eslint-plugin-github-actions-2 1.0.2 → 1.0.3

package/dist/_internal/workflow-permissions.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @packageDocumentation
+ * Helpers for reasoning about workflow and job-level GitHub token permissions.
+ */
+import type { AST } from "yaml-eslint-parser";
+import { type WorkflowJobEntry } from "./workflow-yaml.js";
+/** GitHub token permission levels used in workflow YAML. */
+export type WorkflowPermissionLevel = "read" | "write";
+/** Determine whether a workflow/job has the required effective permission level. */
+export declare const hasRequiredWorkflowPermission: (root: AST.YAMLMapping, job: WorkflowJobEntry, permissionName: string, requiredLevel: WorkflowPermissionLevel) => boolean;
+//# sourceMappingURL=workflow-permissions.d.ts.map

package/dist/_internal/workflow-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-permissions.d.ts","sourceRoot":"","sources":["../../src/_internal/workflow-permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAIH,KAAK,gBAAgB,EACxB,MAAM,oBAAoB,CAAC;AAE5B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,CAAC;AA2EvD,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,GACtC,MAAM,GAAG,CAAC,WAAW,EACrB,KAAK,gBAAgB,EACrB,gBAAgB,MAAM,EACtB,eAAe,uBAAuB,KACvC,OAgBF,CAAC"}

package/dist/_internal/workflow-permissions.js

@@ -0,0 +1,50 @@
+import { getMappingPair, getScalarStringValue, unwrapYamlValue, } from "./workflow-yaml.js";
+/** Read the permissions node for a workflow or job mapping. */
+const getPermissionsNode = (mapping) => getMappingPair(mapping, "permissions")?.value ?? null;
+/** Determine whether a permissions scalar satisfies the required access level. */
+const scalarPermissionSatisfies = (scalarValue, requiredLevel) => {
+    const normalizedValue = scalarValue.trim().toLowerCase();
+    if (normalizedValue === "write-all") {
+        return true;
+    }
+    if (requiredLevel === "read") {
+        return normalizedValue === "read-all";
+    }
+    return false;
+};
+/**
+ * Determine whether a permissions mapping satisfies a required permission
+ * level.
+ */
+const mappingPermissionSatisfies = (permissionsMapping, permissionName, requiredLevel) => {
+    const permissionValue = getScalarStringValue(getMappingPair(permissionsMapping, permissionName)?.value ?? null)?.trim();
+    if (permissionValue === undefined || permissionValue.length === 0) {
+        return false;
+    }
+    if (requiredLevel === "read") {
+        return permissionValue === "read" || permissionValue === "write";
+    }
+    return permissionValue === "write";
+};
+/** Determine whether a permissions node satisfies a required permission level. */
+const permissionsNodeSatisfies = (permissionsNode, permissionName, requiredLevel) => {
+    const scalarValue = getScalarStringValue(permissionsNode)?.trim();
+    if (scalarValue !== undefined && scalarValue.length > 0) {
+        return scalarPermissionSatisfies(scalarValue, requiredLevel);
+    }
+    const unwrappedPermissionsNode = unwrapYamlValue(permissionsNode);
+    if (unwrappedPermissionsNode?.type === "YAMLMapping") {
+        return mappingPermissionSatisfies(unwrappedPermissionsNode, permissionName, requiredLevel);
+    }
+    return false;
+};
+/** Determine whether a workflow/job has the required effective permission level. */
+export const hasRequiredWorkflowPermission = (root, job, permissionName, requiredLevel) => {
+    const jobPermissionsNode = getPermissionsNode(job.mapping);
+    if (jobPermissionsNode !== null) {
+        return permissionsNodeSatisfies(jobPermissionsNode, permissionName, requiredLevel);
+    }
+    return permissionsNodeSatisfies(getPermissionsNode(root), permissionName, requiredLevel);
+};
+/* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Re-enable readonly-parameter checks outside parser AST helper signatures. */
+//# sourceMappingURL=workflow-permissions.js.map

package/dist/_internal/workflow-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-permissions.js","sourceRoot":"","sources":["../../src/_internal/workflow-permissions.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,cAAc,EACd,oBAAoB,EACpB,eAAe,GAElB,MAAM,oBAAoB,CAAC;AAK5B,+DAA+D;AAC/D,MAAM,kBAAkB,GAAG,CACvB,OAAwB,EACiB,EAAE,CAC3C,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AAE1D,kFAAkF;AAClF,MAAM,yBAAyB,GAAG,CAC9B,WAAmB,EACnB,aAAsC,EAC/B,EAAE;IACT,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEzD,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,eAAe,KAAK,UAAU,CAAC;IAC1C,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CAC/B,kBAAmC,EACnC,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,eAAe,GAAG,oBAAoB,CACxC,cAAc,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAAE,KAAK,IAAI,IAAI,CACpE,EAAE,IAAI,EAAE,CAAC;IAEV,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO,CAAC;IACrE,CAAC;IAED,OAAO,eAAe,KAAK,OAAO,CAAC;AACvC,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,CAC7B,eAA0D,EAC1D,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,WAAW,GAAG,oBAAoB,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;IAElE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,yBAAyB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,wBAAwB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAElE,IAAI,wBAAwB,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,0BAA0B,CAC7B,wBAAwB,EACxB,cAAc,EACd,aAAa,CAChB,CAAC;IACN,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CACzC,IAAqB,EACrB,GAAqB,EACrB,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE3D,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,wBAAwB,CAC3B,kBAAkB,EAClB,cAAc,EACd,aAAa,CAChB,CAAC;IACN,CAAC;IAED,OAAO,wBAAwB,CAC3B,kBAAkB,CAAC,IAAI,CAAC,EACxB,cAAc,EACd,aAAa,CAChB,CAAC;AACN,CAAC,CAAC;AAEF,mJAAmJ"}

package/dist/_internal/yaml-fixes.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @packageDocumentation
+ * Shared range helpers for safe YAML/JSON text fixes.
+ */
+/** Read the indentation prefix of the line containing the provided offset. */
+export declare const getLineIndentation: (sourceText: string, offset: number) => string;
+/** Return the insertion point immediately after the line containing the offset. */
+export declare const getIndexAfterLine: (sourceText: string, offset: number) => number;
+/** Expand a node range to cover its entire containing line. */
+export declare const getEnclosingLineRemovalRange: (sourceText: string, range: readonly [number, number]) => [number, number];
+/** Safely remove a flow-style sequence entry and its adjacent delimiter. */
+export declare const getFlowSequenceEntryRemovalRange: (sourceText: string, range: readonly [number, number]) => [number, number];
+//# sourceMappingURL=yaml-fixes.d.ts.map

package/dist/_internal/yaml-fixes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-fixes.d.ts","sourceRoot":"","sources":["../../src/_internal/yaml-fixes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA8BH,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,GAC3B,YAAY,MAAM,EAClB,QAAQ,MAAM,KACf,MAYF,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,GAC1B,YAAY,MAAM,EAClB,QAAQ,MAAM,KACf,MAIF,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,4BAA4B,GACrC,YAAY,MAAM,EAClB,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,KACjC,CAAC,MAAM,EAAE,MAAM,CAYjB,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,gCAAgC,GACzC,YAAY,MAAM,EAClB,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,KACjC,CAAC,MAAM,EAAE,MAAM,CA6CjB,CAAC"}

package/dist/_internal/yaml-fixes.js

@@ -0,0 +1,77 @@
+/**
+ * @packageDocumentation
+ * Shared range helpers for safe YAML/JSON text fixes.
+ */
+/** Determine whether a character is horizontal whitespace. */
+const isHorizontalWhitespace = (character) => character === " " || character === "\t";
+/** Determine whether a character is any whitespace. */
+const isWhitespace = (character) => character === " " ||
+    character === "\t" ||
+    character === "\n" ||
+    character === "\r";
+/** Return the start index of the line containing the provided offset. */
+const getLineStartIndex = (sourceText, offset) => {
+    const previousLineBreakIndex = sourceText.lastIndexOf("\n", Math.max(0, offset - 1));
+    return previousLineBreakIndex === -1 ? 0 : previousLineBreakIndex + 1;
+};
+/** Return the end index of the line containing the provided offset. */
+const getLineEndIndex = (sourceText, offset) => {
+    const nextLineBreakIndex = sourceText.indexOf("\n", offset);
+    return nextLineBreakIndex === -1 ? sourceText.length : nextLineBreakIndex;
+};
+/** Read the indentation prefix of the line containing the provided offset. */
+export const getLineIndentation = (sourceText, offset) => {
+    const lineStart = getLineStartIndex(sourceText, offset);
+    let index = lineStart;
+    while (index < sourceText.length &&
+        isHorizontalWhitespace(sourceText[index])) {
+        index += 1;
+    }
+    return sourceText.slice(lineStart, index);
+};
+/** Return the insertion point immediately after the line containing the offset. */
+export const getIndexAfterLine = (sourceText, offset) => {
+    const lineEnd = getLineEndIndex(sourceText, offset);
+    return lineEnd === sourceText.length ? sourceText.length : lineEnd + 1;
+};
+/** Expand a node range to cover its entire containing line. */
+export const getEnclosingLineRemovalRange = (sourceText, range) => {
+    const previousLineBreakIndex = sourceText.lastIndexOf("\n", Math.max(0, range[0] - 1));
+    const start = previousLineBreakIndex === -1 ? 0 : previousLineBreakIndex + 1;
+    const nextLineBreakIndex = sourceText.indexOf("\n", range[1]);
+    const end = nextLineBreakIndex === -1 ? sourceText.length : nextLineBreakIndex + 1;
+    return [start, end];
+};
+/** Safely remove a flow-style sequence entry and its adjacent delimiter. */
+export const getFlowSequenceEntryRemovalRange = (sourceText, range) => {
+    let start = range[0];
+    let end = range[1];
+    while (start > 0 && isHorizontalWhitespace(sourceText[start - 1])) {
+        start -= 1;
+    }
+    while (end < sourceText.length && isHorizontalWhitespace(sourceText[end])) {
+        end += 1;
+    }
+    let nextIndex = end;
+    while (nextIndex < sourceText.length &&
+        isWhitespace(sourceText[nextIndex])) {
+        nextIndex += 1;
+    }
+    if (sourceText[nextIndex] === ",") {
+        end = nextIndex + 1;
+        while (end < sourceText.length &&
+            isHorizontalWhitespace(sourceText[end])) {
+            end += 1;
+        }
+        return [start, end];
+    }
+    let previousIndex = start - 1;
+    while (previousIndex >= 0 && isWhitespace(sourceText[previousIndex])) {
+        previousIndex -= 1;
+    }
+    if (sourceText[previousIndex] === ",") {
+        return [previousIndex, end];
+    }
+    return [start, end];
+};
+//# sourceMappingURL=yaml-fixes.js.map

package/dist/_internal/yaml-fixes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-fixes.js","sourceRoot":"","sources":["../../src/_internal/yaml-fixes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8DAA8D;AAC9D,MAAM,sBAAsB,GAAG,CAAC,SAA6B,EAAW,EAAE,CACtE,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,CAAC;AAE5C,uDAAuD;AACvD,MAAM,YAAY,GAAG,CAAC,SAA6B,EAAW,EAAE,CAC5D,SAAS,KAAK,GAAG;IACjB,SAAS,KAAK,IAAI;IAClB,SAAS,KAAK,IAAI;IAClB,SAAS,KAAK,IAAI,CAAC;AAEvB,yEAAyE;AACzE,MAAM,iBAAiB,GAAG,CAAC,UAAkB,EAAE,MAAc,EAAU,EAAE;IACrE,MAAM,sBAAsB,GAAG,UAAU,CAAC,WAAW,CACjD,IAAI,EACJ,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAC1B,CAAC;IAEF,OAAO,sBAAsB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAE,MAAc,EAAU,EAAE;IACnE,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE5D,OAAO,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC9E,CAAC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAC9B,UAAkB,EAClB,MAAc,EACR,EAAE;IACR,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,KAAK,GAAG,SAAS,CAAC;IAEtB,OACI,KAAK,GAAG,UAAU,CAAC,MAAM;QACzB,sBAAsB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAC3C,CAAC;QACC,KAAK,IAAI,CAAC,CAAC;IACf,CAAC;IAED,OAAO,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC7B,UAAkB,EAClB,MAAc,EACR,EAAE;IACR,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEpD,OAAO,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CACxC,UAAkB,EAClB,KAAgC,EAChB,EAAE;IAClB,MAAM,sBAAsB,GAAG,UAAU,CAAC,WAAW,CACjD,IAAI,EACJ,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAC5B,CAAC;IACF,MAAM,KAAK,GACP,sBAAsB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,CAAC;IACnE,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,GAAG,GACL,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,CAAC;IAE3E,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC5C,UAAkB,EAClB,KAAgC,EAChB,EAAE;IAClB,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnB,OAAO,KAAK,GAAG,CAAC,IAAI,sBAAsB,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,KAAK,IAAI,CAAC,CAAC;IACf,CAAC;IAED,OAAO,GAAG,GAAG,UAAU,CAAC,MAAM,IAAI,sBAAsB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,IAAI,CAAC,CAAC;IACb,CAAC;IAED,IAAI,SAAS,GAAG,GAAG,CAAC;IAEpB,OACI,SAAS,GAAG,UAAU,CAAC,MAAM;QAC7B,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EACrC,CAAC;QACC,SAAS,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;QAChC,GAAG,GAAG,SAAS,GAAG,CAAC,CAAC;QAEpB,OACI,GAAG,GAAG,UAAU,CAAC,MAAM;YACvB,sBAAsB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EACzC,CAAC;YACC,GAAG,IAAI,CAAC,CAAC;QACb,CAAC;QAED,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,aAAa,GAAG,KAAK,GAAG,CAAC,CAAC;IAE9B,OAAO,aAAa,IAAI,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACnE,aAAa,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,UAAU,CAAC,aAAa,CAAC,KAAK,GAAG,EAAE,CAAC;QACpC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxB,CAAC,CAAC"}