI,SAAS,KAAK,IAAI;wBAClB,eAAe,KAAK,IAAI;wBACxB,yBAAyB,CAAC,eAAe,CAAC,EAC5C,CAAC;wBACC,8BAA8B,CAC1B,OAAO,EACP,SAAS,EACT,QAAQ,GAAG,CAAC,EAAE,GAAG,CACpB,CAAC;oBACN,CAAC;oBAED,MAAM,aAAa,GAAG,yBAAyB,CAC3C,GAAG,CAAC,OAAO,EACX,OAAO,CACV,CAAC;oBAEF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;wBACzB,SAAS;oBACb,CAAC;oBAED,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;wBACxC,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;wBAE3C,IAAI,WAAW,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;4BACtC,SAAS;wBACb,CAAC;wBAED,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;wBACrD,MAAM,gBAAgB,GAAG,oBAAoB,CACzC,UAAU,EAAE,KAAK,IAAI,IAAI,CAC5B,CAAC;wBAEF,IACI,UAAU,KAAK,IAAI;4BACnB,gBAAgB,KAAK,IAAI;4BACzB,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,EAC9C,CAAC;4BACC,SAAS;wBACb,CAAC;wBAED,8BAA8B,CAC1B,OAAO,EACP,UAAU,EACV,kBAAkB,GAAG,CAAC,EAAE,GAAG,CAC9B,CAAC;oBACN,CAAC;gBACL,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,oCAAoC;gBACpC,iCAAiC;gBACjC,+BAA+B;aAClC;YACD,WAAW,EACP,8IAA8I;YAClJ,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,yFAAyF;SACjG;QACD,QAAQ,EAAE;YACN,iBAAiB,EACb,4IAA4I;SACnJ;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-self-hosted-runner-on-fork-pr-events.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow self-hosted runners on fork-capable pull request events.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for blocking self-hosted runners on fork PR events. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-self-hosted-runner-on-fork-pr-events.d.ts.map