eslint-plugin-github-actions-2 1.0.0

package/dist/rules/no-self-hosted-runner-on-fork-pr-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-self-hosted-runner-on-fork-pr-events.d.ts","sourceRoot":"","sources":["../../src/rules/no-self-hosted-runner-on-fork-pr-events.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAiEnC,8EAA8E;AAC9E,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAmEhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-self-hosted-runner-on-fork-pr-events.js

@@ -0,0 +1,93 @@
+import { getMappingPair, getScalarStringValue, getWorkflowEventNames, getWorkflowJobs, getWorkflowRoot, unwrapYamlValue, } from "../_internal/workflow-yaml.js";
+/** Pull-request-adjacent events that can be invoked from forked PR activity. */
+const forkPullRequestEventNames = [
+    "issue_comment",
+    "pull_request",
+    "pull_request_review",
+    "pull_request_review_comment",
+    "pull_request_target",
+];
+/** Fast lookup set for fork-capable pull request events. */
+const forkPullRequestEventNameSet = new Set(forkPullRequestEventNames);
+/** Determine whether a scalar string denotes the self-hosted runner label. */
+const isSelfHostedRunnerLabel = (value) => value.trim().toLowerCase() === "self-hosted";
+/** Determine whether a runs-on node selects a self-hosted runner. */
+const hasSelfHostedRunner = (node) => {
+    const unwrappedNode = unwrapYamlValue(node);
+    if (unwrappedNode === null) {
+        return false;
+    }
+    if (unwrappedNode.type === "YAMLScalar") {
+        const value = getScalarStringValue(unwrappedNode);
+        return value !== null && isSelfHostedRunnerLabel(value);
+    }
+    if (unwrappedNode.type === "YAMLSequence") {
+        return unwrappedNode.entries.some((entry) => {
+            const value = getScalarStringValue(entry);
+            return value !== null && isSelfHostedRunnerLabel(value);
+        });
+    }
+    if (unwrappedNode.type !== "YAMLMapping") {
+        return false;
+    }
+    return hasSelfHostedRunner(getMappingPair(unwrappedNode, "labels")?.value ?? null);
+};
+/** Rule implementation for blocking self-hosted runners on fork PR events. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const triggeringForkPullRequestEvents = [
+                    ...getWorkflowEventNames(root),
+                ]
+                    .filter((eventName) => forkPullRequestEventNameSet.has(eventName))
+                    .toSorted((left, right) => left.localeCompare(right));
+                if (triggeringForkPullRequestEvents.length === 0) {
+                    return;
+                }
+                for (const job of getWorkflowJobs(root)) {
+                    const runsOnPair = getMappingPair(job.mapping, "runs-on");
+                    if (runsOnPair === null ||
+                        !hasSelfHostedRunner(runsOnPair.value ?? null)) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            events: triggeringForkPullRequestEvents.join(", "),
+                            jobId: job.id,
+                        },
+                        messageId: "selfHostedRunnerOnForkPullRequestEvent",
+                        node: (runsOnPair.value ??
+                            runsOnPair),
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.security",
+                "github-actions.configs.strict",
+            ],
+            description: "disallow self-hosted runners in workflows triggered by fork-capable pull-request events that can execute untrusted contributor activity.",
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R036",
+            ruleNumber: 36,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-self-hosted-runner-on-fork-pr-events",
+        },
+        messages: {
+            selfHostedRunnerOnForkPullRequestEvent: "Job '{{jobId}}' uses a self-hosted runner in a workflow triggered by {{events}}, which can be invoked from forked or Dependabot pull requests. Prefer GitHub-hosted runners, or isolate the workload behind hardened ephemeral self-hosted infrastructure.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-self-hosted-runner-on-fork-pr-events.js.map

package/dist/rules/no-self-hosted-runner-on-fork-pr-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-self-hosted-runner-on-fork-pr-events.js","sourceRoot":"","sources":["../../src/rules/no-self-hosted-runner-on-fork-pr-events.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,gFAAgF;AAChF,MAAM,yBAAyB,GAAG;IAC9B,eAAe;IACf,cAAc;IACd,qBAAqB;IACrB,6BAA6B;IAC7B,qBAAqB;CACf,CAAC;AAEX,4DAA4D;AAC5D,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAC5D,yBAAyB,CAC5B,CAAC;AAEF,8EAA8E;AAC9E,MAAM,uBAAuB,GAAG,CAAC,KAAa,EAAW,EAAE,CACvD,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC;AAEjD,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,CACxB,IAAyD,EAClD,EAAE;IACT,MAAM,aAAa,GAAG,eAAe,CACjC,IAAiD,CACpD,CAAC;IAEF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAElD,OAAO,KAAK,KAAK,IAAI,IAAI,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACxC,OAAO,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE1C,OAAO,KAAK,KAAK,IAAI,IAAI,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,OAAO,mBAAmB,CACtB,cAAc,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,CACzD,CAAC;AACN,CAAC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,+BAA+B,GAAG;oBACpC,GAAG,qBAAqB,CAAC,IAAI,CAAC;iBACjC;qBACI,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAClB,2BAA2B,CAAC,GAAG,CAAC,SAAS,CAAC,CAC7C;qBACA,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;gBAE1D,IAAI,+BAA+B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/C,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;oBAE1D,IACI,UAAU,KAAK,IAAI;wBACnB,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,EAChD,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,MAAM,EAAE,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;4BAClD,KAAK,EAAE,GAAG,CAAC,EAAE;yBAChB;wBACD,SAAS,EAAE,wCAAwC;wBACnD,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK;4BACnB,UAAU,CAAyB;qBAC1C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,iCAAiC;gBACjC,+BAA+B;aAClC;YACD,WAAW,EACP,0IAA0I;YAC9I,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,gHAAgH;SACxH;QACD,QAAQ,EAAE;YACN,sCAAsC,EAClC,4PAA4P;SACnQ;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-subdirectory-template-file-pattern.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow workflow-template file patterns that target subdirectory paths.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for root-directory-oriented template file pattern checks. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-subdirectory-template-file-pattern.d.ts.map

package/dist/rules/no-subdirectory-template-file-pattern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-subdirectory-template-file-pattern.d.ts","sourceRoot":"","sources":["../../src/rules/no-subdirectory-template-file-pattern.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAQnC,oFAAoF;AACpF,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAuDhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-subdirectory-template-file-pattern.js

@@ -0,0 +1,52 @@
+import { isWorkflowTemplatePropertiesFile } from "../_internal/lint-targets.js";
+import { getWorkflowTemplateFilePatternEntries, getWorkflowTemplatePropertiesRoot, } from "../_internal/workflow-template-properties.js";
+/** Rule implementation for root-directory-oriented template file pattern checks. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                if (!isWorkflowTemplatePropertiesFile(context.filename)) {
+                    return;
+                }
+                const root = getWorkflowTemplatePropertiesRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const { node, value, } of getWorkflowTemplateFilePatternEntries(root)) {
+                    if (!value.includes("/") && !value.includes("\\")) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            pattern: value,
+                        },
+                        messageId: "subdirectoryTemplateFilePattern",
+                        node: node,
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.workflowTemplateProperties",
+                "github-actions.configs.workflowTemplates",
+                "github-actions.configs.all",
+            ],
+            description: "disallow workflow-template `filePatterns` that match subdirectory paths instead of repository-root files.",
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R062",
+            ruleNumber: 62,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-subdirectory-template-file-pattern",
+        },
+        messages: {
+            subdirectoryTemplateFilePattern: "Template file pattern '{{pattern}}' targets subdirectory paths; workflow-template file patterns should match repository-root files.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-subdirectory-template-file-pattern.js.map

package/dist/rules/no-subdirectory-template-file-pattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-subdirectory-template-file-pattern.js","sourceRoot":"","sources":["../../src/rules/no-subdirectory-template-file-pattern.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EACH,qCAAqC,EACrC,iCAAiC,GACpC,MAAM,8CAA8C,CAAC;AAEtD,oFAAoF;AACpF,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtD,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;gBAExD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,EACP,IAAI,EACJ,KAAK,GACR,IAAI,qCAAqC,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChD,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,OAAO,EAAE,KAAK;yBACjB;wBACD,SAAS,EAAE,iCAAiC;wBAC5C,IAAI,EAAE,IAA4B;qBACrC,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,mDAAmD;gBACnD,0CAA0C;gBAC1C,4BAA4B;aAC/B;YACD,WAAW,EACP,2GAA2G;YAC/G,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,8GAA8G;SACtH;QACD,QAAQ,EAAE;YACN,+BAA+B,EAC3B,qIAAqI;SAC5I;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-template-placeholder-in-non-template-workflow.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow `$default-branch` placeholder usage outside workflow template files.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for invalid placeholder usage outside templates. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-template-placeholder-in-non-template-workflow.d.ts.map

package/dist/rules/no-template-placeholder-in-non-template-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-template-placeholder-in-non-template-workflow.d.ts","sourceRoot":"","sources":["../../src/rules/no-template-placeholder-in-non-template-workflow.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAYnC,2EAA2E;AAC3E,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAqDhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-template-placeholder-in-non-template-workflow.js

@@ -0,0 +1,55 @@
+import { isWorkflowTemplatePropertiesFile, isWorkflowTemplateYamlFile, } from "../_internal/lint-targets.js";
+import { getWorkflowRoot } from "../_internal/workflow-yaml.js";
+import { visitYamlStringScalars } from "../_internal/yaml-traversal.js";
+/** Placeholder token supported in template files. */
+const defaultBranchPlaceholder = "$default-branch";
+/** Rule implementation for invalid placeholder usage outside templates. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                if (isWorkflowTemplateYamlFile(context.filename)) {
+                    return;
+                }
+                if (isWorkflowTemplatePropertiesFile(context.filename)) {
+                    return;
+                }
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                visitYamlStringScalars(root, (node, value) => {
+                    if (!value.includes(defaultBranchPlaceholder)) {
+                        return;
+                    }
+                    context.report({
+                        messageId: "templatePlaceholderOutsideTemplate",
+                        node: node,
+                    });
+                });
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.recommended",
+                "github-actions.configs.strict",
+                "github-actions.configs.all",
+            ],
+            description: "disallow `$default-branch` placeholder usage outside workflow template YAML files.",
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R069",
+            ruleNumber: 69,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-template-placeholder-in-non-template-workflow",
+        },
+        messages: {
+            templatePlaceholderOutsideTemplate: "`$default-branch` is intended for workflow template files and should not be used in regular workflow YAML files.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-template-placeholder-in-non-template-workflow.js.map

package/dist/rules/no-template-placeholder-in-non-template-workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-template-placeholder-in-non-template-workflow.js","sourceRoot":"","sources":["../../src/rules/no-template-placeholder-in-non-template-workflow.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,gCAAgC,EAChC,0BAA0B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,qDAAqD;AACrD,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAEnD,2EAA2E;AAC3E,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,IAAI,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/C,OAAO;gBACX,CAAC;gBAED,IAAI,gCAAgC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACrD,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,sBAAsB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;wBAC5C,OAAO;oBACX,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,SAAS,EAAE,oCAAoC;wBAC/C,IAAI,EAAE,IAA4B;qBACrC,CAAC,CAAC;gBACP,CAAC,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,oCAAoC;gBACpC,+BAA+B;gBAC/B,4BAA4B;aAC/B;YACD,WAAW,EACP,oFAAoF;YACxF,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,yHAAyH;SACjI;QACD,QAAQ,EAAE;YACN,kCAAkC,EAC9B,kHAAkH;SACzH;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-top-level-env.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow workflow-wide environment variables under the top-level `env` key.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for disallowing top-level workflow env. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-top-level-env.d.ts.map

package/dist/rules/no-top-level-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-top-level-env.d.ts","sourceRoot":"","sources":["../../src/rules/no-top-level-env.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAInC,kEAAkE;AAClE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA0ChB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-top-level-env.js

@@ -0,0 +1,42 @@
+import { getMappingPair, getWorkflowRoot } from "../_internal/workflow-yaml.js";
+/** Rule implementation for disallowing top-level workflow env. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const envPair = getMappingPair(root, "env");
+                if (envPair !== null) {
+                    context.report({
+                        messageId: "topLevelEnv",
+                        node: envPair.key,
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.strict",
+            ],
+            description: "disallow top-level workflow `env` when you want environment variables scoped closer to the jobs and steps that use them.",
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R013",
+            ruleNumber: 13,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-top-level-env",
+        },
+        messages: {
+            topLevelEnv: "Avoid top-level workflow `env`; prefer job-level or step-level `env` declarations instead.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-top-level-env.js.map

package/dist/rules/no-top-level-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-top-level-env.js","sourceRoot":"","sources":["../../src/rules/no-top-level-env.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhF,kEAAkE;AAClE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAE5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACnB,OAAO,CAAC,MAAM,CAAC;wBACX,SAAS,EAAE,aAAa;wBACxB,IAAI,EAAE,OAAO,CAAC,GAA2B;qBAC5C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,+BAA+B;aAClC;YACD,WAAW,EACP,0HAA0H;YAC9H,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,yFAAyF;SACjG;QACD,QAAQ,EAAE;YACN,WAAW,EACP,4FAA4F;SACnG;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-top-level-permissions.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow declaring workflow permissions at the top level.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for disallowing top-level workflow permissions. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-top-level-permissions.d.ts.map

package/dist/rules/no-top-level-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-top-level-permissions.d.ts","sourceRoot":"","sources":["../../src/rules/no-top-level-permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAInC,0EAA0E;AAC1E,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAuChB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-top-level-permissions.js

@@ -0,0 +1,39 @@
+import { getMappingPair, getWorkflowRoot } from "../_internal/workflow-yaml.js";
+/** Rule implementation for disallowing top-level workflow permissions. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const permissionsPair = getMappingPair(root, "permissions");
+                if (permissionsPair !== null) {
+                    context.report({
+                        messageId: "topLevelPermissions",
+                        node: permissionsPair.key,
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: ["github-actions.configs.all"],
+            description: "disallow top-level workflow `permissions` when you want every job to declare its own token scope explicitly.",
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R014",
+            ruleNumber: 14,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-top-level-permissions",
+        },
+        messages: {
+            topLevelPermissions: "Avoid top-level workflow `permissions`; declare `permissions` on each job instead.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-top-level-permissions.js.map

package/dist/rules/no-top-level-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-top-level-permissions.js","sourceRoot":"","sources":["../../src/rules/no-top-level-permissions.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhF,0EAA0E;AAC1E,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBAE5D,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;oBAC3B,OAAO,CAAC,MAAM,CAAC;wBACX,SAAS,EAAE,qBAAqB;wBAChC,IAAI,EAAE,eAAe,CAAC,GAA2B;qBACpD,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE,CAAC,4BAA4B,CAAC;YACvC,WAAW,EACP,8GAA8G;YAClH,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,iGAAiG;SACzG;QACD,QAAQ,EAAE;YACN,mBAAmB,EACf,oFAAoF;SAC3F;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-universal-template-file-pattern.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow universal catch-all regexes in template `filePatterns`.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for universal template file pattern checks. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-universal-template-file-pattern.d.ts.map

package/dist/rules/no-universal-template-file-pattern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-universal-template-file-pattern.d.ts","sourceRoot":"","sources":["../../src/rules/no-universal-template-file-pattern.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAgBnC,sEAAsE;AACtE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAyDhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-universal-template-file-pattern.js

@@ -0,0 +1,60 @@
+import { isWorkflowTemplatePropertiesFile } from "../_internal/lint-targets.js";
+import { getWorkflowTemplateFilePatternEntries, getWorkflowTemplatePropertiesRoot, } from "../_internal/workflow-template-properties.js";
+/** Normalized regex strings treated as universal catch-all template patterns. */
+const universalTemplateFilePatterns = new Set([
+    ".*",
+    ".+",
+    "^.*$",
+    "^.+$",
+]);
+/** Rule implementation for universal template file pattern checks. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                if (!isWorkflowTemplatePropertiesFile(context.filename)) {
+                    return;
+                }
+                const root = getWorkflowTemplatePropertiesRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const { node, value, } of getWorkflowTemplateFilePatternEntries(root)) {
+                    const normalizedPattern = value.trim();
+                    if (!universalTemplateFilePatterns.has(normalizedPattern)) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            pattern: value,
+                        },
+                        messageId: "universalTemplateFilePattern",
+                        node: node,
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.workflowTemplateProperties",
+                "github-actions.configs.workflowTemplates",
+                "github-actions.configs.all",
+            ],
+            description: "disallow universal catch-all regexes in workflow-template `filePatterns`.",
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R061",
+            ruleNumber: 61,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-universal-template-file-pattern",
+        },
+        messages: {
+            universalTemplateFilePattern: "Template file pattern '{{pattern}}' is too broad and matches nearly every repository.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-universal-template-file-pattern.js.map

package/dist/rules/no-universal-template-file-pattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-universal-template-file-pattern.js","sourceRoot":"","sources":["../../src/rules/no-universal-template-file-pattern.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EACH,qCAAqC,EACrC,iCAAiC,GACpC,MAAM,8CAA8C,CAAC;AAEtD,iFAAiF;AACjF,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC1C,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,MAAM;CACT,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtD,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;gBAExD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,EACP,IAAI,EACJ,KAAK,GACR,IAAI,qCAAqC,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;oBAEvC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;wBACxD,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,OAAO,EAAE,KAAK;yBACjB;wBACD,SAAS,EAAE,8BAA8B;wBACzC,IAAI,EAAE,IAA4B;qBACrC,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,mDAAmD;gBACnD,0CAA0C;gBAC1C,4BAA4B;aAC/B;YACD,WAAW,EACP,2EAA2E;YAC/E,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,2GAA2G;SACnH;QACD,QAAQ,EAAE;YACN,4BAA4B,EACxB,uFAAuF;SAC9F;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-unknown-input-reference-in-composite.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow references to undeclared inputs in composite action metadata.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for unknown composite input references. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-unknown-input-reference-in-composite.d.ts.map

package/dist/rules/no-unknown-input-reference-in-composite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unknown-input-reference-in-composite.d.ts","sourceRoot":"","sources":["../../src/rules/no-unknown-input-reference-in-composite.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAgBnC,kEAAkE;AAClE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAyFhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-unknown-input-reference-in-composite.js

@@ -0,0 +1,80 @@
+import { isActionMetadataFile } from "../_internal/lint-targets.js";
+import { getMappingValueAsMapping, getScalarStringValue, getWorkflowRoot, } from "../_internal/workflow-yaml.js";
+import { visitYamlStringScalars } from "../_internal/yaml-traversal.js";
+/**
+ * Pattern for extracting `inputs.<input_id>` references from expression-like
+ * strings.
+ */
+const inputReferencePattern = /inputs\.(?<inputId>[^\s.\]}]+)/g;
+/** Rule implementation for unknown composite input references. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                if (!isActionMetadataFile(context.filename)) {
+                    return;
+                }
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const runsMapping = getMappingValueAsMapping(root, "runs");
+                if (runsMapping === null) {
+                    return;
+                }
+                const usingRuntime = getScalarStringValue(runsMapping.pairs.find((pair) => pair !== null &&
+                    getScalarStringValue(pair.key) === "using")?.value);
+                if (usingRuntime !== "composite") {
+                    return;
+                }
+                const inputsMapping = getMappingValueAsMapping(root, "inputs");
+                const declaredInputIds = new Set();
+                if (inputsMapping !== null) {
+                    for (const pair of inputsMapping.pairs) {
+                        const inputId = getScalarStringValue(pair.key);
+                        if (inputId !== null) {
+                            declaredInputIds.add(inputId);
+                        }
+                    }
+                }
+                visitYamlStringScalars(runsMapping, (node, value) => {
+                    for (const match of value.matchAll(inputReferencePattern)) {
+                        const inputId = match.groups?.["inputId"];
+                        if (inputId === undefined ||
+                            declaredInputIds.has(inputId)) {
+                            continue;
+                        }
+                        context.report({
+                            data: {
+                                inputId,
+                            },
+                            messageId: "unknownInputReference",
+                            node: node,
+                        });
+                    }
+                });
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.actionMetadata",
+                "github-actions.configs.all",
+            ],
+            description: "disallow `inputs.<id>` references in composite action metadata when the input id is not declared.",
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R050",
+            ruleNumber: 50,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-unknown-input-reference-in-composite",
+        },
+        messages: {
+            unknownInputReference: "Composite action references `inputs.{{inputId}}`, but that input is not declared in `inputs`.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-unknown-input-reference-in-composite.js.map

package/dist/rules/no-unknown-input-reference-in-composite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unknown-input-reference-in-composite.js","sourceRoot":"","sources":["../../src/rules/no-unknown-input-reference-in-composite.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACH,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;;GAGG;AACH,MAAM,qBAAqB,GAAG,iCAAiC,CAAC;AAEhE,kEAAkE;AAClE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAE3D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;oBACvB,OAAO;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,oBAAoB,CACrC,WAAW,CAAC,KAAK,CAAC,IAAI,CAClB,CAAC,IAAI,EAAE,EAAE,CACL,IAAI,KAAK,IAAI;oBACb,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CACjD,EAAE,KAAK,CACX,CAAC;gBAEF,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;oBAC/B,OAAO;gBACX,CAAC;gBAED,MAAM,aAAa,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;gBAE3C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;oBACzB,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;wBACrC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAE/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;4BACnB,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBAClC,CAAC;oBACL,CAAC;gBACL,CAAC;gBAED,sBAAsB,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBAChD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;wBACxD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;wBAE1C,IACI,OAAO,KAAK,SAAS;4BACrB,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAC/B,CAAC;4BACC,SAAS;wBACb,CAAC;wBAED,OAAO,CAAC,MAAM,CAAC;4BACX,IAAI,EAAE;gCACF,OAAO;6BACV;4BACD,SAAS,EAAE,uBAAuB;4BAClC,IAAI,EAAE,IAA4B;yBACrC,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,uCAAuC;gBACvC,4BAA4B;aAC/B;YACD,WAAW,EACP,mGAAmG;YACvG,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,gHAAgH;SACxH;QACD,QAAQ,EAAE;YACN,qBAAqB,EACjB,+FAA+F;SACtG;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-unknown-job-output-reference.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow references to undeclared job outputs.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for validating job output references. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-unknown-job-output-reference.d.ts.map

package/dist/rules/no-unknown-job-output-reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unknown-job-output-reference.d.ts","sourceRoot":"","sources":["../../src/rules/no-unknown-job-output-reference.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AA6HnC,gEAAgE;AAChE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAgNhB,CAAC;AAEF,eAAe,IAAI,CAAC"}