eslint-plugin-github-actions-2 1.0.4 → 1.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (217) hide show
  1. package/README.md +127 -127
  2. package/dist/_internal/github-actions-config-references.js +1 -1
  3. package/dist/_internal/github-actions-config-references.js.map +1 -1
  4. package/dist/_internal/rule-docs.d.ts +1 -1
  5. package/dist/_internal/rule-docs.d.ts.map +1 -1
  6. package/dist/_internal/workflow-permissions.d.ts +2 -0
  7. package/dist/_internal/workflow-permissions.d.ts.map +1 -1
  8. package/dist/_internal/workflow-permissions.js +54 -7
  9. package/dist/_internal/workflow-permissions.js.map +1 -1
  10. package/dist/plugin.cjs +276 -24
  11. package/dist/plugin.cjs.map +2 -2
  12. package/dist/plugin.d.ts.map +1 -1
  13. package/dist/plugin.js +1 -1
  14. package/dist/plugin.js.map +1 -1
  15. package/dist/rules/action-name-casing.d.ts.map +1 -1
  16. package/dist/rules/action-name-casing.js +4 -0
  17. package/dist/rules/action-name-casing.js.map +1 -1
  18. package/dist/rules/job-id-casing.d.ts.map +1 -1
  19. package/dist/rules/job-id-casing.js +4 -0
  20. package/dist/rules/job-id-casing.js.map +1 -1
  21. package/dist/rules/max-jobs-per-action.d.ts.map +1 -1
  22. package/dist/rules/max-jobs-per-action.js +4 -0
  23. package/dist/rules/max-jobs-per-action.js.map +1 -1
  24. package/dist/rules/no-codeql-autobuild-for-javascript-typescript.d.ts.map +1 -1
  25. package/dist/rules/no-codeql-autobuild-for-javascript-typescript.js +4 -0
  26. package/dist/rules/no-codeql-autobuild-for-javascript-typescript.js.map +1 -1
  27. package/dist/rules/no-codeql-javascript-typescript-split-language-matrix.d.ts.map +1 -1
  28. package/dist/rules/no-codeql-javascript-typescript-split-language-matrix.js +4 -0
  29. package/dist/rules/no-codeql-javascript-typescript-split-language-matrix.js.map +1 -1
  30. package/dist/rules/no-external-job.d.ts.map +1 -1
  31. package/dist/rules/no-external-job.js +4 -0
  32. package/dist/rules/no-external-job.js.map +1 -1
  33. package/dist/rules/no-inherit-secrets.d.ts.map +1 -1
  34. package/dist/rules/no-inherit-secrets.js +4 -0
  35. package/dist/rules/no-inherit-secrets.js.map +1 -1
  36. package/dist/rules/no-invalid-concurrency-context.d.ts.map +1 -1
  37. package/dist/rules/no-invalid-concurrency-context.js +4 -0
  38. package/dist/rules/no-invalid-concurrency-context.js.map +1 -1
  39. package/dist/rules/no-invalid-reusable-workflow-job-key.d.ts.map +1 -1
  40. package/dist/rules/no-invalid-reusable-workflow-job-key.js +4 -0
  41. package/dist/rules/no-invalid-reusable-workflow-job-key.js.map +1 -1
  42. package/dist/rules/no-invalid-workflow-call-output-value.d.ts.map +1 -1
  43. package/dist/rules/no-invalid-workflow-call-output-value.js +4 -0
  44. package/dist/rules/no-invalid-workflow-call-output-value.js.map +1 -1
  45. package/dist/rules/no-pr-head-checkout-in-pull-request-target.d.ts.map +1 -1
  46. package/dist/rules/no-pr-head-checkout-in-pull-request-target.js +4 -0
  47. package/dist/rules/no-pr-head-checkout-in-pull-request-target.js.map +1 -1
  48. package/dist/rules/no-secrets-in-if.d.ts.map +1 -1
  49. package/dist/rules/no-secrets-in-if.js +4 -0
  50. package/dist/rules/no-secrets-in-if.js.map +1 -1
  51. package/dist/rules/no-self-hosted-runner-on-fork-pr-events.d.ts.map +1 -1
  52. package/dist/rules/no-self-hosted-runner-on-fork-pr-events.js +4 -0
  53. package/dist/rules/no-self-hosted-runner-on-fork-pr-events.js.map +1 -1
  54. package/dist/rules/no-top-level-env.d.ts.map +1 -1
  55. package/dist/rules/no-top-level-env.js +4 -0
  56. package/dist/rules/no-top-level-env.js.map +1 -1
  57. package/dist/rules/no-top-level-permissions.d.ts.map +1 -1
  58. package/dist/rules/no-top-level-permissions.js +4 -1
  59. package/dist/rules/no-top-level-permissions.js.map +1 -1
  60. package/dist/rules/no-unknown-job-output-reference.d.ts.map +1 -1
  61. package/dist/rules/no-unknown-job-output-reference.js +4 -0
  62. package/dist/rules/no-unknown-job-output-reference.js.map +1 -1
  63. package/dist/rules/no-unknown-step-reference.d.ts.map +1 -1
  64. package/dist/rules/no-unknown-step-reference.js +4 -0
  65. package/dist/rules/no-unknown-step-reference.js.map +1 -1
  66. package/dist/rules/no-untrusted-input-in-run.d.ts.map +1 -1
  67. package/dist/rules/no-untrusted-input-in-run.js +4 -0
  68. package/dist/rules/no-untrusted-input-in-run.js.map +1 -1
  69. package/dist/rules/no-write-all-permissions.d.ts.map +1 -1
  70. package/dist/rules/no-write-all-permissions.js +4 -0
  71. package/dist/rules/no-write-all-permissions.js.map +1 -1
  72. package/dist/rules/pin-action-shas.d.ts.map +1 -1
  73. package/dist/rules/pin-action-shas.js +4 -0
  74. package/dist/rules/pin-action-shas.js.map +1 -1
  75. package/dist/rules/prefer-fail-fast.d.ts.map +1 -1
  76. package/dist/rules/prefer-fail-fast.js +4 -0
  77. package/dist/rules/prefer-fail-fast.js.map +1 -1
  78. package/dist/rules/prefer-file-extension.d.ts.map +1 -1
  79. package/dist/rules/prefer-file-extension.js +4 -0
  80. package/dist/rules/prefer-file-extension.js.map +1 -1
  81. package/dist/rules/prefer-inputs-context.d.ts.map +1 -1
  82. package/dist/rules/prefer-inputs-context.js +4 -0
  83. package/dist/rules/prefer-inputs-context.js.map +1 -1
  84. package/dist/rules/prefer-step-uses-style.d.ts.map +1 -1
  85. package/dist/rules/prefer-step-uses-style.js +4 -0
  86. package/dist/rules/prefer-step-uses-style.js.map +1 -1
  87. package/dist/rules/require-checkout-before-local-action.d.ts.map +1 -1
  88. package/dist/rules/require-checkout-before-local-action.js +4 -0
  89. package/dist/rules/require-checkout-before-local-action.js.map +1 -1
  90. package/dist/rules/require-codeql-actions-read.d.ts.map +1 -1
  91. package/dist/rules/require-codeql-actions-read.js +4 -0
  92. package/dist/rules/require-codeql-actions-read.js.map +1 -1
  93. package/dist/rules/require-codeql-branch-filters.d.ts.map +1 -1
  94. package/dist/rules/require-codeql-branch-filters.js +4 -0
  95. package/dist/rules/require-codeql-branch-filters.js.map +1 -1
  96. package/dist/rules/require-codeql-category-when-language-matrix.d.ts.map +1 -1
  97. package/dist/rules/require-codeql-category-when-language-matrix.js +4 -0
  98. package/dist/rules/require-codeql-category-when-language-matrix.js.map +1 -1
  99. package/dist/rules/require-codeql-pull-request-trigger.d.ts.map +1 -1
  100. package/dist/rules/require-codeql-pull-request-trigger.js +4 -0
  101. package/dist/rules/require-codeql-pull-request-trigger.js.map +1 -1
  102. package/dist/rules/require-codeql-schedule.d.ts.map +1 -1
  103. package/dist/rules/require-codeql-schedule.js +4 -0
  104. package/dist/rules/require-codeql-schedule.js.map +1 -1
  105. package/dist/rules/require-codeql-security-events-write.d.ts.map +1 -1
  106. package/dist/rules/require-codeql-security-events-write.js +4 -0
  107. package/dist/rules/require-codeql-security-events-write.js.map +1 -1
  108. package/dist/rules/require-dependabot-automation-permissions.d.ts.map +1 -1
  109. package/dist/rules/require-dependabot-automation-permissions.js +4 -0
  110. package/dist/rules/require-dependabot-automation-permissions.js.map +1 -1
  111. package/dist/rules/require-dependabot-automation-pull-request-trigger.d.ts.map +1 -1
  112. package/dist/rules/require-dependabot-automation-pull-request-trigger.js +4 -0
  113. package/dist/rules/require-dependabot-automation-pull-request-trigger.js.map +1 -1
  114. package/dist/rules/require-dependabot-bot-actor-guard.d.ts.map +1 -1
  115. package/dist/rules/require-dependabot-bot-actor-guard.js +4 -0
  116. package/dist/rules/require-dependabot-bot-actor-guard.js.map +1 -1
  117. package/dist/rules/require-dependabot-open-pull-requests-limit.d.ts.map +1 -1
  118. package/dist/rules/require-dependabot-open-pull-requests-limit.js +32 -2
  119. package/dist/rules/require-dependabot-open-pull-requests-limit.js.map +1 -1
  120. package/dist/rules/require-dependency-review-fail-on-severity.d.ts.map +1 -1
  121. package/dist/rules/require-dependency-review-fail-on-severity.js +4 -0
  122. package/dist/rules/require-dependency-review-fail-on-severity.js.map +1 -1
  123. package/dist/rules/require-dependency-review-permissions-contents-read.d.ts.map +1 -1
  124. package/dist/rules/require-dependency-review-permissions-contents-read.js +23 -18
  125. package/dist/rules/require-dependency-review-permissions-contents-read.js.map +1 -1
  126. package/dist/rules/require-dependency-review-pull-request-trigger.d.ts.map +1 -1
  127. package/dist/rules/require-dependency-review-pull-request-trigger.js +4 -0
  128. package/dist/rules/require-dependency-review-pull-request-trigger.js.map +1 -1
  129. package/dist/rules/require-fetch-metadata-github-token.d.ts.map +1 -1
  130. package/dist/rules/require-fetch-metadata-github-token.js +4 -0
  131. package/dist/rules/require-fetch-metadata-github-token.js.map +1 -1
  132. package/dist/rules/require-job-name.d.ts.map +1 -1
  133. package/dist/rules/require-job-name.js +4 -0
  134. package/dist/rules/require-job-name.js.map +1 -1
  135. package/dist/rules/require-job-step-name.d.ts.map +1 -1
  136. package/dist/rules/require-job-step-name.js +4 -0
  137. package/dist/rules/require-job-step-name.js.map +1 -1
  138. package/dist/rules/require-job-timeout-minutes.d.ts.map +1 -1
  139. package/dist/rules/require-job-timeout-minutes.js +4 -0
  140. package/dist/rules/require-job-timeout-minutes.js.map +1 -1
  141. package/dist/rules/require-merge-group-trigger.d.ts.map +1 -1
  142. package/dist/rules/require-merge-group-trigger.js +4 -0
  143. package/dist/rules/require-merge-group-trigger.js.map +1 -1
  144. package/dist/rules/require-pull-request-target-branches.d.ts.map +1 -1
  145. package/dist/rules/require-pull-request-target-branches.js +4 -0
  146. package/dist/rules/require-pull-request-target-branches.js.map +1 -1
  147. package/dist/rules/require-run-step-shell.d.ts.map +1 -1
  148. package/dist/rules/require-run-step-shell.js +4 -0
  149. package/dist/rules/require-run-step-shell.js.map +1 -1
  150. package/dist/rules/require-sarif-upload-security-events-write.d.ts.map +1 -1
  151. package/dist/rules/require-sarif-upload-security-events-write.js +4 -0
  152. package/dist/rules/require-sarif-upload-security-events-write.js.map +1 -1
  153. package/dist/rules/require-scorecard-results-format-sarif.d.ts.map +1 -1
  154. package/dist/rules/require-scorecard-results-format-sarif.js +4 -0
  155. package/dist/rules/require-scorecard-results-format-sarif.js.map +1 -1
  156. package/dist/rules/require-scorecard-upload-sarif-step.d.ts.map +1 -1
  157. package/dist/rules/require-scorecard-upload-sarif-step.js +4 -0
  158. package/dist/rules/require-scorecard-upload-sarif-step.js.map +1 -1
  159. package/dist/rules/require-secret-scan-contents-read.d.ts.map +1 -1
  160. package/dist/rules/require-secret-scan-contents-read.js +7 -3
  161. package/dist/rules/require-secret-scan-contents-read.js.map +1 -1
  162. package/dist/rules/require-secret-scan-fetch-depth-zero.d.ts.map +1 -1
  163. package/dist/rules/require-secret-scan-fetch-depth-zero.js +4 -0
  164. package/dist/rules/require-secret-scan-fetch-depth-zero.js.map +1 -1
  165. package/dist/rules/require-secret-scan-schedule.d.ts.map +1 -1
  166. package/dist/rules/require-secret-scan-schedule.js +4 -0
  167. package/dist/rules/require-secret-scan-schedule.js.map +1 -1
  168. package/dist/rules/require-trigger-types.d.ts.map +1 -1
  169. package/dist/rules/require-trigger-types.js +4 -0
  170. package/dist/rules/require-trigger-types.js.map +1 -1
  171. package/dist/rules/require-trufflehog-verified-results-mode.d.ts.map +1 -1
  172. package/dist/rules/require-trufflehog-verified-results-mode.js +4 -0
  173. package/dist/rules/require-trufflehog-verified-results-mode.js.map +1 -1
  174. package/dist/rules/require-workflow-call-input-type.d.ts.map +1 -1
  175. package/dist/rules/require-workflow-call-input-type.js +4 -0
  176. package/dist/rules/require-workflow-call-input-type.js.map +1 -1
  177. package/dist/rules/require-workflow-call-output-value.d.ts.map +1 -1
  178. package/dist/rules/require-workflow-call-output-value.js +4 -0
  179. package/dist/rules/require-workflow-call-output-value.js.map +1 -1
  180. package/dist/rules/require-workflow-concurrency.d.ts.map +1 -1
  181. package/dist/rules/require-workflow-concurrency.js +4 -0
  182. package/dist/rules/require-workflow-concurrency.js.map +1 -1
  183. package/dist/rules/require-workflow-dispatch-input-type.d.ts.map +1 -1
  184. package/dist/rules/require-workflow-dispatch-input-type.js +4 -0
  185. package/dist/rules/require-workflow-dispatch-input-type.js.map +1 -1
  186. package/dist/rules/require-workflow-interface-description.d.ts.map +1 -1
  187. package/dist/rules/require-workflow-interface-description.js +4 -0
  188. package/dist/rules/require-workflow-interface-description.js.map +1 -1
  189. package/dist/rules/require-workflow-run-branches.d.ts.map +1 -1
  190. package/dist/rules/require-workflow-run-branches.js +4 -0
  191. package/dist/rules/require-workflow-run-branches.js.map +1 -1
  192. package/dist/rules/valid-timeout-minutes.d.ts.map +1 -1
  193. package/dist/rules/valid-timeout-minutes.js +4 -0
  194. package/dist/rules/valid-timeout-minutes.js.map +1 -1
  195. package/dist/rules/valid-trigger-events.d.ts.map +1 -1
  196. package/dist/rules/valid-trigger-events.js +4 -0
  197. package/dist/rules/valid-trigger-events.js.map +1 -1
  198. package/docs/rules/guides/authoring-rules.md +34 -0
  199. package/docs/rules/guides/docs-authoring.md +34 -0
  200. package/docs/rules/guides/index.md +15 -0
  201. package/docs/rules/guides/testing-rules.md +34 -0
  202. package/docs/rules/no-top-level-permissions.md +4 -4
  203. package/docs/rules/presets/action-metadata.md +8 -8
  204. package/docs/rules/presets/all.md +123 -124
  205. package/docs/rules/presets/code-scanning.md +8 -8
  206. package/docs/rules/presets/dependabot.md +8 -8
  207. package/docs/rules/presets/index.md +119 -123
  208. package/docs/rules/presets/recommended.md +8 -8
  209. package/docs/rules/presets/security.md +8 -8
  210. package/docs/rules/presets/strict.md +8 -8
  211. package/docs/rules/presets/workflow-template-properties.md +8 -8
  212. package/docs/rules/presets/workflow-templates.md +8 -8
  213. package/docs/rules/require-dependabot-open-pull-requests-limit.md +21 -4
  214. package/docs/rules/require-dependency-review-permissions-contents-read.md +15 -4
  215. package/docs/rules/require-secret-scan-contents-read.md +10 -2
  216. package/docs/rules/require-workflow-permissions.md +4 -4
  217. package/package.json +1 -1
@@ -37,7 +37,7 @@ export const githubActionsConfigMetadataByName = {
37
37
  presetName: "github-actions:action-metadata",
38
38
  },
39
39
  all: {
40
- description: "Enables every available rule published by this plugin across workflows, action metadata, workflow templates, and Dependabot configuration.",
40
+ description: "Enables the complete bundled rule set across workflows, action metadata, workflow templates, and Dependabot configuration, while leaving explicitly opt-in policy rules manual.",
41
41
  files: [
42
42
  ...WORKFLOW_FILE_GLOBS,
43
43
  ...ACTION_METADATA_FILE_GLOBS,
@@ -1 +1 @@
1
- {"version":3,"file":"github-actions-config-references.js","sourceRoot":"","sources":["../../src/_internal/github-actions-config-references.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACH,0BAA0B,EAC1B,qBAAqB,EACrB,4BAA4B,EAC5B,uCAAuC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACpC,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,4BAA4B;IAC5B,mBAAmB;IACnB,aAAa;IACb,UAAU;IACV,QAAQ;IACR,KAAK;CACC,CAAC;AAKX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAE3C;IACA,uCAAuC,EAAE,gBAAgB;IACzD,4BAA4B,EAAE,KAAK;IACnC,qCAAqC,EAAE,cAAc;IACrD,mCAAmC,EAAE,YAAY;IACjD,oCAAoC,EAAE,aAAa;IACnD,iCAAiC,EAAE,UAAU;IAC7C,+BAA+B,EAAE,QAAQ;IACzC,mDAAmD,EAC/C,4BAA4B;IAChC,0CAA0C,EAAE,mBAAmB;CACP,CAAC;AAM7D,yEAAyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAU1C;IACA,cAAc,EAAE;QACZ,WAAW,EACP,mFAAmF;QACvF,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,gCAAgC;KAC/C;IACD,GAAG,EAAE;QACD,WAAW,EACP,4IAA4I;QAChJ,KAAK,EAAE;YACH,GAAG,mBAAmB;YACtB,GAAG,0BAA0B;YAC7B,GAAG,qBAAqB;YACxB,GAAG,4BAA4B;SAClC;QACD,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,oBAAoB;KACnC;IACD,YAAY,EAAE;QACV,WAAW,EACP,kHAAkH;QACtH,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,8BAA8B;KAC7C;IACD,UAAU,EAAE;QACR,WAAW,EACP,4FAA4F;QAChG,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,2BAA2B;KAC1C;IACD,WAAW,EAAE;QACT,WAAW,EACP,6EAA6E;QACjF,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,4BAA4B;KAC3C;IACD,QAAQ,EAAE;QACN,WAAW,EACP,8EAA8E;QAClF,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,yBAAyB;KACxC;IACD,MAAM,EAAE;QACJ,WAAW,EACP,iEAAiE;QACrE,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,uBAAuB;KACtC;IACD,0BAA0B,EAAE;QACxB,WAAW,EACP,8EAA8E;QAClF,KAAK,EAAE,uCAAuC;QAC9C,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,6CAA6C;KAC5D;IACD,iBAAiB,EAAE;QACf,WAAW,EACP,8EAA8E;QAClF,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,mCAAmC;KAClD;CACK,CAAC"}
1
+ {"version":3,"file":"github-actions-config-references.js","sourceRoot":"","sources":["../../src/_internal/github-actions-config-references.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACH,0BAA0B,EAC1B,qBAAqB,EACrB,4BAA4B,EAC5B,uCAAuC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACpC,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,4BAA4B;IAC5B,mBAAmB;IACnB,aAAa;IACb,UAAU;IACV,QAAQ;IACR,KAAK;CACC,CAAC;AAKX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAE3C;IACA,uCAAuC,EAAE,gBAAgB;IACzD,4BAA4B,EAAE,KAAK;IACnC,qCAAqC,EAAE,cAAc;IACrD,mCAAmC,EAAE,YAAY;IACjD,oCAAoC,EAAE,aAAa;IACnD,iCAAiC,EAAE,UAAU;IAC7C,+BAA+B,EAAE,QAAQ;IACzC,mDAAmD,EAC/C,4BAA4B;IAChC,0CAA0C,EAAE,mBAAmB;CACP,CAAC;AAM7D,yEAAyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAU1C;IACA,cAAc,EAAE;QACZ,WAAW,EACP,mFAAmF;QACvF,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,gCAAgC;KAC/C;IACD,GAAG,EAAE;QACD,WAAW,EACP,iLAAiL;QACrL,KAAK,EAAE;YACH,GAAG,mBAAmB;YACtB,GAAG,0BAA0B;YAC7B,GAAG,qBAAqB;YACxB,GAAG,4BAA4B;SAClC;QACD,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,oBAAoB;KACnC;IACD,YAAY,EAAE;QACV,WAAW,EACP,kHAAkH;QACtH,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,8BAA8B;KAC7C;IACD,UAAU,EAAE;QACR,WAAW,EACP,4FAA4F;QAChG,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,2BAA2B;KAC1C;IACD,WAAW,EAAE;QACT,WAAW,EACP,6EAA6E;QACjF,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,4BAA4B;KAC3C;IACD,QAAQ,EAAE;QACN,WAAW,EACP,8EAA8E;QAClF,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,yBAAyB;KACxC;IACD,MAAM,EAAE;QACJ,WAAW,EACP,iEAAiE;QACrE,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,uBAAuB;KACtC;IACD,0BAA0B,EAAE;QACxB,WAAW,EACP,8EAA8E;QAClF,KAAK,EAAE,uCAAuC;QAC9C,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,6CAA6C;KAC5D;IACD,iBAAiB,EAAE;QACf,WAAW,EACP,8EAA8E;QAClF,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,mCAAmC;KAClD;CACK,CAAC"}
@@ -6,7 +6,7 @@ import type { Rule } from "eslint";
6
6
  import type { GithubActionsConfigReference } from "./github-actions-config-references.js";
7
7
  /** Custom docs metadata stored alongside each ESLint rule definition. */
8
8
  export type GithubActionsRuleDocs = Rule.RuleMetaData["docs"] & {
9
- readonly configs: GithubActionsConfigReference | readonly GithubActionsConfigReference[];
9
+ readonly configs?: GithubActionsConfigReference | readonly GithubActionsConfigReference[];
10
10
  readonly recommended: boolean;
11
11
  readonly requiresTypeChecking: boolean;
12
12
  readonly ruleId: `R${number}`;
@@ -1 +1 @@
1
- {"version":3,"file":"rule-docs.d.ts","sourceRoot":"","sources":["../../src/_internal/rule-docs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEnC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAE1F,yEAAyE;AACzE,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG;IAC5D,QAAQ,CAAC,OAAO,EACV,4BAA4B,GAC5B,SAAS,4BAA4B,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB,CAAC"}
1
+ {"version":3,"file":"rule-docs.d.ts","sourceRoot":"","sources":["../../src/_internal/rule-docs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEnC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAE1F,yEAAyE;AACzE,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG;IAC5D,QAAQ,CAAC,OAAO,CAAC,EACX,4BAA4B,GAC5B,SAAS,4BAA4B,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB,CAAC"}
@@ -8,4 +8,6 @@ import { type WorkflowJobEntry } from "./workflow-yaml.js";
8
8
  export type WorkflowPermissionLevel = "read" | "write";
9
9
  /** Determine whether a workflow/job has the required effective permission level. */
10
10
  export declare const hasRequiredWorkflowPermission: (root: AST.YAMLMapping, job: WorkflowJobEntry, permissionName: string, requiredLevel: WorkflowPermissionLevel) => boolean;
11
+ /** Determine whether a workflow/job has an exact effective permission level. */
12
+ export declare const hasExactWorkflowPermission: (root: AST.YAMLMapping, job: WorkflowJobEntry, permissionName: string, requiredLevel: WorkflowPermissionLevel) => boolean;
11
13
  //# sourceMappingURL=workflow-permissions.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"workflow-permissions.d.ts","sourceRoot":"","sources":["../../src/_internal/workflow-permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAIH,KAAK,gBAAgB,EACxB,MAAM,oBAAoB,CAAC;AAE5B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,CAAC;AA2EvD,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,GACtC,MAAM,GAAG,CAAC,WAAW,EACrB,KAAK,gBAAgB,EACrB,gBAAgB,MAAM,EACtB,eAAe,uBAAuB,KACvC,OAgBF,CAAC"}
1
+ {"version":3,"file":"workflow-permissions.d.ts","sourceRoot":"","sources":["../../src/_internal/workflow-permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAIH,KAAK,gBAAgB,EACxB,MAAM,oBAAoB,CAAC;AAE5B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,CAAC;AA6IvD,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,GACtC,MAAM,GAAG,CAAC,WAAW,EACrB,KAAK,gBAAgB,EACrB,gBAAgB,MAAM,EACtB,eAAe,uBAAuB,KACvC,OAgBF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,GACnC,MAAM,GAAG,CAAC,WAAW,EACrB,KAAK,gBAAgB,EACrB,gBAAgB,MAAM,EACtB,eAAe,uBAAuB,KACvC,OAcF,CAAC"}
@@ -1,30 +1,67 @@
1
1
  import { getMappingPair, getScalarStringValue, unwrapYamlValue, } from "./workflow-yaml.js";
2
2
  /** Read the permissions node for a workflow or job mapping. */
3
3
  const getPermissionsNode = (mapping) => getMappingPair(mapping, "permissions")?.value ?? null;
4
- /** Determine whether a permissions scalar satisfies the required access level. */
5
- const scalarPermissionSatisfies = (scalarValue, requiredLevel) => {
4
+ /** Convert a scalar permissions shorthand into an exact effective level. */
5
+ const getScalarPermissionLevel = (scalarValue) => {
6
6
  const normalizedValue = scalarValue.trim().toLowerCase();
7
+ if (normalizedValue === "read-all") {
8
+ return "read";
9
+ }
7
10
  if (normalizedValue === "write-all") {
11
+ return "write";
12
+ }
13
+ return null;
14
+ };
15
+ /** Determine whether a permissions scalar satisfies the required access level. */
16
+ const scalarPermissionSatisfies = (scalarValue, requiredLevel) => {
17
+ const permissionLevel = getScalarPermissionLevel(scalarValue);
18
+ if (permissionLevel === "write") {
8
19
  return true;
9
20
  }
10
21
  if (requiredLevel === "read") {
11
- return normalizedValue === "read-all";
22
+ return permissionLevel === "read";
12
23
  }
13
24
  return false;
14
25
  };
26
+ /** Resolve an exact permission level from a permissions mapping. */
27
+ const getMappingPermissionLevel = (permissionsMapping, permissionName) => {
28
+ const permissionValue = getScalarStringValue(getMappingPair(permissionsMapping, permissionName)?.value ?? null)?.trim();
29
+ if (permissionValue === undefined || permissionValue.length === 0) {
30
+ return null;
31
+ }
32
+ if (permissionValue === "read") {
33
+ return "read";
34
+ }
35
+ if (permissionValue === "write") {
36
+ return "write";
37
+ }
38
+ return null;
39
+ };
15
40
  /**
16
41
  * Determine whether a permissions mapping satisfies a required permission
17
42
  * level.
18
43
  */
19
44
  const mappingPermissionSatisfies = (permissionsMapping, permissionName, requiredLevel) => {
20
- const permissionValue = getScalarStringValue(getMappingPair(permissionsMapping, permissionName)?.value ?? null)?.trim();
21
- if (permissionValue === undefined || permissionValue.length === 0) {
45
+ const permissionLevel = getMappingPermissionLevel(permissionsMapping, permissionName);
46
+ if (permissionLevel === null) {
22
47
  return false;
23
48
  }
24
49
  if (requiredLevel === "read") {
25
- return permissionValue === "read" || permissionValue === "write";
50
+ return permissionLevel === "read" || permissionLevel === "write";
26
51
  }
27
- return permissionValue === "write";
52
+ return permissionLevel === "write";
53
+ };
54
+ /** Resolve the exact permission level declared by a permissions node. */
55
+ const getPermissionsNodeLevel = (permissionsNode, permissionName) => {
56
+ const scalarValue = getScalarStringValue(permissionsNode)?.trim();
57
+ if (scalarValue !== undefined && scalarValue.length > 0) {
58
+ return getScalarPermissionLevel(scalarValue);
59
+ }
60
+ const unwrappedPermissionsNode = unwrapYamlValue(permissionsNode);
61
+ if (unwrappedPermissionsNode?.type === "YAMLMapping") {
62
+ return getMappingPermissionLevel(unwrappedPermissionsNode, permissionName);
63
+ }
64
+ return null;
28
65
  };
29
66
  /** Determine whether a permissions node satisfies a required permission level. */
30
67
  const permissionsNodeSatisfies = (permissionsNode, permissionName, requiredLevel) => {
@@ -46,5 +83,15 @@ export const hasRequiredWorkflowPermission = (root, job, permissionName, require
46
83
  }
47
84
  return permissionsNodeSatisfies(getPermissionsNode(root), permissionName, requiredLevel);
48
85
  };
86
+ /** Determine whether a workflow/job has an exact effective permission level. */
87
+ export const hasExactWorkflowPermission = (root, job, permissionName, requiredLevel) => {
88
+ const jobPermissionsNode = getPermissionsNode(job.mapping);
89
+ if (jobPermissionsNode !== null) {
90
+ return (getPermissionsNodeLevel(jobPermissionsNode, permissionName) ===
91
+ requiredLevel);
92
+ }
93
+ return (getPermissionsNodeLevel(getPermissionsNode(root), permissionName) ===
94
+ requiredLevel);
95
+ };
49
96
  /* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Re-enable readonly-parameter checks outside parser AST helper signatures. */
50
97
  //# sourceMappingURL=workflow-permissions.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"workflow-permissions.js","sourceRoot":"","sources":["../../src/_internal/workflow-permissions.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,cAAc,EACd,oBAAoB,EACpB,eAAe,GAElB,MAAM,oBAAoB,CAAC;AAK5B,+DAA+D;AAC/D,MAAM,kBAAkB,GAAG,CACvB,OAAwB,EACiB,EAAE,CAC3C,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AAE1D,kFAAkF;AAClF,MAAM,yBAAyB,GAAG,CAC9B,WAAmB,EACnB,aAAsC,EAC/B,EAAE;IACT,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEzD,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,eAAe,KAAK,UAAU,CAAC;IAC1C,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CAC/B,kBAAmC,EACnC,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,eAAe,GAAG,oBAAoB,CACxC,cAAc,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAAE,KAAK,IAAI,IAAI,CACpE,EAAE,IAAI,EAAE,CAAC;IAEV,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO,CAAC;IACrE,CAAC;IAED,OAAO,eAAe,KAAK,OAAO,CAAC;AACvC,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,CAC7B,eAA0D,EAC1D,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,WAAW,GAAG,oBAAoB,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;IAElE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,yBAAyB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,wBAAwB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAElE,IAAI,wBAAwB,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,0BAA0B,CAC7B,wBAAwB,EACxB,cAAc,EACd,aAAa,CAChB,CAAC;IACN,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CACzC,IAAqB,EACrB,GAAqB,EACrB,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE3D,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,wBAAwB,CAC3B,kBAAkB,EAClB,cAAc,EACd,aAAa,CAChB,CAAC;IACN,CAAC;IAED,OAAO,wBAAwB,CAC3B,kBAAkB,CAAC,IAAI,CAAC,EACxB,cAAc,EACd,aAAa,CAChB,CAAC;AACN,CAAC,CAAC;AAEF,mJAAmJ"}
1
+ {"version":3,"file":"workflow-permissions.js","sourceRoot":"","sources":["../../src/_internal/workflow-permissions.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,cAAc,EACd,oBAAoB,EACpB,eAAe,GAElB,MAAM,oBAAoB,CAAC;AAQ5B,+DAA+D;AAC/D,MAAM,kBAAkB,GAAG,CAAC,OAAwB,EAAmB,EAAE,CACrE,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AAE1D,4EAA4E;AAC5E,MAAM,wBAAwB,GAAG,CAC7B,WAAmB,EACW,EAAE;IAChC,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEzD,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,yBAAyB,GAAG,CAC9B,WAAmB,EACnB,aAAsC,EAC/B,EAAE;IACT,MAAM,eAAe,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAE9D,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,eAAe,KAAK,MAAM,CAAC;IACtC,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,oEAAoE;AACpE,MAAM,yBAAyB,GAAG,CAC9B,kBAAmC,EACnC,cAAsB,EACQ,EAAE;IAChC,MAAM,eAAe,GAAG,oBAAoB,CACxC,cAAc,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAAE,KAAK,IAAI,IAAI,CACpE,EAAE,IAAI,EAAE,CAAC;IAEV,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CAC/B,kBAAmC,EACnC,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,eAAe,GAAG,yBAAyB,CAC7C,kBAAkB,EAClB,cAAc,CACjB,CAAC;IAEF,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO,CAAC;IACrE,CAAC;IAED,OAAO,eAAe,KAAK,OAAO,CAAC;AACvC,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,uBAAuB,GAAG,CAC5B,eAAgC,EAChC,cAAsB,EACQ,EAAE;IAChC,MAAM,WAAW,GAAG,oBAAoB,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;IAElE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,wBAAwB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAElE,IAAI,wBAAwB,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,yBAAyB,CAC5B,wBAAwB,EACxB,cAAc,CACjB,CAAC;IACN,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,CAC7B,eAAgC,EAChC,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,WAAW,GAAG,oBAAoB,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;IAElE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,yBAAyB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,wBAAwB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAElE,IAAI,wBAAwB,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,0BAA0B,CAC7B,wBAAwB,EACxB,cAAc,EACd,aAAa,CAChB,CAAC;IACN,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CACzC,IAAqB,EACrB,GAAqB,EACrB,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE3D,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,wBAAwB,CAC3B,kBAAkB,EAClB,cAAc,EACd,aAAa,CAChB,CAAC;IACN,CAAC;IAED,OAAO,wBAAwB,CAC3B,kBAAkB,CAAC,IAAI,CAAC,EACxB,cAAc,EACd,aAAa,CAChB,CAAC;AACN,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACtC,IAAqB,EACrB,GAAqB,EACrB,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE3D,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,CACH,uBAAuB,CAAC,kBAAkB,EAAE,cAAc,CAAC;YAC3D,aAAa,CAChB,CAAC;IACN,CAAC;IAED,OAAO,CACH,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;QACjE,aAAa,CAChB,CAAC;AACN,CAAC,CAAC;AAEF,mJAAmJ"}