eslint-plugin-github-actions-2 1.0.2 → 1.0.3

package/dist/rules/require-codeql-actions-read.js

@@ -0,0 +1,63 @@
+import { getCodeqlAnalyzeSteps, getCodeqlAutobuildSteps, getCodeqlInitSteps, getSarifUploadSteps, } from "../_internal/code-scanning-workflow.js";
+import { hasRequiredWorkflowPermission } from "../_internal/workflow-permissions.js";
+import { getWorkflowRoot } from "../_internal/workflow-yaml.js";
+/** Rule implementation for CodeQL actions:read requirements. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                const steps = [
+                    ...getCodeqlInitSteps(root),
+                    ...getCodeqlAutobuildSteps(root),
+                    ...getCodeqlAnalyzeSteps(root),
+                    ...getSarifUploadSteps(root),
+                ];
+                const seenJobIds = new Set();
+                for (const step of steps) {
+                    if (seenJobIds.has(step.job.id)) {
+                        continue;
+                    }
+                    seenJobIds.add(step.job.id);
+                    if (hasRequiredWorkflowPermission(root, step.job, "actions", "read")) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            jobId: step.job.id,
+                        },
+                        messageId: "missingActionsRead",
+                        node: step.job.idNode,
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.codeScanning",
+            ],
+            description: "require jobs running CodeQL actions to grant `actions: read`.",
+            dialects: ["GitHub Actions workflow"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R099",
+            ruleNumber: 99,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-codeql-actions-read",
+        },
+        messages: {
+            missingActionsRead: "Job '{{jobId}}' uses CodeQL actions and should grant `actions: read`.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-codeql-actions-read.js.map

package/dist/rules/require-codeql-actions-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-codeql-actions-read.js","sourceRoot":"","sources":["../../src/rules/require-codeql-actions-read.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,gEAAgE;AAChE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,MAAM,KAAK,GAAG;oBACV,GAAG,kBAAkB,CAAC,IAAI,CAAC;oBAC3B,GAAG,uBAAuB,CAAC,IAAI,CAAC;oBAChC,GAAG,qBAAqB,CAAC,IAAI,CAAC;oBAC9B,GAAG,mBAAmB,CAAC,IAAI,CAAC;iBAC/B,CAAC;gBACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;gBAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACvB,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;wBAC9B,SAAS;oBACb,CAAC;oBAED,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAE5B,IACI,6BAA6B,CACzB,IAAI,EACJ,IAAI,CAAC,GAAG,EACR,SAAS,EACT,MAAM,CACT,EACH,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;yBACrB;wBACD,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAA8B;qBAChD,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,qCAAqC;aACxC;YACD,WAAW,EACP,+DAA+D;YACnE,QAAQ,EAAE,CAAC,yBAAyB,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,oGAAoG;SAC5G;QACD,QAAQ,EAAE;YACN,kBAAkB,EACd,uEAAuE;SAC9E;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-codeql-branch-filters.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @packageDocumentation
+ * Require CodeQL push and pull_request triggers to scope branches explicitly.
+ */
+import type { Rule } from "eslint";
+/**
+ * Rule implementation for requiring branch filters on CodeQL push and PR
+ * triggers.
+ */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-codeql-branch-filters.d.ts.map

package/dist/rules/require-codeql-branch-filters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-codeql-branch-filters.d.ts","sourceRoot":"","sources":["../../src/rules/require-codeql-branch-filters.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAsCnC;;;GAGG;AACH,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA4EhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-codeql-branch-filters.js

@@ -0,0 +1,83 @@
+import { getCodeqlInitSteps } from "../_internal/code-scanning-workflow.js";
+import { getMappingPair, getMappingValueAsMapping, getScalarStringValue, getWorkflowRoot, unwrapYamlValue, } from "../_internal/workflow-yaml.js";
+const hasConfiguredBranchFilter = (node) => {
+    const valueNode = unwrapYamlValue(node?.value ?? null);
+    if (valueNode === null) {
+        return false;
+    }
+    if (valueNode.type === "YAMLScalar") {
+        const value = getScalarStringValue(valueNode);
+        return value !== null && value.trim().length > 0;
+    }
+    if (valueNode.type !== "YAMLSequence") {
+        return false;
+    }
+    return valueNode.entries.some((entry) => {
+        const value = getScalarStringValue(entry);
+        return value !== null && value.trim().length > 0;
+    });
+};
+/**
+ * Rule implementation for requiring branch filters on CodeQL push and PR
+ * triggers.
+ */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null || getCodeqlInitSteps(root).length === 0) {
+                    return;
+                }
+                const onMapping = getMappingValueAsMapping(root, "on");
+                if (onMapping === null) {
+                    return;
+                }
+                for (const triggerName of ["push", "pull_request"]) {
+                    const triggerPair = getMappingPair(onMapping, triggerName);
+                    const triggerMapping = triggerPair === null
+                        ? null
+                        : unwrapYamlValue(triggerPair.value);
+                    if (triggerMapping?.type !== "YAMLMapping") {
+                        continue;
+                    }
+                    const branchesPair = getMappingPair(triggerMapping, "branches");
+                    const branchesIgnorePair = getMappingPair(triggerMapping, "branches-ignore");
+                    if (hasConfiguredBranchFilter(branchesPair) ||
+                        hasConfiguredBranchFilter(branchesIgnorePair)) {
+                        continue;
+                    }
+                    context.report({
+                        data: { triggerName },
+                        messageId: "missingBranchFilter",
+                        node: triggerMapping,
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.codeScanning",
+            ],
+            description: "require CodeQL `push` and `pull_request` triggers to scope branches explicitly.",
+            dialects: ["GitHub Actions workflow"],
+            frozen: false,
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R113",
+            ruleNumber: 113,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-codeql-branch-filters",
+        },
+        messages: {
+            missingBranchFilter: "CodeQL trigger '{{triggerName}}' should declare a non-empty `branches` or `branches-ignore` filter.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-codeql-branch-filters.js.map

package/dist/rules/require-codeql-branch-filters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-codeql-branch-filters.js","sourceRoot":"","sources":["../../src/rules/require-codeql-branch-filters.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,yBAAyB,GAAG,CAC9B,IAA+C,EACxC,EAAE;IACT,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;IAEvD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAE9C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzD,OAAO;gBACX,CAAC;gBAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAEvD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,WAAW,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;oBACjD,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;oBAC3D,MAAM,cAAc,GAChB,WAAW,KAAK,IAAI;wBAChB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;oBAE7C,IAAI,cAAc,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;wBACzC,SAAS;oBACb,CAAC;oBAED,MAAM,YAAY,GAAG,cAAc,CAC/B,cAAc,EACd,UAAU,CACb,CAAC;oBACF,MAAM,kBAAkB,GAAG,cAAc,CACrC,cAAc,EACd,iBAAiB,CACpB,CAAC;oBAEF,IACI,yBAAyB,CAAC,YAAY,CAAC;wBACvC,yBAAyB,CAAC,kBAAkB,CAAC,EAC/C,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE,EAAE,WAAW,EAAE;wBACrB,SAAS,EAAE,qBAAqB;wBAChC,IAAI,EAAE,cAAsC;qBAC/C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,qCAAqC;aACxC;YACD,WAAW,EACP,iFAAiF;YACrF,QAAQ,EAAE,CAAC,yBAAyB,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,GAAG;YACf,GAAG,EAAE,sGAAsG;SAC9G;QACD,QAAQ,EAAE;YACN,mBAAmB,EACf,qGAAqG;SAC5G;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-codeql-category-when-language-matrix.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @packageDocumentation
+ * Require CodeQL analyze steps to set a category that includes the matrix language when a language matrix is used.
+ */
+import type { Rule } from "eslint";
+/**
+ * Rule implementation for requiring CodeQL category when matrix.language is
+ * used.
+ */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-codeql-category-when-language-matrix.d.ts.map

package/dist/rules/require-codeql-category-when-language-matrix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-codeql-category-when-language-matrix.d.ts","sourceRoot":"","sources":["../../src/rules/require-codeql-category-when-language-matrix.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAUnC;;;GAGG;AACH,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAkFhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-codeql-category-when-language-matrix.js

@@ -0,0 +1,68 @@
+import { getCodeqlAnalyzeSteps } from "../_internal/code-scanning-workflow.js";
+import { getMappingPair, getMappingValueAsMapping, getScalarStringValue, getWorkflowRoot, } from "../_internal/workflow-yaml.js";
+/**
+ * Rule implementation for requiring CodeQL category when matrix.language is
+ * used.
+ */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const step of getCodeqlAnalyzeSteps(root)) {
+                    const strategyMapping = getMappingValueAsMapping(step.job.mapping, "strategy");
+                    const matrixMapping = strategyMapping === null
+                        ? null
+                        : getMappingValueAsMapping(strategyMapping, "matrix");
+                    if (matrixMapping === null ||
+                        getMappingPair(matrixMapping, "language") === null) {
+                        continue;
+                    }
+                    const withMapping = getMappingValueAsMapping(step.stepMapping, "with");
+                    const categoryPair = withMapping === null
+                        ? null
+                        : getMappingPair(withMapping, "category");
+                    const categoryValue = getScalarStringValue(categoryPair?.value ?? null)?.trim();
+                    if (categoryValue?.includes("matrix.language") === true) {
+                        continue;
+                    }
+                    context.report({
+                        data: { jobId: step.job.id },
+                        messageId: "missingCategoryForLanguageMatrix",
+                        node: (categoryPair?.value ??
+                            categoryPair ??
+                            withMapping ??
+                            step.usesPair),
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.codeScanning",
+            ],
+            description: "require CodeQL analyze steps to set `with.category` using `matrix.language` when the job uses a language matrix.",
+            dialects: ["GitHub Actions workflow"],
+            frozen: false,
+            recommended: false,
+            requiresTypeChecking: false,
+            ruleId: "R114",
+            ruleNumber: 114,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-codeql-category-when-language-matrix",
+        },
+        messages: {
+            missingCategoryForLanguageMatrix: "CodeQL analyze step in job '{{jobId}}' should set `with.category` to include `matrix.language` when a language matrix is used.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-codeql-category-when-language-matrix.js.map

package/dist/rules/require-codeql-category-when-language-matrix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-codeql-category-when-language-matrix.js","sourceRoot":"","sources":["../../src/rules/require-codeql-category-when-language-matrix.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC;;;GAGG;AACH,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,MAAM,eAAe,GAAG,wBAAwB,CAC5C,IAAI,CAAC,GAAG,CAAC,OAAO,EAChB,UAAU,CACb,CAAC;oBACF,MAAM,aAAa,GACf,eAAe,KAAK,IAAI;wBACpB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,wBAAwB,CACpB,eAAe,EACf,QAAQ,CACX,CAAC;oBAEZ,IACI,aAAa,KAAK,IAAI;wBACtB,cAAc,CAAC,aAAa,EAAE,UAAU,CAAC,KAAK,IAAI,EACpD,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,WAAW,GAAG,wBAAwB,CACxC,IAAI,CAAC,WAAW,EAChB,MAAM,CACT,CAAC;oBACF,MAAM,YAAY,GACd,WAAW,KAAK,IAAI;wBAChB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;oBAClD,MAAM,aAAa,GAAG,oBAAoB,CACtC,YAAY,EAAE,KAAK,IAAI,IAAI,CAC9B,EAAE,IAAI,EAAE,CAAC;oBAEV,IAAI,aAAa,EAAE,QAAQ,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC;wBACtD,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;wBAC5B,SAAS,EAAE,kCAAkC;wBAC7C,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK;4BACtB,YAAY;4BACZ,WAAW;4BACX,IAAI,CAAC,QAAQ,CAAyB;qBAC7C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,qCAAqC;aACxC;YACD,WAAW,EACP,kHAAkH;YACtH,QAAQ,EAAE,CAAC,yBAAyB,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,GAAG;YACf,GAAG,EAAE,qHAAqH;SAC7H;QACD,QAAQ,EAAE;YACN,gCAAgC,EAC5B,gIAAgI;SACvI;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-codeql-pull-request-trigger.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require CodeQL workflows to run on pull_request.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for requiring pull_request triggers on CodeQL workflows. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-codeql-pull-request-trigger.d.ts.map

package/dist/rules/require-codeql-pull-request-trigger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-codeql-pull-request-trigger.d.ts","sourceRoot":"","sources":["../../src/rules/require-codeql-pull-request-trigger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAQnC,mFAAmF;AACnF,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA6ChB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-codeql-pull-request-trigger.js

@@ -0,0 +1,46 @@
+import { getCodeqlInitSteps } from "../_internal/code-scanning-workflow.js";
+import { getWorkflowEventNames, getWorkflowRoot, } from "../_internal/workflow-yaml.js";
+/** Rule implementation for requiring pull_request triggers on CodeQL workflows. */
+const rule = {
+    create(context) {
+        return {
+            Program(node) {
+                const root = getWorkflowRoot(context);
+                if (root === null || getCodeqlInitSteps(root).length === 0) {
+                    return;
+                }
+                if (getWorkflowEventNames(root).has("pull_request")) {
+                    return;
+                }
+                context.report({
+                    messageId: "missingPullRequestTrigger",
+                    node: node,
+                });
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.codeScanning",
+            ],
+            description: "require CodeQL workflows to listen for `pull_request`.",
+            dialects: ["GitHub Actions workflow"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R100",
+            ruleNumber: 100,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-codeql-pull-request-trigger",
+        },
+        messages: {
+            missingPullRequestTrigger: "CodeQL workflows should listen for `pull_request` so code scanning runs on incoming pull requests.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-codeql-pull-request-trigger.js.map

package/dist/rules/require-codeql-pull-request-trigger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-codeql-pull-request-trigger.js","sourceRoot":"","sources":["../../src/rules/require-codeql-pull-request-trigger.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACH,qBAAqB,EACrB,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,mFAAmF;AACnF,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO,CAAC,IAAI;gBACR,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzD,OAAO;gBACX,CAAC;gBAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;oBAClD,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,2BAA2B;oBACtC,IAAI,EAAE,IAA4B;iBACrC,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,qCAAqC;aACxC;YACD,WAAW,EACP,wDAAwD;YAC5D,QAAQ,EAAE,CAAC,yBAAyB,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,GAAG;YACf,GAAG,EAAE,4GAA4G;SACpH;QACD,QAAQ,EAAE;YACN,yBAAyB,EACrB,oGAAoG;SAC3G;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-codeql-schedule.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require CodeQL workflows to run on a schedule.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for requiring scheduled CodeQL runs. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-codeql-schedule.d.ts.map

package/dist/rules/require-codeql-schedule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-codeql-schedule.d.ts","sourceRoot":"","sources":["../../src/rules/require-codeql-schedule.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAQnC,+DAA+D;AAC/D,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA6ChB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-codeql-schedule.js

@@ -0,0 +1,46 @@
+import { getCodeqlInitSteps } from "../_internal/code-scanning-workflow.js";
+import { getWorkflowEventNames, getWorkflowRoot, } from "../_internal/workflow-yaml.js";
+/** Rule implementation for requiring scheduled CodeQL runs. */
+const rule = {
+    create(context) {
+        return {
+            Program(node) {
+                const root = getWorkflowRoot(context);
+                if (root === null || getCodeqlInitSteps(root).length === 0) {
+                    return;
+                }
+                if (getWorkflowEventNames(root).has("schedule")) {
+                    return;
+                }
+                context.report({
+                    messageId: "missingScheduleTrigger",
+                    node: node,
+                });
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.codeScanning",
+            ],
+            description: "require CodeQL workflows to include a scheduled trigger for periodic re-analysis.",
+            dialects: ["GitHub Actions workflow"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R101",
+            ruleNumber: 101,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-codeql-schedule",
+        },
+        messages: {
+            missingScheduleTrigger: "CodeQL workflows should include a `schedule` trigger for periodic re-analysis.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-codeql-schedule.js.map

package/dist/rules/require-codeql-schedule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-codeql-schedule.js","sourceRoot":"","sources":["../../src/rules/require-codeql-schedule.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACH,qBAAqB,EACrB,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,+DAA+D;AAC/D,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO,CAAC,IAAI;gBACR,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzD,OAAO;gBACX,CAAC;gBAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9C,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,wBAAwB;oBACnC,IAAI,EAAE,IAA4B;iBACrC,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,qCAAqC;aACxC;YACD,WAAW,EACP,mFAAmF;YACvF,QAAQ,EAAE,CAAC,yBAAyB,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,GAAG;YACf,GAAG,EAAE,gGAAgG;SACxG;QACD,QAAQ,EAAE;YACN,sBAAsB,EAClB,gFAAgF;SACvF;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-codeql-security-events-write.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require CodeQL analysis jobs to grant security-events write permissions.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for CodeQL security-events permission requirements. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-codeql-security-events-write.d.ts.map

package/dist/rules/require-codeql-security-events-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-codeql-security-events-write.d.ts","sourceRoot":"","sources":["../../src/rules/require-codeql-security-events-write.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAMnC,8EAA8E;AAC9E,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA0DhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-codeql-security-events-write.js

@@ -0,0 +1,53 @@
+import { getCodeqlAnalyzeSteps } from "../_internal/code-scanning-workflow.js";
+import { hasRequiredWorkflowPermission } from "../_internal/workflow-permissions.js";
+import { getWorkflowRoot } from "../_internal/workflow-yaml.js";
+/** Rule implementation for CodeQL security-events permission requirements. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getWorkflowRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const step of getCodeqlAnalyzeSteps(root)) {
+                    if (hasRequiredWorkflowPermission(root, step.job, "security-events", "write")) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            jobId: step.job.id,
+                        },
+                        messageId: "missingSecurityEventsWrite",
+                        node: step.job.idNode,
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.codeScanning",
+                "github-actions.configs.security",
+            ],
+            description: "require jobs running CodeQL analysis to grant `security-events: write`.",
+            dialects: ["GitHub Actions workflow"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R098",
+            ruleNumber: 98,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-codeql-security-events-write",
+        },
+        messages: {
+            missingSecurityEventsWrite: "Job '{{jobId}}' runs CodeQL analysis and should grant `security-events: write`.",
+        },
+        schema: [],
+        type: "problem",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-codeql-security-events-write.js.map

package/dist/rules/require-codeql-security-events-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-codeql-security-events-write.js","sourceRoot":"","sources":["../../src/rules/require-codeql-security-events-write.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,8EAA8E;AAC9E,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,IACI,6BAA6B,CACzB,IAAI,EACJ,IAAI,CAAC,GAAG,EACR,iBAAiB,EACjB,OAAO,CACV,EACH,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;yBACrB;wBACD,SAAS,EAAE,4BAA4B;wBACvC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAA8B;qBAChD,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,qCAAqC;gBACrC,iCAAiC;aACpC;YACD,WAAW,EACP,yEAAyE;YAC7E,QAAQ,EAAE,CAAC,yBAAyB,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,6GAA6G;SACrH;QACD,QAAQ,EAAE;YACN,0BAA0B,EACtB,iFAAiF;SACxF;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KACG;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-composite-step-name.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-composite-step-name.d.ts","sourceRoot":"","sources":["../../src/rules/require-composite-step-name.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAYnC,kEAAkE;AAClE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAqFhB,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"require-composite-step-name.d.ts","sourceRoot":"","sources":["../../src/rules/require-composite-step-name.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAYnC,kEAAkE;AAClE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAwFhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-composite-step-name.js

@@ -44,12 +44,15 @@ const rule = {
         };
     },
     meta: {
+        deprecated: false,
         docs: {
             configs: [
                 "github-actions.configs.actionMetadata",
                 "github-actions.configs.all",
             ],
             description: "require each composite action step to declare a descriptive `name`.",
+            dialects: ["GitHub Action metadata"],
+            frozen: false,
             recommended: false,
             requiresTypeChecking: false,
             ruleId: "R052",

package/dist/rules/require-composite-step-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"require-composite-step-name.js","sourceRoot":"","sources":["../../src/rules/require-composite-step-name.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,kEAAkE;AAClE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM,WAAW,GACb,IAAI,KAAK,IAAI;oBACT,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAEjD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;oBACvB,OAAO;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,oBAAoB,CACrC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,KAAK,CAC9C,CAAC;gBAEF,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;oBAC/B,OAAO;gBACX,CAAC;gBAED,MAAM,aAAa,GAAG,yBAAyB,CAC3C,WAAW,EACX,OAAO,CACV,CAAC;gBAEF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;oBACzB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,CACP,KAAK,EACL,SAAS,EACZ,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;oBACnC,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;oBAE/C,IAAI,WAAW,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;wBACtC,SAAS;oBACb,CAAC;oBAED,MAAM,SAAS,GAAG,oBAAoB,CAClC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,CAC7C,CAAC;oBAEF,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpD,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;yBAC3B;wBACD,SAAS,EAAE,0BAA0B;wBACrC,IAAI,EAAE,WAAmC;qBAC5C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,uCAAuC;gBACvC,4BAA4B;aAC/B;YACD,WAAW,EACP,qEAAqE;YACzE,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,oGAAoG;SAC5G;QACD,QAAQ,EAAE;YACN,wBAAwB,EACpB,4FAA4F;SACnG;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"require-composite-step-name.js","sourceRoot":"","sources":["../../src/rules/require-composite-step-name.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,kEAAkE;AAClE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM,WAAW,GACb,IAAI,KAAK,IAAI;oBACT,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAEjD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;oBACvB,OAAO;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,oBAAoB,CACrC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,KAAK,CAC9C,CAAC;gBAEF,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;oBAC/B,OAAO;gBACX,CAAC;gBAED,MAAM,aAAa,GAAG,yBAAyB,CAC3C,WAAW,EACX,OAAO,CACV,CAAC;gBAEF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;oBACzB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,CACP,KAAK,EACL,SAAS,EACZ,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;oBACnC,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;oBAE/C,IAAI,WAAW,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;wBACtC,SAAS;oBACb,CAAC;oBAED,MAAM,SAAS,GAAG,oBAAoB,CAClC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,CAC7C,CAAC;oBAEF,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpD,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;yBAC3B;wBACD,SAAS,EAAE,0BAA0B;wBACrC,IAAI,EAAE,WAAmC;qBAC5C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,uCAAuC;gBACvC,4BAA4B;aAC/B;YACD,WAAW,EACP,qEAAqE;YACzE,QAAQ,EAAE,CAAC,wBAAwB,CAAC;YACpC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,oGAAoG;SAC5G;QACD,QAAQ,EAAE;YACN,wBAAwB,EACpB,4FAA4F;SACnG;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-assignees.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require Dependabot update entries to define effective assignees.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for requiring effective assignees. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-dependabot-assignees.d.ts.map

package/dist/rules/require-dependabot-assignees.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-assignees.d.ts","sourceRoot":"","sources":["../../src/rules/require-dependabot-assignees.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAUnC,6DAA6D;AAC7D,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA4DhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-assignees.js

@@ -0,0 +1,53 @@
+import { getDependabotRoot, getDependabotUpdateEntries, getDependabotUpdateLabel, getEffectiveDependabotUpdateValue, getNonEmptyStringSequenceEntries, } from "../_internal/dependabot-yaml.js";
+/** Rule implementation for requiring effective assignees. */
+const rule = {
+    create(context) {
+        return {
+            Program() {
+                const root = getDependabotRoot(context);
+                if (root === null) {
+                    return;
+                }
+                for (const update of getDependabotUpdateEntries(root)) {
+                    const assigneesValue = getEffectiveDependabotUpdateValue(root, update, "assignees");
+                    if (getNonEmptyStringSequenceEntries(assigneesValue)
+                        .length > 0) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            updateLabel: getDependabotUpdateLabel(update),
+                        },
+                        messageId: "missingAssignees",
+                        node: (assigneesValue ??
+                            update.node),
+                    });
+                }
+            },
+        };
+    },
+    meta: {
+        deprecated: false,
+        docs: {
+            configs: [
+                "github-actions.configs.all",
+                "github-actions.configs.dependabot",
+            ],
+            description: "require Dependabot update entries to define effective `assignees` directly or via a multi-ecosystem group.",
+            dialects: ["Dependabot configuration"],
+            frozen: false,
+            recommended: true,
+            requiresTypeChecking: false,
+            ruleId: "R077",
+            ruleNumber: 77,
+            url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-dependabot-assignees",
+        },
+        messages: {
+            missingAssignees: "{{updateLabel}} should define non-empty `assignees` so Dependabot pull requests have clear ownership.",
+        },
+        schema: [],
+        type: "suggestion",
+    },
+};
+export default rule;
+//# sourceMappingURL=require-dependabot-assignees.js.map

package/dist/rules/require-dependabot-assignees.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-assignees.js","sourceRoot":"","sources":["../../src/rules/require-dependabot-assignees.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,EACxB,iCAAiC,EACjC,gCAAgC,GACnC,MAAM,iCAAiC,CAAC;AAEzC,6DAA6D;AAC7D,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAExC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,cAAc,GAAG,iCAAiC,CACpD,IAAI,EACJ,MAAM,EACN,WAAW,CACd,CAAC;oBAEF,IACI,gCAAgC,CAAC,cAAc,CAAC;yBAC3C,MAAM,GAAG,CAAC,EACjB,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC;yBAChD;wBACD,SAAS,EAAE,kBAAkB;wBAC7B,IAAI,EAAE,CAAC,cAAc;4BACjB,MAAM,CAAC,IAAI,CAAyB;qBAC3C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,mCAAmC;aACtC;YACD,WAAW,EACP,4GAA4G;YAChH,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,qGAAqG;SAC7G;QACD,QAAQ,EAAE;YACN,gBAAgB,EACZ,uGAAuG;SAC9G;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-automation-permissions.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @packageDocumentation
+ * Require minimum permissions for workflows that automate Dependabot pull requests.
+ */
+import type { Rule } from "eslint";
+/** Rule implementation for Dependabot automation permission requirements. */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=require-dependabot-automation-permissions.d.ts.map

package/dist/rules/require-dependabot-automation-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dependabot-automation-permissions.d.ts","sourceRoot":"","sources":["../../src/rules/require-dependabot-automation-permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAMnC,6EAA6E;AAC7E,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA0FhB,CAAC;AAEF,eAAe,IAAI,CAAC"}