eslint-plugin-github-actions-2 1.0.4 → 1.0.5

package/dist/plugin.cjs

@@ -39,7 +39,7 @@ var yamlParser = __toESM(require("yaml-eslint-parser"), 1);
 var package_default = {
   $schema: "https://www.schemastore.org/package.json",
   name: "eslint-plugin-github-actions-2",
-  version: "1.0.4",
+  version: "1.0.5",
   private: false,
   description: "ESLint plugin for GitHub Actions workflow quality, reliability, and security rules.",
   keywords: [
@@ -717,7 +717,7 @@ var githubActionsConfigMetadataByName = {
     presetName: "github-actions:action-metadata"
   },
   all: {
-    description: "Enables every available rule published by this plugin across workflows, action metadata, workflow templates, and Dependabot configuration.",
+    description: "Enables the complete bundled rule set across workflows, action metadata, workflow templates, and Dependabot configuration, while leaving explicitly opt-in policy rules manual.",
     files: [
       ...WORKFLOW_FILE_GLOBS,
       ...ACTION_METADATA_FILE_GLOBS,
@@ -1432,6 +1432,9 @@ var rule = {
     const { allowedCasings, ignoredNames } = normalizeActionNameCasingOptions(option ?? void 0);
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -1560,6 +1563,9 @@ var rule2 = {
     const { allowedCasings, ignoredJobIds } = normalizeJobIdCasingOptions(option ?? void 0);
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -1667,6 +1673,9 @@ var rule3 = {
     const maxJobs = configuredMaxJobs >= 1 ? configuredMaxJobs : DEFAULT_MAX_JOBS;
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -1894,6 +1903,9 @@ var rule5 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -1945,6 +1957,9 @@ var rule6 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -2361,6 +2376,9 @@ var rule11 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -2525,6 +2543,9 @@ var rule14 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -2733,6 +2754,9 @@ var rule15 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -2957,6 +2981,9 @@ var rule17 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -3081,6 +3108,9 @@ var rule19 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -3517,6 +3547,9 @@ var rule23 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -3743,6 +3776,9 @@ var rule26 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -3834,6 +3870,9 @@ var rule27 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -3999,6 +4038,9 @@ var rule30 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -4043,6 +4085,9 @@ var rule31 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -4060,7 +4105,6 @@ var rule31 = {
   meta: {
     deprecated: false,
     docs: {
-      configs: ["github-actions.configs.all"],
       description: "disallow top-level workflow `permissions` when you want every job to declare its own token scope explicitly.",
       dialects: ["GitHub Actions workflow"],
       frozen: false,
@@ -4338,6 +4382,9 @@ var rule35 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -4538,6 +4585,9 @@ var rule36 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -4657,6 +4707,9 @@ var rule37 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -4858,6 +4911,9 @@ var rule40 = {
     };
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -4933,6 +4989,9 @@ var rule41 = {
     };
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -5035,6 +5094,9 @@ var rule43 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -5111,6 +5173,9 @@ var rule44 = {
     const { caseSensitive, extension } = normalizePreferFileExtensionOptions(option ?? void 0);
     return {
       Program(node) {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const actualExtensionWithDot = (0, import_node_path3.extname)(context.filename);
         if (actualExtensionWithDot.length === 0) {
           return;
@@ -5223,6 +5288,9 @@ var rule45 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -5351,6 +5419,9 @@ var rule46 = {
     const { allowDocker, allowedStyles, allowRepository, ignoredReferences } = normalizeStepUsesStyleOptions(option ?? void 0);
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -5648,6 +5719,9 @@ var rule50 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -5715,25 +5789,59 @@ var require_checkout_before_local_action_default = rule50;
 
 // dist/_internal/workflow-permissions.js
 var getPermissionsNode = (mapping) => getMappingPair(mapping, "permissions")?.value ?? null;
-var scalarPermissionSatisfies = (scalarValue, requiredLevel) => {
+var getScalarPermissionLevel = (scalarValue) => {
   const normalizedValue = scalarValue.trim().toLowerCase();
+  if (normalizedValue === "read-all") {
+    return "read";
+  }
   if (normalizedValue === "write-all") {
+    return "write";
+  }
+  return null;
+};
+var scalarPermissionSatisfies = (scalarValue, requiredLevel) => {
+  const permissionLevel = getScalarPermissionLevel(scalarValue);
+  if (permissionLevel === "write") {
     return true;
   }
   if (requiredLevel === "read") {
-    return normalizedValue === "read-all";
+    return permissionLevel === "read";
   }
   return false;
 };
-var mappingPermissionSatisfies = (permissionsMapping, permissionName, requiredLevel) => {
+var getMappingPermissionLevel = (permissionsMapping, permissionName) => {
   const permissionValue = getScalarStringValue(getMappingPair(permissionsMapping, permissionName)?.value ?? null)?.trim();
   if (permissionValue === void 0 || permissionValue.length === 0) {
+    return null;
+  }
+  if (permissionValue === "read") {
+    return "read";
+  }
+  if (permissionValue === "write") {
+    return "write";
+  }
+  return null;
+};
+var mappingPermissionSatisfies = (permissionsMapping, permissionName, requiredLevel) => {
+  const permissionLevel = getMappingPermissionLevel(permissionsMapping, permissionName);
+  if (permissionLevel === null) {
     return false;
   }
   if (requiredLevel === "read") {
-    return permissionValue === "read" || permissionValue === "write";
+    return permissionLevel === "read" || permissionLevel === "write";
+  }
+  return permissionLevel === "write";
+};
+var getPermissionsNodeLevel = (permissionsNode, permissionName) => {
+  const scalarValue = getScalarStringValue(permissionsNode)?.trim();
+  if (scalarValue !== void 0 && scalarValue.length > 0) {
+    return getScalarPermissionLevel(scalarValue);
   }
-  return permissionValue === "write";
+  const unwrappedPermissionsNode = unwrapYamlValue(permissionsNode);
+  if (unwrappedPermissionsNode?.type === "YAMLMapping") {
+    return getMappingPermissionLevel(unwrappedPermissionsNode, permissionName);
+  }
+  return null;
 };
 var permissionsNodeSatisfies = (permissionsNode, permissionName, requiredLevel) => {
   const scalarValue = getScalarStringValue(permissionsNode)?.trim();
@@ -5753,12 +5861,22 @@ var hasRequiredWorkflowPermission = (root, job, permissionName, requiredLevel) =
   }
   return permissionsNodeSatisfies(getPermissionsNode(root), permissionName, requiredLevel);
 };
+var hasExactWorkflowPermission = (root, job, permissionName, requiredLevel) => {
+  const jobPermissionsNode = getPermissionsNode(job.mapping);
+  if (jobPermissionsNode !== null) {
+    return getPermissionsNodeLevel(jobPermissionsNode, permissionName) === requiredLevel;
+  }
+  return getPermissionsNodeLevel(getPermissionsNode(root), permissionName) === requiredLevel;
+};
 
 // dist/rules/require-codeql-actions-read.js
 var rule51 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -5836,6 +5954,9 @@ var rule52 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null || getCodeqlInitSteps(root).length === 0) {
           return;
@@ -5894,6 +6015,9 @@ var rule53 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -5949,6 +6073,9 @@ var rule54 = {
   create(context) {
     return {
       Program(node) {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null || getCodeqlInitSteps(root).length === 0) {
           return;
@@ -5993,6 +6120,9 @@ var rule55 = {
   create(context) {
     return {
       Program(node) {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null || getCodeqlInitSteps(root).length === 0) {
           return;
@@ -6037,6 +6167,9 @@ var rule56 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -6213,6 +6346,9 @@ var rule59 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -6275,6 +6411,9 @@ var rule60 = {
   create(context) {
     return {
       Program(node) {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null || !hasDependabotAutomation(root)) {
           return;
@@ -6320,6 +6459,9 @@ var rule61 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null || !hasDependabotAutomation(root)) {
           return;
@@ -7466,6 +7608,9 @@ var rule81 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -7519,20 +7664,28 @@ var rule82 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null || !hasDependencyReviewAction(root)) {
           return;
         }
-        const permissionsMapping = getMappingValueAsMapping(root, "permissions");
-        const contentsPair = permissionsMapping === null ? null : getMappingPair(permissionsMapping, "contents");
-        const contentsValue = getScalarStringValue(contentsPair?.value ?? null)?.trim();
-        if (contentsValue === "read") {
-          return;
+        const seenJobIds = /* @__PURE__ */ new Set();
+        for (const step of getDependencyReviewActionSteps(root)) {
+          if (seenJobIds.has(step.job.id)) {
+            continue;
+          }
+          seenJobIds.add(step.job.id);
+          if (hasExactWorkflowPermission(root, step.job, "contents", "read")) {
+            continue;
+          }
+          context.report({
+            data: { jobId: step.job.id },
+            messageId: "missingContentsReadPermission",
+            node: step.job.idNode
+          });
         }
-        context.report({
-          messageId: "missingContentsReadPermission",
-          node: contentsPair?.value ?? contentsPair ?? permissionsMapping ?? root
-        });
       }
     };
   },
@@ -7544,7 +7697,7 @@ var rule82 = {
         "github-actions.configs.codeScanning",
         "github-actions.configs.security"
       ],
-      description: "require workflows using `actions/dependency-review-action` to set top-level `permissions.contents: read`.",
+      description: "require jobs using `actions/dependency-review-action` to grant effective `contents: read`.",
       dialects: ["GitHub Actions workflow"],
       frozen: false,
       recommended: false,
@@ -7554,7 +7707,7 @@ var rule82 = {
       url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-dependency-review-permissions-contents-read"
     },
     messages: {
-      missingContentsReadPermission: "Workflows using `actions/dependency-review-action` should set top-level `permissions.contents: read`."
+      missingContentsReadPermission: "Job '{{jobId}}' uses `actions/dependency-review-action` and should grant effective `contents: read` at the job or workflow level."
     },
     schema: [],
     type: "problem"
@@ -7567,6 +7720,9 @@ var rule83 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null || !hasDependencyReviewAction(root)) {
           return;
@@ -7612,6 +7768,9 @@ var rule84 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -7662,6 +7821,9 @@ var rule85 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -7777,6 +7939,9 @@ var rule86 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -7886,6 +8051,9 @@ var rule87 = {
     const maxMinutes = options?.maxMinutes ?? DEFAULT_MAX_MINUTES;
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -7998,6 +8166,9 @@ var rule88 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null || !hasTriggerEvent(root, "pull_request")) {
           return;
@@ -8070,6 +8241,9 @@ var rule89 = {
     };
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -8170,6 +8344,9 @@ var rule90 = {
     };
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -8253,6 +8430,9 @@ var rule91 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -8301,6 +8481,9 @@ var rule92 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -8351,6 +8534,9 @@ var rule93 = {
   create(context) {
     return {
       Program(node) {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null || getScorecardSteps(root).length === 0) {
           return;
@@ -8403,12 +8589,15 @@ var rule94 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
         }
         for (const step of getSecretScanningActionSteps(root)) {
-          if (hasRequiredWorkflowPermission(root, step.job, "contents", "read")) {
+          if (hasExactWorkflowPermission(root, step.job, "contents", "read")) {
             continue;
           }
           context.report({
@@ -8437,7 +8626,7 @@ var rule94 = {
       url: "https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/require-secret-scan-contents-read"
     },
     messages: {
-      missingContentsRead: "Job '{{jobId}}' runs a secret scanner and should grant `contents: read`."
+      missingContentsRead: "Job '{{jobId}}' runs a secret scanner and should grant effective `contents: read` at the job or workflow level."
     },
     schema: [],
     type: "problem"
@@ -8451,6 +8640,9 @@ var rule95 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -8521,6 +8713,9 @@ var rule96 = {
   create(context) {
     return {
       Program(node) {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null || !hasSecretScanningAction(root)) {
           return;
@@ -8876,6 +9071,9 @@ var rule102 = {
     };
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -8954,6 +9152,9 @@ var rule103 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -9010,6 +9211,9 @@ var rule104 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -9090,6 +9294,9 @@ var rule105 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -9179,6 +9386,9 @@ var rule106 = {
     const requireCancelInProgress = options?.requireCancelInProgress ?? true;
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -9324,6 +9534,9 @@ var rule107 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -9435,6 +9648,9 @@ var rule108 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -9605,6 +9821,9 @@ var rule110 = {
   create(context) {
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -9818,6 +10037,9 @@ var rule113 = {
     };
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -10050,6 +10272,9 @@ var rule114 = {
     };
     return {
       Program() {
+        if (!isWorkflowFile(context.filename)) {
+          return;
+        }
         const root = getWorkflowRoot(context);
         if (root === null) {
           return;
@@ -10266,7 +10491,7 @@ var getRuleConfigReferences = (ruleName, rule115) => {
   const references = docs?.configs;
   const referenceList = Array.isArray(references) ? references : [references];
   if (referenceList.length === 0 || referenceList[0] === void 0) {
-    throw new TypeError(`Rule '${ruleName}' is missing docs.configs preset metadata.`);
+    return [];
   }
   for (const reference of referenceList) {
     if (typeof reference !== "string" || !isGithubActionsConfigReference(reference)) {