eslint-plugin-github-actions-2 1.0.0

package/dist/rules/no-unknown-job-output-reference.js

@@ -0,0 +1,229 @@
+import { getMappingPair, getMappingValueAsMapping, getScalarStringValue, getWorkflowJobs, getWorkflowRoot, unwrapYamlValue, } from "../_internal/workflow-yaml.js";
+/**
+ * `needs.<job_id>.outputs.<output_name>` references inside workflow
+ * expressions.
+ */
+const needsOutputReferencePattern = /needs\.(?<neededJobId>[A-Z_a-z][\w-]*)\.outputs\.(?<outputName>[A-Z_a-z][\w-]*)/g;
+/**
+ * `jobs.<job_id>.outputs.<output_name>` references inside reusable workflow
+ * outputs.
+ */
+const jobsOutputReferencePattern = /jobs\.(?<jobId>[A-Z_a-z][\w-]*)\.outputs\.(?<outputName>[A-Z_a-z][\w-]*)/g;
+/** Visit every string scalar reachable from a YAML value node. */
+const visitStringScalars = (node, visitor) => {
+    const unwrappedNode = unwrapYamlValue(node);
+    if (unwrappedNode === null) {
+        return;
+    }
+    if (unwrappedNode.type === "YAMLScalar") {
+        const value = getScalarStringValue(unwrappedNode);
+        if (value !== null) {
+            visitor(unwrappedNode, value);
+        }
+        return;
+    }
+    if (unwrappedNode.type === "YAMLSequence") {
+        for (const entry of unwrappedNode.entries) {
+            visitStringScalars(entry, visitor);
+        }
+        return;
+    }
+    if (unwrappedNode.type !== "YAMLMapping") {
+        return;
+    }
+    for (const pair of unwrappedNode.pairs) {
+        visitStringScalars(pair.value ?? null, visitor);
+    }
+};
+/** Collect declared output names from a job definition. */
+const getDeclaredJobOutputNames = (jobMapping) => {
+    const outputsMapping = getMappingValueAsMapping(jobMapping, "outputs");
+    const outputNames = new Set();
+    if (outputsMapping === null) {
+        return outputNames;
+    }
+    for (const pair of outputsMapping.pairs) {
+        const outputName = getScalarStringValue(pair.key);
+        if (outputName !== null) {
+            outputNames.add(outputName);
+        }
+    }
+    return outputNames;
+};
+/** Collect the direct `needs` dependencies configured for a job. */
+const getDirectNeedsJobIds = (jobMapping) => {
+    const needsPair = getMappingPair(jobMapping, "needs");
+    const needsValue = unwrapYamlValue(needsPair?.value ?? null);
+    const directNeeds = new Set();
+    if (needsValue === null) {
+        return directNeeds;
+    }
+    if (needsValue.type === "YAMLScalar") {
+        const jobId = getScalarStringValue(needsValue);
+        if (jobId !== null) {
+            directNeeds.add(jobId);
+        }
+        return directNeeds;
+    }
+    if (needsValue.type !== "YAMLSequence") {
+        return directNeeds;
+    }
+    for (const entry of needsValue.entries) {
+        const jobId = getScalarStringValue(entry);
+        if (jobId !== null) {
+            directNeeds.add(jobId);
+        }
+    }
+    return directNeeds;
+};
+/** Rule implementation for validating job output references. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const jobs = getWorkflowJobs(root);
+                const declaredOutputsByJobId = new Map(jobs.map((job) => [
+                    job.id,
+                    getDeclaredJobOutputNames(job.mapping),
+                ]));
+                const onMapping = getMappingValueAsMapping(root, "on");
+                const workflowCallMapping = onMapping === null
+                    ? null
+                    : getMappingValueAsMapping(onMapping, "workflow_call");
+                const workflowCallOutputsMapping = workflowCallMapping === null
+                    ? null
+                    : getMappingValueAsMapping(workflowCallMapping, "outputs");
+                if (workflowCallOutputsMapping !== null) {
+                    for (const pair of workflowCallOutputsMapping.pairs) {
+                        const reusableOutputName = getScalarStringValue(pair.key);
+                        const reusableOutputMapping = unwrapYamlValue(pair.value);
+                        if (reusableOutputName === null ||
+                            reusableOutputMapping?.type !== "YAMLMapping") {
+                            continue;
+                        }
+                        const valuePair = getMappingPair(reusableOutputMapping, "value");
+                        visitStringScalars(valuePair?.value ?? null, (node, value) => {
+                            for (const match of value.matchAll(jobsOutputReferencePattern)) {
+                                const reference = match[0];
+                                const jobId = match.groups?.["jobId"];
+                                const outputName = match.groups?.["outputName"];
+                                if (jobId === undefined ||
+                                    outputName === undefined) {
+                                    continue;
+                                }
+                                const declaredOutputNames = declaredOutputsByJobId.get(jobId);
+                                if (declaredOutputNames === undefined) {
+                                    context.report({
+                                        data: {
+                                            jobId,
+                                            reference,
+                                            reusableOutputName,
+                                        },
+                                        messageId: "unknownReusableWorkflowJob",
+                                        node: node,
+                                    });
+                                    continue;
+                                }
+                                if (declaredOutputNames.has(outputName)) {
+                                    continue;
+                                }
+                                context.report({
+                                    data: {
+                                        jobId,
+                                        outputName,
+                                        reference,
+                                        reusableOutputName,
+                                    },
+                                    messageId: "unknownReusableWorkflowJobOutput",
+                                    node: node,
+                                });
+                            }
+                        });
+                    }
+                }
+                for (const job of jobs) {
+                    const directNeedsJobIds = getDirectNeedsJobIds(job.mapping);
+                    visitStringScalars(job.mapping, (node, value) => {
+                        for (const match of value.matchAll(needsOutputReferencePattern)) {
+                            const reference = match[0];
+                            const neededJobId = match.groups?.["neededJobId"];
+                            const outputName = match.groups?.["outputName"];
+                            if (neededJobId === undefined ||
+                                outputName === undefined) {
+                                continue;
+                            }
+                            const declaredOutputNames = declaredOutputsByJobId.get(neededJobId);
+                            if (declaredOutputNames === undefined) {
+                                context.report({
+                                    data: {
+                                        currentJobId: job.id,
+                                        neededJobId,
+                                        reference,
+                                    },
+                                    messageId: "unknownNeedsJob",
+                                    node: node,
+                                });
+                                continue;
+                            }
+                            if (!directNeedsJobIds.has(neededJobId)) {
+                                context.report({
+                                    data: {
+                                        currentJobId: job.id,
+                                        neededJobId,
+                                        reference,
+                                    },
+                                    messageId: "missingNeedsDependency",
+                                    node: node,
+                                });
+                                continue;
+                            }
+                            if (declaredOutputNames.has(outputName)) {
+                                continue;
+                            }
+                            context.report({
+                                data: {
+                                    currentJobId: job.id,
+                                    neededJobId,
+                                    outputName,
+                                    reference,
+                                },
+                                messageId: "unknownNeedsOutput",
+                                node: node,
+                            });
+                        }
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.recommended",
+                "github-actions.configs.strict",
+            ],
+            description: "disallow `needs.*.outputs.*` and reusable-workflow `jobs.*.outputs.*` references that point at undeclared jobs or outputs.",
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R037",
+            ruleNumber: 37,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-unknown-job-output-reference",
+        },
+        messages: {
+            missingNeedsDependency: "Job '{{currentJobId}}' references `{{reference}}`, but job '{{neededJobId}}' is not listed in that job's direct `needs` dependencies.",
+            unknownNeedsJob: "Job '{{currentJobId}}' references `{{reference}}`, but job '{{neededJobId}}' is not declared in this workflow.",
+            unknownNeedsOutput: "Job '{{currentJobId}}' references `{{reference}}`, but job '{{neededJobId}}' does not declare output '{{outputName}}' under `jobs.{{neededJobId}}.outputs`.",
+            unknownReusableWorkflowJob: "Reusable workflow output '{{reusableOutputName}}' references `{{reference}}`, but job '{{jobId}}' is not declared in this workflow.",
+            unknownReusableWorkflowJobOutput: "Reusable workflow output '{{reusableOutputName}}' references `{{reference}}`, but job '{{jobId}}' does not declare output '{{outputName}}' under `jobs.{{jobId}}.outputs`.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-unknown-job-output-reference.js.map

package/dist/rules/no-unknown-job-output-reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unknown-job-output-reference.js","sourceRoot":"","sources":["../../src/rules/no-unknown-job-output-reference.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC;;;GAGG;AACH,MAAM,2BAA2B,GAC7B,kFAAkF,CAAC;AAEvF;;;GAGG;AACH,MAAM,0BAA0B,GAC5B,2EAA2E,CAAC;AAEhF,kEAAkE;AAClE,MAAM,kBAAkB,GAAG,CACvB,IAAyD,EACzD,OAAgE,EAC5D,EAAE;IACN,MAAM,aAAa,GAAG,eAAe,CACjC,IAAiD,CACpD,CAAC;IAEF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO;IACX,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAElD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,OAAO;IACX,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YACxC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,OAAO;IACX,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACvC,OAAO;IACX,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACrC,kBAAkB,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;AACL,CAAC,CAAC;AAEF,2DAA2D;AAC3D,MAAM,yBAAyB,GAAG,CAC9B,UAAqC,EAClB,EAAE;IACrB,MAAM,cAAc,GAAG,wBAAwB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,WAAW,CAAC;IACvB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAElD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACtB,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACvB,CAAC,CAAC;AAEF,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,CACzB,UAAqC,EAClB,EAAE;IACrB,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC;IACvB,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAE/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjB,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,WAAW,CAAC;IACvB,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC;IACvB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAE1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjB,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACvB,CAAC,CAAC;AAEF,gEAAgE;AAChE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;gBACnC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAClC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;oBACd,GAAG,CAAC,EAAE;oBACN,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;iBACzC,CAAC,CACL,CAAC;gBAEF,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvD,MAAM,mBAAmB,GACrB,SAAS,KAAK,IAAI;oBACd,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,wBAAwB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;gBAC/D,MAAM,0BAA0B,GAC5B,mBAAmB,KAAK,IAAI;oBACxB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,wBAAwB,CACpB,mBAAmB,EACnB,SAAS,CACZ,CAAC;gBAEZ,IAAI,0BAA0B,KAAK,IAAI,EAAE,CAAC;oBACtC,KAAK,MAAM,IAAI,IAAI,0BAA0B,CAAC,KAAK,EAAE,CAAC;wBAClD,MAAM,kBAAkB,GAAG,oBAAoB,CAC3C,IAAI,CAAC,GAAG,CACX,CAAC;wBACF,MAAM,qBAAqB,GAAG,eAAe,CACzC,IAAI,CAAC,KAAK,CACb,CAAC;wBAEF,IACI,kBAAkB,KAAK,IAAI;4BAC3B,qBAAqB,EAAE,IAAI,KAAK,aAAa,EAC/C,CAAC;4BACC,SAAS;wBACb,CAAC;wBAED,MAAM,SAAS,GAAG,cAAc,CAC5B,qBAAqB,EACrB,OAAO,CACV,CAAC;wBAEF,kBAAkB,CACd,SAAS,EAAE,KAAK,IAAI,IAAI,EACxB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;4BACZ,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAC9B,0BAA0B,CAC7B,EAAE,CAAC;gCACA,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gCAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;gCACtC,MAAM,UAAU,GACZ,KAAK,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;gCAEjC,IACI,KAAK,KAAK,SAAS;oCACnB,UAAU,KAAK,SAAS,EAC1B,CAAC;oCACC,SAAS;gCACb,CAAC;gCAED,MAAM,mBAAmB,GACrB,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gCAEtC,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;oCACpC,OAAO,CAAC,MAAM,CAAC;wCACX,IAAI,EAAE;4CACF,KAAK;4CACL,SAAS;4CACT,kBAAkB;yCACrB;wCACD,SAAS,EACL,4BAA4B;wCAChC,IAAI,EAAE,IAA4B;qCACrC,CAAC,CAAC;oCAEH,SAAS;gCACb,CAAC;gCAED,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oCACtC,SAAS;gCACb,CAAC;gCAED,OAAO,CAAC,MAAM,CAAC;oCACX,IAAI,EAAE;wCACF,KAAK;wCACL,UAAU;wCACV,SAAS;wCACT,kBAAkB;qCACrB;oCACD,SAAS,EACL,kCAAkC;oCACtC,IAAI,EAAE,IAA4B;iCACrC,CAAC,CAAC;4BACP,CAAC;wBACL,CAAC,CACJ,CAAC;oBACN,CAAC;gBACL,CAAC;gBAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACrB,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAE5D,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;wBAC5C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAC9B,2BAA2B,CAC9B,EAAE,CAAC;4BACA,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;4BAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,CAAC;4BAClD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;4BAEhD,IACI,WAAW,KAAK,SAAS;gCACzB,UAAU,KAAK,SAAS,EAC1B,CAAC;gCACC,SAAS;4BACb,CAAC;4BAED,MAAM,mBAAmB,GACrB,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;4BAE5C,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;gCACpC,OAAO,CAAC,MAAM,CAAC;oCACX,IAAI,EAAE;wCACF,YAAY,EAAE,GAAG,CAAC,EAAE;wCACpB,WAAW;wCACX,SAAS;qCACZ;oCACD,SAAS,EAAE,iBAAiB;oCAC5B,IAAI,EAAE,IAA4B;iCACrC,CAAC,CAAC;gCAEH,SAAS;4BACb,CAAC;4BAED,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gCACtC,OAAO,CAAC,MAAM,CAAC;oCACX,IAAI,EAAE;wCACF,YAAY,EAAE,GAAG,CAAC,EAAE;wCACpB,WAAW;wCACX,SAAS;qCACZ;oCACD,SAAS,EAAE,wBAAwB;oCACnC,IAAI,EAAE,IAA4B;iCACrC,CAAC,CAAC;gCAEH,SAAS;4BACb,CAAC;4BAED,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gCACtC,SAAS;4BACb,CAAC;4BAED,OAAO,CAAC,MAAM,CAAC;gCACX,IAAI,EAAE;oCACF,YAAY,EAAE,GAAG,CAAC,EAAE;oCACpB,WAAW;oCACX,UAAU;oCACV,SAAS;iCACZ;gCACD,SAAS,EAAE,oBAAoB;gCAC/B,IAAI,EAAE,IAA4B;6BACrC,CAAC,CAAC;wBACP,CAAC;oBACL,CAAC,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,oCAAoC;gBACpC,+BAA+B;aAClC;YACD,WAAW,EACP,4HAA4H;YAChI,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,wGAAwG;SAChH;QACD,QAAQ,EAAE;YACN,sBAAsB,EAClB,uIAAuI;YAC3I,eAAe,EACX,gHAAgH;YACpH,kBAAkB,EACd,6JAA6J;YACjK,0BAA0B,EACtB,qIAAqI;YACzI,gCAAgC,EAC5B,4KAA4K;SACnL;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-unknown-step-reference.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow references to undefined or not-yet-available steps.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for validating step context references. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-unknown-step-reference.d.ts.map

package/dist/rules/no-unknown-step-reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unknown-step-reference.d.ts","sourceRoot":"","sources":["../../src/rules/no-unknown-step-reference.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AA0GnC,kEAAkE;AAClE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA0FhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-unknown-step-reference.js

@@ -0,0 +1,133 @@
+import { getMappingPair, getMappingValueAsSequence, getScalarStringValue, getWorkflowJobs, getWorkflowRoot, unwrapYamlValue, } from "../_internal/workflow-yaml.js";
+/** Step context references using property dereference syntax. */
+const stepReferencePattern = /steps\.(?<stepId>[A-Z_a-z][\w-]*)\.(?:outputs\.[A-Z_a-z][\w-]*|conclusion|outcome)/g;
+/**
+ * Visit every string scalar in a job, tracking the current step index when
+ * applicable.
+ */
+const visitJobStringScalars = (node, visitor, currentStepIndex = null) => {
+    const unwrappedNode = unwrapYamlValue(node);
+    if (unwrappedNode === null) {
+        return;
+    }
+    if (unwrappedNode.type === "YAMLScalar") {
+        const value = getScalarStringValue(unwrappedNode);
+        if (value !== null) {
+            visitor(unwrappedNode, value, currentStepIndex);
+        }
+        return;
+    }
+    if (unwrappedNode.type === "YAMLSequence") {
+        for (const entry of unwrappedNode.entries) {
+            visitJobStringScalars(entry, visitor, currentStepIndex);
+        }
+        return;
+    }
+    if (unwrappedNode.type !== "YAMLMapping") {
+        return;
+    }
+    const stepsSequence = getMappingValueAsSequence(unwrappedNode, "steps");
+    if (stepsSequence !== null) {
+        for (const [stepIndex, entry] of stepsSequence.entries.entries()) {
+            visitJobStringScalars(entry, visitor, stepIndex);
+        }
+    }
+    for (const pair of unwrappedNode.pairs) {
+        if (getScalarStringValue(pair.key) === "steps") {
+            continue;
+        }
+        visitJobStringScalars(pair.value ?? null, visitor, currentStepIndex);
+    }
+};
+/** Collect the first declared index for each step id in a job. */
+const getStepIndexById = (jobMapping) => {
+    const stepsSequence = getMappingValueAsSequence(jobMapping, "steps");
+    const stepIndexById = new Map();
+    if (stepsSequence === null) {
+        return stepIndexById;
+    }
+    for (const [stepIndex, entry] of stepsSequence.entries.entries()) {
+        const stepMapping = unwrapYamlValue(entry);
+        if (stepMapping?.type !== "YAMLMapping") {
+            continue;
+        }
+        const stepId = getScalarStringValue(getMappingPair(stepMapping, "id")?.value ?? null);
+        if (stepId !== null && !stepIndexById.has(stepId)) {
+            stepIndexById.set(stepId, stepIndex);
+        }
+    }
+    return stepIndexById;
+};
+/** Rule implementation for validating step context references. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const job of getWorkflowJobs(root)) {
+                    const stepIndexById = getStepIndexById(job.mapping);
+                    visitJobStringScalars(job.mapping, (node, value, currentStepIndex) => {
+                        for (const match of value.matchAll(stepReferencePattern)) {
+                            const reference = match[0];
+                            const stepId = match.groups?.["stepId"];
+                            if (stepId === undefined) {
+                                continue;
+                            }
+                            const referencedStepIndex = stepIndexById.get(stepId);
+                            if (referencedStepIndex === undefined) {
+                                context.report({
+                                    data: {
+                                        jobId: job.id,
+                                        reference,
+                                        stepId,
+                                    },
+                                    messageId: "unknownStepReference",
+                                    node: node,
+                                });
+                                continue;
+                            }
+                            if (currentStepIndex === null ||
+                                referencedStepIndex < currentStepIndex) {
+                                continue;
+                            }
+                            context.report({
+                                data: {
+                                    jobId: job.id,
+                                    reference,
+                                    stepId,
+                                },
+                                messageId: "stepReferenceBeforeAvailability",
+                                node: node,
+                            });
+                        }
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.strict",
+            ],
+            description: "disallow `steps.<id>.*` references that target a missing step id or a step that has not run yet.",
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R038",
+            ruleNumber: 38,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-unknown-step-reference",
+        },
+        messages: {
+            stepReferenceBeforeAvailability: "Job '{{jobId}}' references `{{reference}}` before step '{{stepId}}' has run. The `steps` context only contains prior steps in the same job.",
+            unknownStepReference: "Job '{{jobId}}' references `{{reference}}`, but no step with `id: {{stepId}}` exists in that job.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-unknown-step-reference.js.map

package/dist/rules/no-unknown-step-reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unknown-step-reference.js","sourceRoot":"","sources":["../../src/rules/no-unknown-step-reference.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,iEAAiE;AACjE,MAAM,oBAAoB,GACtB,qFAAqF,CAAC;AAE1F;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAC1B,IAAyD,EACzD,OAIS,EACT,mBAAkC,IAAI,EAClC,EAAE;IACN,MAAM,aAAa,GAAG,eAAe,CACjC,IAAiD,CACpD,CAAC;IAEF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO;IACX,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAElD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAED,OAAO;IACX,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YACxC,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO;IACX,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACvC,OAAO;IACX,CAAC;IAED,MAAM,aAAa,GAAG,yBAAyB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAExE,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;IACL,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACrC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;YAC7C,SAAS;QACb,CAAC;QAED,qBAAqB,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACzE,CAAC;AACL,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,CACrB,UAAqC,EACV,EAAE;IAC7B,MAAM,aAAa,GAAG,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,aAAa,CAAC;IACzB,CAAC;IAED,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/D,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAE3C,IAAI,WAAW,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;YACtC,SAAS;QACb,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAC/B,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CACnD,CAAC;QAEF,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACzC,CAAC;IACL,CAAC;IAED,OAAO,aAAa,CAAC;AACzB,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAEpD,qBAAqB,CACjB,GAAG,CAAC,OAAO,EACX,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE;wBAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAC9B,oBAAoB,CACvB,EAAE,CAAC;4BACA,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;4BAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;4BAExC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gCACvB,SAAS;4BACb,CAAC;4BAED,MAAM,mBAAmB,GACrB,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;4BAE9B,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;gCACpC,OAAO,CAAC,MAAM,CAAC;oCACX,IAAI,EAAE;wCACF,KAAK,EAAE,GAAG,CAAC,EAAE;wCACb,SAAS;wCACT,MAAM;qCACT;oCACD,SAAS,EAAE,sBAAsB;oCACjC,IAAI,EAAE,IAA4B;iCACrC,CAAC,CAAC;gCAEH,SAAS;4BACb,CAAC;4BAED,IACI,gBAAgB,KAAK,IAAI;gCACzB,mBAAmB,GAAG,gBAAgB,EACxC,CAAC;gCACC,SAAS;4BACb,CAAC;4BAED,OAAO,CAAC,MAAM,CAAC;gCACX,IAAI,EAAE;oCACF,KAAK,EAAE,GAAG,CAAC,EAAE;oCACb,SAAS;oCACT,MAAM;iCACT;gCACD,SAAS,EACL,iCAAiC;gCACrC,IAAI,EAAE,IAA4B;6BACrC,CAAC,CAAC;wBACP,CAAC;oBACL,CAAC,CACJ,CAAC;gBACN,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,+BAA+B;aAClC;YACD,WAAW,EACP,kGAAkG;YACtG,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,kGAAkG;SAC1G;QACD,QAAQ,EAAE;YACN,+BAA+B,EAC3B,6IAA6I;YACjJ,oBAAoB,EAChB,mGAAmG;SAC1G;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-untrusted-input-in-run.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow directly interpolating untrusted event inputs inside `run` steps.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for disallowing unsafe direct interpolation in `run`. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-untrusted-input-in-run.d.ts.map

package/dist/rules/no-untrusted-input-in-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-untrusted-input-in-run.d.ts","sourceRoot":"","sources":["../../src/rules/no-untrusted-input-in-run.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AA+DnC,gFAAgF;AAChF,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA8EhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-untrusted-input-in-run.js

@@ -0,0 +1,115 @@
+import { getMappingPair, getMappingValueAsSequence, getScalarStringValue, getWorkflowJobs, getWorkflowRoot, unwrapYamlValue, } from "../_internal/workflow-yaml.js";
+/**
+ * Untrusted workflow-expression sources that should not be embedded directly in
+ * `run`.
+ */
+const untrustedRunExpressionSources = [
+    {
+        fragments: [
+            "github.event.pull_request.body",
+            "github.event.pull_request.title",
+        ],
+        source: "pull request title/body",
+    },
+    {
+        fragments: ["github.event.issue.body", "github.event.issue.title"],
+        source: "issue title/body",
+    },
+    {
+        fragments: ["github.event.comment.body"],
+        source: "comment body",
+    },
+    {
+        fragments: ["github.event.review.body"],
+        source: "review body",
+    },
+    {
+        fragments: [
+            "github.event.discussion.body",
+            "github.event.discussion.title",
+        ],
+        source: "discussion title/body",
+    },
+    {
+        fragments: ["github.event.discussion_comment.body"],
+        source: "discussion comment body",
+    },
+    {
+        fragments: ["github.event.client_payload."],
+        source: "repository_dispatch client payload",
+    },
+];
+/** Resolve the first matching untrusted expression source inside a run script. */
+const getUnsafeRunSource = (runScript) => {
+    for (const source of untrustedRunExpressionSources) {
+        if (source.fragments.some((fragment) => runScript.includes(fragment))) {
+            return source.source;
+        }
+    }
+    return null;
+};
+/** Rule implementation for disallowing unsafe direct interpolation in `run`. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const job of getWorkflowJobs(root)) {
+                    const stepsSequence = getMappingValueAsSequence(job.mapping, "steps");
+                    if (stepsSequence === null) {
+                        continue;
+                    }
+                    for (const entry of stepsSequence.entries) {
+                        const stepMapping = unwrapYamlValue(entry);
+                        if (stepMapping?.type !== "YAMLMapping") {
+                            continue;
+                        }
+                        const runPair = getMappingPair(stepMapping, "run");
+                        const runScript = getScalarStringValue(runPair?.value ?? null);
+                        if (runPair === null || runScript === null) {
+                            continue;
+                        }
+                        const unsafeSource = getUnsafeRunSource(runScript);
+                        if (unsafeSource === null) {
+                            continue;
+                        }
+                        context.report({
+                            data: {
+                                jobId: job.id,
+                                source: unsafeSource,
+                            },
+                            messageId: "unsafeRunInterpolation",
+                            node: (runPair.value ??
+                                runPair),
+                        });
+                    }
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.security",
+                "github-actions.configs.strict",
+            ],
+            description: "disallow directly embedding untrusted event payload values inside `run` scripts; move them through `env` first or pass them to an action input.",
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R029",
+            ruleNumber: 29,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-untrusted-input-in-run",
+        },
+        messages: {
+            unsafeRunInterpolation: "Job '{{jobId}}' interpolates untrusted {{source}} directly inside `run`. Assign the value to `env` first or pass it to an action input.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-untrusted-input-in-run.js.map

package/dist/rules/no-untrusted-input-in-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-untrusted-input-in-run.js","sourceRoot":"","sources":["../../src/rules/no-untrusted-input-in-run.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC;;;GAGG;AACH,MAAM,6BAA6B,GAAG;IAClC;QACI,SAAS,EAAE;YACP,gCAAgC;YAChC,iCAAiC;SACpC;QACD,MAAM,EAAE,yBAAyB;KACpC;IACD;QACI,SAAS,EAAE,CAAC,yBAAyB,EAAE,0BAA0B,CAAC;QAClE,MAAM,EAAE,kBAAkB;KAC7B;IACD;QACI,SAAS,EAAE,CAAC,2BAA2B,CAAC;QACxC,MAAM,EAAE,cAAc;KACzB;IACD;QACI,SAAS,EAAE,CAAC,0BAA0B,CAAC;QACvC,MAAM,EAAE,aAAa;KACxB;IACD;QACI,SAAS,EAAE;YACP,8BAA8B;YAC9B,+BAA+B;SAClC;QACD,MAAM,EAAE,uBAAuB;KAClC;IACD;QACI,SAAS,EAAE,CAAC,sCAAsC,CAAC;QACnD,MAAM,EAAE,yBAAyB;KACpC;IACD;QACI,SAAS,EAAE,CAAC,8BAA8B,CAAC;QAC3C,MAAM,EAAE,oCAAoC;KAC/C;CACK,CAAC;AAEX,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAiB,EAAE;IAC5D,KAAK,MAAM,MAAM,IAAI,6BAA6B,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,MAAM,aAAa,GAAG,yBAAyB,CAC3C,GAAG,CAAC,OAAO,EACX,OAAO,CACV,CAAC;oBAEF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;wBACzB,SAAS;oBACb,CAAC;oBAED,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;wBACxC,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;wBAE3C,IAAI,WAAW,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;4BACtC,SAAS;wBACb,CAAC;wBAED,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;wBACnD,MAAM,SAAS,GAAG,oBAAoB,CAClC,OAAO,EAAE,KAAK,IAAI,IAAI,CACzB,CAAC;wBAEF,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;4BACzC,SAAS;wBACb,CAAC;wBAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;wBAEnD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;4BACxB,SAAS;wBACb,CAAC;wBAED,OAAO,CAAC,MAAM,CAAC;4BACX,IAAI,EAAE;gCACF,KAAK,EAAE,GAAG,CAAC,EAAE;gCACb,MAAM,EAAE,YAAY;6BACvB;4BACD,SAAS,EAAE,wBAAwB;4BACnC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK;gCAChB,OAAO,CAAyB;yBACvC,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,iCAAiC;gBACjC,+BAA+B;aAClC;YACD,WAAW,EACP,iJAAiJ;YACrJ,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,kGAAkG;SAC1G;QACD,QAAQ,EAAE;YACN,sBAAsB,EAClB,yIAAyI;SAChJ;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-unused-input-in-composite.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow declared inputs that are never used in a composite action.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for unused composite input checks. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-unused-input-in-composite.d.ts.map

package/dist/rules/no-unused-input-in-composite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unused-input-in-composite.d.ts","sourceRoot":"","sources":["../../src/rules/no-unused-input-in-composite.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAcnC,6DAA6D;AAC7D,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAyFhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-unused-input-in-composite.js

@@ -0,0 +1,78 @@
+import { isActionMetadataFile } from "../_internal/lint-targets.js";
+import { getMappingPair, getMappingValueAsMapping, getScalarStringValue, getWorkflowRoot, } from "../_internal/workflow-yaml.js";
+import { collectYamlStringScalars } from "../_internal/yaml-traversal.js";
+/** Matches `inputs.<id>` references in composite-step string values. */
+const INPUT_REFERENCE_PATTERN = /inputs\.(?<inputId>[\w-]+)/gu;
+/** Rule implementation for unused composite input checks. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                if (!isActionMetadataFile(context.filename)) {
+                    return;
+                }
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const runsMapping = getMappingValueAsMapping(root, "runs");
+                const inputsMapping = getMappingValueAsMapping(root, "inputs");
+                if (runsMapping === null || inputsMapping === null) {
+                    return;
+                }
+                const usingRuntime = getScalarStringValue(getMappingPair(runsMapping, "using")?.value);
+                if (usingRuntime !== "composite") {
+                    return;
+                }
+                const allScalarValues = collectYamlStringScalars(runsMapping);
+                const referencedInputIds = new Set();
+                for (const scalarValue of allScalarValues) {
+                    for (const match of scalarValue.matchAll(INPUT_REFERENCE_PATTERN)) {
+                        const matchedInputId = match.groups?.["inputId"];
+                        if (matchedInputId === undefined) {
+                            continue;
+                        }
+                        referencedInputIds.add(matchedInputId);
+                    }
+                }
+                for (const inputPair of inputsMapping.pairs) {
+                    const inputId = getScalarStringValue(inputPair.key);
+                    if (inputId === null) {
+                        continue;
+                    }
+                    if (referencedInputIds.has(inputId)) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            inputId,
+                        },
+                        messageId: "unusedCompositeInput",
+                        node: inputPair.key,
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        docs: {
+            configs: [
+                "github-actions.configs.actionMetadata",
+                "github-actions.configs.all",
+            ],
+            description: "disallow declared composite-action inputs that are never referenced.",
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R053",
+            ruleNumber: 53,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-unused-input-in-composite",
+        },
+        messages: {
+            unusedCompositeInput: "Composite action input '{{inputId}}' is declared but never referenced via `inputs.{{inputId}}`.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=no-unused-input-in-composite.js.map

package/dist/rules/no-unused-input-in-composite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unused-input-in-composite.js","sourceRoot":"","sources":["../../src/rules/no-unused-input-in-composite.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,wEAAwE;AACxE,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,6DAA6D;AAC7D,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC3D,MAAM,aAAa,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAE/D,IAAI,WAAW,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;oBACjD,OAAO;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,oBAAoB,CACrC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,KAAK,CAC9C,CAAC;gBAEF,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;oBAC/B,OAAO;gBACX,CAAC;gBAED,MAAM,eAAe,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;gBAC9D,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;gBAE7C,KAAK,MAAM,WAAW,IAAI,eAAe,EAAE,CAAC;oBACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,QAAQ,CACpC,uBAAuB,CAC1B,EAAE,CAAC;wBACA,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;wBAEjD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;4BAC/B,SAAS;wBACb,CAAC;wBAED,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;oBAC3C,CAAC;gBACL,CAAC;gBAED,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;oBAC1C,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAEpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;wBACnB,SAAS;oBACb,CAAC;oBAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;wBAClC,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,OAAO;yBACV;wBACD,SAAS,EAAE,sBAAsB;wBACjC,IAAI,EAAE,SAAS,CAAC,GAA2B;qBAC9C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,uCAAuC;gBACvC,4BAA4B;aAC/B;YACD,WAAW,EACP,sEAAsE;YAC1E,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,qGAAqG;SAC7G;QACD,QAAQ,EAAE;YACN,oBAAoB,EAChB,iGAAiG;SACxG;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-write-all-permissions.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Disallow broad `write-all` GitHub token permissions.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for disallowing `permissions: write-all`. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-write-all-permissions.d.ts.map

package/dist/rules/no-write-all-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-write-all-permissions.d.ts","sourceRoot":"","sources":["../../src/rules/no-write-all-permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAiBnC,oEAAoE;AACpE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAgFhB,CAAC;AAEF,eAAe,IAAI,CAAC"}