eslint-plugin-github-actions-2 1.0.1 → 1.0.3

package/dist/rules/require-dependabot-schedule-interval.js

@@ -0,0 +1,73 @@
+import { getDependabotRoot, getDependabotUpdateEntries, getDependabotUpdateLabel, getEffectiveDependabotUpdateMapping, } from "../_internal/dependabot-yaml.js";
+import { getMappingPair, getScalarStringValue, } from "../_internal/workflow-yaml.js";
+/** Valid schedule interval values documented by GitHub. */
+const validDependabotIntervals = new Set([
+    "cron",
+    "daily",
+    "monthly",
+    "quarterly",
+    "semiannually",
+    "weekly",
+    "yearly",
+]);
+/** Rule implementation for requiring effective `schedule.interval`. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getDependabotRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const update of getDependabotUpdateEntries(root)) {
+                    const scheduleMapping = getEffectiveDependabotUpdateMapping(root, update, "schedule");
+                    const intervalPair = scheduleMapping === null
+                        ? null
+                        : getMappingPair(scheduleMapping, "interval");
+                    const intervalValue = getScalarStringValue(intervalPair?.value)?.trim();
+                    if (intervalValue !== undefined &&
+                        intervalValue !== null &&
+                        validDependabotIntervals.has(intervalValue)) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            updateLabel: getDependabotUpdateLabel(update),
+                        },
+                        messageId: intervalPair === null
+                            ? "missingScheduleInterval"
+                            : "invalidScheduleInterval",
+                        node: (intervalPair?.value ??
+                            intervalPair ??
+                            update.node),
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.dependabot",
+            ],
+            description: "require every Dependabot update entry to define a valid effective `schedule.interval`.",
+            dialects: ["Dependabot configuration"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R074",
+            ruleNumber: 74,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-dependabot-schedule-interval",
+        },
+        messages: {
+            invalidScheduleInterval: "{{updateLabel}} must use a supported `schedule.interval` value such as `daily`, `weekly`, `monthly`, or `cron`.",
+            missingScheduleInterval: "{{updateLabel}} must define an effective `schedule.interval` (directly or via its `multi-ecosystem-group`).",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-dependabot-schedule-interval.js.map

package/dist/rules/require-dependabot-schedule-interval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-schedule-interval.js","sourceRoot":"","sources":["../../src/rules/require-dependabot-schedule-interval.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,EACxB,mCAAmC,GACtC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACH,cAAc,EACd,oBAAoB,GACvB,MAAM,+BAA+B,CAAC;AAEvC,2DAA2D;AAC3D,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACrC,MAAM;IACN,OAAO;IACP,SAAS;IACT,WAAW;IACX,cAAc;IACd,QAAQ;IACR,QAAQ;CACX,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAExC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,eAAe,GAAG,mCAAmC,CACvD,IAAI,EACJ,MAAM,EACN,UAAU,CACb,CAAC;oBACF,MAAM,YAAY,GACd,eAAe,KAAK,IAAI;wBACpB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,cAAc,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;oBACtD,MAAM,aAAa,GAAG,oBAAoB,CACtC,YAAY,EAAE,KAAK,CACtB,EAAE,IAAI,EAAE,CAAC;oBAEV,IACI,aAAa,KAAK,SAAS;wBAC3B,aAAa,KAAK,IAAI;wBACtB,wBAAwB,CAAC,GAAG,CAAC,aAAa,CAAC,EAC7C,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC;yBAChD;wBACD,SAAS,EACL,YAAY,KAAK,IAAI;4BACjB,CAAC,CAAC,yBAAyB;4BAC3B,CAAC,CAAC,yBAAyB;wBACnC,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK;4BACtB,YAAY;4BACZ,MAAM,CAAC,IAAI,CAAyB;qBAC3C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,mCAAmC;aACtC;YACD,WAAW,EACP,wFAAwF;YAC5F,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,6GAA6G;SACrH;QACD,QAAQ,EAAE;YACN,uBAAuB,EACnB,iHAAiH;YACrH,uBAAuB,EACnB,6GAA6G;SACpH;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-schedule-time.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require non-cron Dependabot schedules to declare an explicit `schedule.time`.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for requiring `schedule.time` on non-cron schedules. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-dependabot-schedule-time.d.ts.map

package/dist/rules/require-dependabot-schedule-time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-schedule-time.d.ts","sourceRoot":"","sources":["../../src/rules/require-dependabot-schedule-time.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAanC,+EAA+E;AAC/E,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAmFhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-schedule-time.js

@@ -0,0 +1,68 @@
+import { getDependabotRoot, getDependabotUpdateEntries, getDependabotUpdateLabel, getEffectiveDependabotUpdateMapping, } from "../_internal/dependabot-yaml.js";
+import { getMappingPair, getScalarStringValue, } from "../_internal/workflow-yaml.js";
+/** Rule implementation for requiring `schedule.time` on non-cron schedules. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getDependabotRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const update of getDependabotUpdateEntries(root)) {
+                    const scheduleMapping = getEffectiveDependabotUpdateMapping(root, update, "schedule");
+                    if (scheduleMapping === null) {
+                        continue;
+                    }
+                    const intervalValue = getScalarStringValue(getMappingPair(scheduleMapping, "interval")?.value)?.trim();
+                    if (intervalValue === undefined || intervalValue === null) {
+                        continue;
+                    }
+                    if (intervalValue === "cron") {
+                        continue;
+                    }
+                    const timePair = getMappingPair(scheduleMapping, "time");
+                    const timeValue = getScalarStringValue(timePair?.value)?.trim();
+                    if (timeValue !== undefined &&
+                        timeValue !== null &&
+                        timeValue.length > 0) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            updateLabel: getDependabotUpdateLabel(update),
+                        },
+                        messageId: "missingScheduleTime",
+                        node: (timePair?.value ??
+                            timePair ??
+                            update.node),
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.dependabot",
+            ],
+            description: "require non-cron Dependabot schedules to declare an explicit `schedule.time`.",
+            dialects: ["Dependabot configuration"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R075",
+            ruleNumber: 75,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-dependabot-schedule-time",
+        },
+        messages: {
+            missingScheduleTime: "{{updateLabel}} should declare an explicit `schedule.time` for predictable Dependabot update runs.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-dependabot-schedule-time.js.map

package/dist/rules/require-dependabot-schedule-time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-schedule-time.js","sourceRoot":"","sources":["../../src/rules/require-dependabot-schedule-time.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,EACxB,mCAAmC,GACtC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACH,cAAc,EACd,oBAAoB,GACvB,MAAM,+BAA+B,CAAC;AAEvC,+EAA+E;AAC/E,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAExC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,eAAe,GAAG,mCAAmC,CACvD,IAAI,EACJ,MAAM,EACN,UAAU,CACb,CAAC;oBAEF,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;wBAC3B,SAAS;oBACb,CAAC;oBAED,MAAM,aAAa,GAAG,oBAAoB,CACtC,cAAc,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,KAAK,CACrD,EAAE,IAAI,EAAE,CAAC;oBAEV,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;wBACxD,SAAS;oBACb,CAAC;oBAED,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;wBAC3B,SAAS;oBACb,CAAC;oBAED,MAAM,QAAQ,GAAG,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;oBACzD,MAAM,SAAS,GAAG,oBAAoB,CAClC,QAAQ,EAAE,KAAK,CAClB,EAAE,IAAI,EAAE,CAAC;oBAEV,IACI,SAAS,KAAK,SAAS;wBACvB,SAAS,KAAK,IAAI;wBAClB,SAAS,CAAC,MAAM,GAAG,CAAC,EACtB,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC;yBAChD;wBACD,SAAS,EAAE,qBAAqB;wBAChC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK;4BAClB,QAAQ;4BACR,MAAM,CAAC,IAAI,CAAyB;qBAC3C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,mCAAmC;aACtC;YACD,WAAW,EACP,+EAA+E;YACnF,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,yGAAyG;SACjH;QACD,QAAQ,EAAE;YACN,mBAAmB,EACf,oGAAoG;SAC3G;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-schedule-timezone.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require explicit `schedule.timezone` when Dependabot uses `time` or `cron` scheduling.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for requiring explicit schedule timezones. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-dependabot-schedule-timezone.d.ts.map

package/dist/rules/require-dependabot-schedule-timezone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-schedule-timezone.d.ts","sourceRoot":"","sources":["../../src/rules/require-dependabot-schedule-timezone.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAanC,qEAAqE;AACrE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA0FhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-schedule-timezone.js

@@ -0,0 +1,69 @@
+import { getDependabotRoot, getDependabotUpdateEntries, getDependabotUpdateLabel, getEffectiveDependabotUpdateMapping, } from "../_internal/dependabot-yaml.js";
+import { getMappingPair, getScalarStringValue, } from "../_internal/workflow-yaml.js";
+/** Rule implementation for requiring explicit schedule timezones. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getDependabotRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const update of getDependabotUpdateEntries(root)) {
+                    const scheduleMapping = getEffectiveDependabotUpdateMapping(root, update, "schedule");
+                    if (scheduleMapping === null) {
+                        continue;
+                    }
+                    const intervalValue = getScalarStringValue(getMappingPair(scheduleMapping, "interval")?.value)?.trim();
+                    const timeValue = getScalarStringValue(getMappingPair(scheduleMapping, "time")?.value)?.trim();
+                    if (intervalValue !== "cron" &&
+                        (timeValue === undefined ||
+                            timeValue === null ||
+                            timeValue.length === 0)) {
+                        continue;
+                    }
+                    const timezonePair = getMappingPair(scheduleMapping, "timezone");
+                    const timezoneValue = getScalarStringValue(timezonePair?.value)?.trim();
+                    if (timezoneValue !== undefined &&
+                        timezoneValue !== null &&
+                        timezoneValue.length > 0) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            updateLabel: getDependabotUpdateLabel(update),
+                        },
+                        messageId: "missingScheduleTimezone",
+                        node: (timezonePair?.value ??
+                            timezonePair ??
+                            update.node),
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.dependabot",
+            ],
+            description: "require explicit `schedule.timezone` when Dependabot schedules use `time` or `cron` semantics.",
+            dialects: ["Dependabot configuration"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R076",
+            ruleNumber: 76,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-dependabot-schedule-timezone",
+        },
+        messages: {
+            missingScheduleTimezone: "{{updateLabel}} should declare `schedule.timezone` so Dependabot runs at the intended local time.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-dependabot-schedule-timezone.js.map

package/dist/rules/require-dependabot-schedule-timezone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-schedule-timezone.js","sourceRoot":"","sources":["../../src/rules/require-dependabot-schedule-timezone.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,EACxB,mCAAmC,GACtC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACH,cAAc,EACd,oBAAoB,GACvB,MAAM,+BAA+B,CAAC;AAEvC,qEAAqE;AACrE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAExC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,eAAe,GAAG,mCAAmC,CACvD,IAAI,EACJ,MAAM,EACN,UAAU,CACb,CAAC;oBAEF,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;wBAC3B,SAAS;oBACb,CAAC;oBAED,MAAM,aAAa,GAAG,oBAAoB,CACtC,cAAc,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,KAAK,CACrD,EAAE,IAAI,EAAE,CAAC;oBACV,MAAM,SAAS,GAAG,oBAAoB,CAClC,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,KAAK,CACjD,EAAE,IAAI,EAAE,CAAC;oBAEV,IACI,aAAa,KAAK,MAAM;wBACxB,CAAC,SAAS,KAAK,SAAS;4BACpB,SAAS,KAAK,IAAI;4BAClB,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7B,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,YAAY,GAAG,cAAc,CAC/B,eAAe,EACf,UAAU,CACb,CAAC;oBACF,MAAM,aAAa,GAAG,oBAAoB,CACtC,YAAY,EAAE,KAAK,CACtB,EAAE,IAAI,EAAE,CAAC;oBAEV,IACI,aAAa,KAAK,SAAS;wBAC3B,aAAa,KAAK,IAAI;wBACtB,aAAa,CAAC,MAAM,GAAG,CAAC,EAC1B,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC;yBAChD;wBACD,SAAS,EAAE,yBAAyB;wBACpC,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK;4BACtB,YAAY;4BACZ,MAAM,CAAC,IAAI,CAAyB;qBAC3C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,mCAAmC;aACtC;YACD,WAAW,EACP,gGAAgG;YACpG,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,6GAA6G;SACrH;QACD,QAAQ,EAAE;YACN,uBAAuB,EACnB,mGAAmG;SAC1G;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-target-branch.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require Dependabot update entries to define an effective target branch.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for requiring effective target branches. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-dependabot-target-branch.d.ts.map

package/dist/rules/require-dependabot-target-branch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-target-branch.d.ts","sourceRoot":"","sources":["../../src/rules/require-dependabot-target-branch.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAUnC,mEAAmE;AACnE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA8DhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-target-branch.js

@@ -0,0 +1,53 @@
+import { getDependabotRoot, getDependabotUpdateEntries, getDependabotUpdateLabel, getEffectiveDependabotStringValue, getEffectiveDependabotUpdateValue, } from "../_internal/dependabot-yaml.js";
+/** Rule implementation for requiring effective target branches. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getDependabotRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const update of getDependabotUpdateEntries(root)) {
+                    const targetBranchValue = getEffectiveDependabotUpdateValue(root, update, "target-branch");
+                    const targetBranch = getEffectiveDependabotStringValue(root, update, "target-branch");
+                    if (targetBranch !== null) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            updateLabel: getDependabotUpdateLabel(update),
+                        },
+                        messageId: "missingTargetBranch",
+                        node: (targetBranchValue ??
+                            update.node),
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.dependabot",
+            ],
+            description: "require Dependabot update entries to define an effective `target-branch` directly or via a multi-ecosystem group.",
+            dialects: ["Dependabot configuration"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R078",
+            ruleNumber: 78,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-dependabot-target-branch",
+        },
+        messages: {
+            missingTargetBranch: "{{updateLabel}} should define `target-branch` so Dependabot pull requests land on the intended maintenance branch.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-dependabot-target-branch.js.map

package/dist/rules/require-dependabot-target-branch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-target-branch.js","sourceRoot":"","sources":["../../src/rules/require-dependabot-target-branch.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,EACxB,iCAAiC,EACjC,iCAAiC,GACpC,MAAM,iCAAiC,CAAC;AAEzC,mEAAmE;AACnE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAExC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,iBAAiB,GAAG,iCAAiC,CACvD,IAAI,EACJ,MAAM,EACN,eAAe,CAClB,CAAC;oBACF,MAAM,YAAY,GAAG,iCAAiC,CAClD,IAAI,EACJ,MAAM,EACN,eAAe,CAClB,CAAC;oBAEF,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;wBACxB,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC;yBAChD;wBACD,SAAS,EAAE,qBAAqB;wBAChC,IAAI,EAAE,CAAC,iBAAiB;4BACpB,MAAM,CAAC,IAAI,CAAyB;qBAC3C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,mCAAmC;aACtC;YACD,WAAW,EACP,mHAAmH;YACvH,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,yGAAyG;SACjH;QACD,QAAQ,EAAE;YACN,mBAAmB,EACf,oHAAoH;SAC3H;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-updates.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require a non-empty top-level `updates` sequence in Dependabot configuration files.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for requiring a non-empty `updates` sequence. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-dependabot-updates.d.ts.map

package/dist/rules/require-dependabot-updates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-updates.d.ts","sourceRoot":"","sources":["../../src/rules/require-dependabot-updates.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAQnC,wEAAwE;AACxE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA6DhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-updates.js

@@ -0,0 +1,54 @@
+import { getDependabotRoot } from "../_internal/dependabot-yaml.js";
+import { getMappingPair, getMappingValueAsSequence, } from "../_internal/workflow-yaml.js";
+/** Rule implementation for requiring a non-empty `updates` sequence. */
+const rule = {
+    create(context) {
+        return {
+            Program(node) {
+                const root = getDependabotRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const updatesPair = getMappingPair(root, "updates");
+                const updatesSequence = getMappingValueAsSequence(root, "updates");
+                if (updatesSequence !== null &&
+                    updatesSequence.entries.length > 0) {
+                    return;
+                }
+                context.report({
+                    messageId: updatesPair === null
+                        ? "missingDependabotUpdates"
+                        : "emptyDependabotUpdates",
+                    node: (updatesPair?.value ??
+                        updatesPair ??
+                        node),
+                });
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.dependabot",
+            ],
+            description: "require Dependabot configuration files to define a non-empty top-level `updates` sequence.",
+            dialects: ["Dependabot configuration"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R071",
+            ruleNumber: 71,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-dependabot-updates",
+        },
+        messages: {
+            emptyDependabotUpdates: "Dependabot configuration must define at least one entry under the top-level `updates` sequence.",
+            missingDependabotUpdates: "Dependabot configuration is missing the required top-level `updates` sequence.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-dependabot-updates.js.map

package/dist/rules/require-dependabot-updates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-updates.js","sourceRoot":"","sources":["../../src/rules/require-dependabot-updates.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EACH,cAAc,EACd,yBAAyB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,wEAAwE;AACxE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO,CAAC,IAAI;gBACR,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAExC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,eAAe,GAAG,yBAAyB,CAC7C,IAAI,EACJ,SAAS,CACZ,CAAC;gBAEF,IACI,eAAe,KAAK,IAAI;oBACxB,eAAe,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EACpC,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EACL,WAAW,KAAK,IAAI;wBAChB,CAAC,CAAC,0BAA0B;wBAC5B,CAAC,CAAC,wBAAwB;oBAClC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK;wBACrB,WAAW;wBACX,IAAI,CAAyB;iBACpC,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,mCAAmC;aACtC;YACD,WAAW,EACP,4FAA4F;YAChG,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,mGAAmG;SAC3G;QACD,QAAQ,EAAE;YACN,sBAAsB,EAClB,iGAAiG;YACrG,wBAAwB,EACpB,gFAAgF;SACvF;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-version.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require `version: 2` in Dependabot configuration files.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for requiring `version: 2` in Dependabot config. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-dependabot-version.d.ts.map

package/dist/rules/require-dependabot-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-version.d.ts","sourceRoot":"","sources":["../../src/rules/require-dependabot-version.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAQnC,2EAA2E;AAC3E,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA6EhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-version.js

@@ -0,0 +1,62 @@
+import { getDependabotMappingStringValue, getDependabotRoot, } from "../_internal/dependabot-yaml.js";
+import { getMappingPair } from "../_internal/workflow-yaml.js";
+/** Rule implementation for requiring `version: 2` in Dependabot config. */
+const rule = {
+    create(context) {
+        return {
+            Program(node) {
+                const root = getDependabotRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const versionPair = getMappingPair(root, "version");
+                const versionValue = getDependabotMappingStringValue(root, "version");
+                if (versionValue === "2") {
+                    return;
+                }
+                context.report({
+                    fix: (fixer) => {
+                        if (versionPair === null) {
+                            return fixer.insertTextBeforeRange([root.range[0], root.range[0]], "version: 2\n");
+                        }
+                        return versionPair.value === null
+                            ? fixer.replaceTextRange(versionPair.range, "version: 2")
+                            : fixer.replaceTextRange(versionPair.value.range, "2");
+                    },
+                    messageId: versionPair === null
+                        ? "missingDependabotVersion"
+                        : "invalidDependabotVersion",
+                    node: (versionPair?.value ??
+                        versionPair ??
+                        node),
+                });
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.dependabot",
+            ],
+            description: "require Dependabot configuration files to declare `version: 2`.",
+            dialects: ["Dependabot configuration"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R070",
+            ruleNumber: 70,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-dependabot-version",
+        },
+        fixable: "code",
+        messages: {
+            invalidDependabotVersion: "Dependabot configuration must declare `version: 2`.",
+            missingDependabotVersion: "Dependabot configuration is missing the required top-level `version: 2` key.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-dependabot-version.js.map

package/dist/rules/require-dependabot-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-version.js","sourceRoot":"","sources":["../../src/rules/require-dependabot-version.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,+BAA+B,EAC/B,iBAAiB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO,CAAC,IAAI;gBACR,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAExC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,YAAY,GAAG,+BAA+B,CAChD,IAAI,EACJ,SAAS,CACZ,CAAC;gBAEF,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;oBACvB,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;wBACX,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;4BACvB,OAAO,KAAK,CAAC,qBAAqB,CAC9B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAC9B,cAAc,CACjB,CAAC;wBACN,CAAC;wBAED,OAAO,WAAW,CAAC,KAAK,KAAK,IAAI;4BAC7B,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAClB,WAAW,CAAC,KAAK,EACjB,YAAY,CACf;4BACH,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAClB,WAAW,CAAC,KAAK,CAAC,KAAK,EACvB,GAAG,CACN,CAAC;oBACZ,CAAC;oBACD,SAAS,EACL,WAAW,KAAK,IAAI;wBAChB,CAAC,CAAC,0BAA0B;wBAC5B,CAAC,CAAC,0BAA0B;oBACpC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK;wBACrB,WAAW;wBACX,IAAI,CAAyB;iBACpC,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,mCAAmC;aACtC;YACD,WAAW,EACP,iEAAiE;YACrE,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,mGAAmG;SAC3G;QACD,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE;YACN,wBAAwB,EACpB,qDAAqD;YACzD,wBAAwB,EACpB,8EAA8E;SACrF;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-versioning-strategy-for-npm.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require npm Dependabot update entries to define versioning strategy.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for npm versioning strategy requirements. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-dependabot-versioning-strategy-for-npm.d.ts.map

package/dist/rules/require-dependabot-versioning-strategy-for-npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-versioning-strategy-for-npm.d.ts","sourceRoot":"","sources":["../../src/rules/require-dependabot-versioning-strategy-for-npm.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAUnC,oEAAoE;AACpE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAiEhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-versioning-strategy-for-npm.js

@@ -0,0 +1,58 @@
+import { getDependabotMappingStringValue, getDependabotRoot, getDependabotUpdateEntries, getDependabotUpdateLabel, } from "../_internal/dependabot-yaml.js";
+import { getMappingPair } from "../_internal/workflow-yaml.js";
+/** Rule implementation for npm versioning strategy requirements. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getDependabotRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const update of getDependabotUpdateEntries(root)) {
+                    if (update.packageEcosystem?.trim() !== "npm") {
+                        continue;
+                    }
+                    const strategyPair = getMappingPair(update.mapping, "versioning-strategy");
+                    const strategyValue = getDependabotMappingStringValue(update.mapping, "versioning-strategy");
+                    if (strategyValue !== null) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            updateLabel: getDependabotUpdateLabel(update),
+                        },
+                        messageId: "missingVersioningStrategy",
+                        node: (strategyPair?.value ??
+                            strategyPair ??
+                            update.node),
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.dependabot",
+            ],
+            description: "require npm Dependabot update entries to define `versioning-strategy`.",
+            dialects: ["Dependabot configuration"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R088",
+            ruleNumber: 88,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-dependabot-versioning-strategy-for-npm",
+        },
+        messages: {
+            missingVersioningStrategy: "{{updateLabel}} should define `versioning-strategy` so npm dependency range updates follow an explicit policy.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-dependabot-versioning-strategy-for-npm.js.map

package/dist/rules/require-dependabot-versioning-strategy-for-npm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-versioning-strategy-for-npm.js","sourceRoot":"","sources":["../../src/rules/require-dependabot-versioning-strategy-for-npm.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,+BAA+B,EAC/B,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,oEAAoE;AACpE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAExC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,IAAI,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;wBAC5C,SAAS;oBACb,CAAC;oBAED,MAAM,YAAY,GAAG,cAAc,CAC/B,MAAM,CAAC,OAAO,EACd,qBAAqB,CACxB,CAAC;oBACF,MAAM,aAAa,GAAG,+BAA+B,CACjD,MAAM,CAAC,OAAO,EACd,qBAAqB,CACxB,CAAC;oBAEF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;wBACzB,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC;yBAChD;wBACD,SAAS,EAAE,2BAA2B;wBACtC,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK;4BACtB,YAAY;4BACZ,MAAM,CAAC,IAAI,CAAyB;qBAC3C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,mCAAmC;aACtC;YACD,WAAW,EACP,wEAAwE;YAC5E,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,uHAAuH;SAC/H;QACD,QAAQ,EAAE;YACN,yBAAyB,EACrB,gHAAgH;SACvH;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependency-review-action.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require dependency-review workflow files to invoke actions/dependency-review-action.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for requiring dependency review action usage. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-dependency-review-action.d.ts.map

package/dist/rules/require-dependency-review-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependency-review-action.d.ts","sourceRoot":"","sources":["../../src/rules/require-dependency-review-action.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAMnC,wEAAwE;AACxE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAkDhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependency-review-action.js

@@ -0,0 +1,51 @@
+import { getDependencyReviewActionSteps } from "../_internal/dependency-review-workflow.js";
+import { isDependencyReviewWorkflowFile } from "../_internal/lint-targets.js";
+import { getWorkflowRoot } from "../_internal/workflow-yaml.js";
+/** Rule implementation for requiring dependency review action usage. */
+const rule = {
+    create(context) {
+        return {
+            Program(node) {
+                if (!isDependencyReviewWorkflowFile(context.filename)) {
+                    return;
+                }
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                if (getDependencyReviewActionSteps(root).length > 0) {
+                    return;
+                }
+                context.report({
+                    messageId: "missingDependencyReviewAction",
+                    node: node,
+                });
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.codeScanning",
+                "github-actions.configs.security",
+            ],
+            description: "require dependency-review workflow files to invoke `actions/dependency-review-action`.",
+            dialects: ["GitHub Actions workflow"],
+            frozen: false,
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R091",
+            ruleNumber: 91,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-dependency-review-action",
+        },
+        messages: {
+            missingDependencyReviewAction: "Dependency review workflow files should invoke `actions/dependency-review-action` in at least one job step.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-dependency-review-action.js.map

package/dist/rules/require-dependency-review-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependency-review-action.js","sourceRoot":"","sources":["../../src/rules/require-dependency-review-action.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,wEAAwE;AACxE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO,CAAC,IAAI;gBACR,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpD,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClD,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,+BAA+B;oBAC1C,IAAI,EAAE,IAA4B;iBACrC,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,qCAAqC;gBACrC,iCAAiC;aACpC;YACD,WAAW,EACP,wFAAwF;YAC5F,QAAQ,EAAE,CAAC,yBAAyB,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,yGAAyG;SACjH;QACD,QAAQ,EAAE;YACN,6BAA6B,EACzB,6GAA6G;SACpH;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}