eslint-plugin-github-actions-2 1.0.4 → 1.0.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +127 -127
- package/dist/_internal/github-actions-config-references.js +1 -1
- package/dist/_internal/github-actions-config-references.js.map +1 -1
- package/dist/_internal/rule-docs.d.ts +1 -1
- package/dist/_internal/rule-docs.d.ts.map +1 -1
- package/dist/_internal/workflow-permissions.d.ts +2 -0
- package/dist/_internal/workflow-permissions.d.ts.map +1 -1
- package/dist/_internal/workflow-permissions.js +54 -7
- package/dist/_internal/workflow-permissions.js.map +1 -1
- package/dist/plugin.cjs +276 -24
- package/dist/plugin.cjs.map +2 -2
- package/dist/plugin.d.ts.map +1 -1
- package/dist/plugin.js +1 -1
- package/dist/plugin.js.map +1 -1
- package/dist/rules/action-name-casing.d.ts.map +1 -1
- package/dist/rules/action-name-casing.js +4 -0
- package/dist/rules/action-name-casing.js.map +1 -1
- package/dist/rules/job-id-casing.d.ts.map +1 -1
- package/dist/rules/job-id-casing.js +4 -0
- package/dist/rules/job-id-casing.js.map +1 -1
- package/dist/rules/max-jobs-per-action.d.ts.map +1 -1
- package/dist/rules/max-jobs-per-action.js +4 -0
- package/dist/rules/max-jobs-per-action.js.map +1 -1
- package/dist/rules/no-codeql-autobuild-for-javascript-typescript.d.ts.map +1 -1
- package/dist/rules/no-codeql-autobuild-for-javascript-typescript.js +4 -0
- package/dist/rules/no-codeql-autobuild-for-javascript-typescript.js.map +1 -1
- package/dist/rules/no-codeql-javascript-typescript-split-language-matrix.d.ts.map +1 -1
- package/dist/rules/no-codeql-javascript-typescript-split-language-matrix.js +4 -0
- package/dist/rules/no-codeql-javascript-typescript-split-language-matrix.js.map +1 -1
- package/dist/rules/no-external-job.d.ts.map +1 -1
- package/dist/rules/no-external-job.js +4 -0
- package/dist/rules/no-external-job.js.map +1 -1
- package/dist/rules/no-inherit-secrets.d.ts.map +1 -1
- package/dist/rules/no-inherit-secrets.js +4 -0
- package/dist/rules/no-inherit-secrets.js.map +1 -1
- package/dist/rules/no-invalid-concurrency-context.d.ts.map +1 -1
- package/dist/rules/no-invalid-concurrency-context.js +4 -0
- package/dist/rules/no-invalid-concurrency-context.js.map +1 -1
- package/dist/rules/no-invalid-reusable-workflow-job-key.d.ts.map +1 -1
- package/dist/rules/no-invalid-reusable-workflow-job-key.js +4 -0
- package/dist/rules/no-invalid-reusable-workflow-job-key.js.map +1 -1
- package/dist/rules/no-invalid-workflow-call-output-value.d.ts.map +1 -1
- package/dist/rules/no-invalid-workflow-call-output-value.js +4 -0
- package/dist/rules/no-invalid-workflow-call-output-value.js.map +1 -1
- package/dist/rules/no-pr-head-checkout-in-pull-request-target.d.ts.map +1 -1
- package/dist/rules/no-pr-head-checkout-in-pull-request-target.js +4 -0
- package/dist/rules/no-pr-head-checkout-in-pull-request-target.js.map +1 -1
- package/dist/rules/no-secrets-in-if.d.ts.map +1 -1
- package/dist/rules/no-secrets-in-if.js +4 -0
- package/dist/rules/no-secrets-in-if.js.map +1 -1
- package/dist/rules/no-self-hosted-runner-on-fork-pr-events.d.ts.map +1 -1
- package/dist/rules/no-self-hosted-runner-on-fork-pr-events.js +4 -0
- package/dist/rules/no-self-hosted-runner-on-fork-pr-events.js.map +1 -1
- package/dist/rules/no-top-level-env.d.ts.map +1 -1
- package/dist/rules/no-top-level-env.js +4 -0
- package/dist/rules/no-top-level-env.js.map +1 -1
- package/dist/rules/no-top-level-permissions.d.ts.map +1 -1
- package/dist/rules/no-top-level-permissions.js +4 -1
- package/dist/rules/no-top-level-permissions.js.map +1 -1
- package/dist/rules/no-unknown-job-output-reference.d.ts.map +1 -1
- package/dist/rules/no-unknown-job-output-reference.js +4 -0
- package/dist/rules/no-unknown-job-output-reference.js.map +1 -1
- package/dist/rules/no-unknown-step-reference.d.ts.map +1 -1
- package/dist/rules/no-unknown-step-reference.js +4 -0
- package/dist/rules/no-unknown-step-reference.js.map +1 -1
- package/dist/rules/no-untrusted-input-in-run.d.ts.map +1 -1
- package/dist/rules/no-untrusted-input-in-run.js +4 -0
- package/dist/rules/no-untrusted-input-in-run.js.map +1 -1
- package/dist/rules/no-write-all-permissions.d.ts.map +1 -1
- package/dist/rules/no-write-all-permissions.js +4 -0
- package/dist/rules/no-write-all-permissions.js.map +1 -1
- package/dist/rules/pin-action-shas.d.ts.map +1 -1
- package/dist/rules/pin-action-shas.js +4 -0
- package/dist/rules/pin-action-shas.js.map +1 -1
- package/dist/rules/prefer-fail-fast.d.ts.map +1 -1
- package/dist/rules/prefer-fail-fast.js +4 -0
- package/dist/rules/prefer-fail-fast.js.map +1 -1
- package/dist/rules/prefer-file-extension.d.ts.map +1 -1
- package/dist/rules/prefer-file-extension.js +4 -0
- package/dist/rules/prefer-file-extension.js.map +1 -1
- package/dist/rules/prefer-inputs-context.d.ts.map +1 -1
- package/dist/rules/prefer-inputs-context.js +4 -0
- package/dist/rules/prefer-inputs-context.js.map +1 -1
- package/dist/rules/prefer-step-uses-style.d.ts.map +1 -1
- package/dist/rules/prefer-step-uses-style.js +4 -0
- package/dist/rules/prefer-step-uses-style.js.map +1 -1
- package/dist/rules/require-checkout-before-local-action.d.ts.map +1 -1
- package/dist/rules/require-checkout-before-local-action.js +4 -0
- package/dist/rules/require-checkout-before-local-action.js.map +1 -1
- package/dist/rules/require-codeql-actions-read.d.ts.map +1 -1
- package/dist/rules/require-codeql-actions-read.js +4 -0
- package/dist/rules/require-codeql-actions-read.js.map +1 -1
- package/dist/rules/require-codeql-branch-filters.d.ts.map +1 -1
- package/dist/rules/require-codeql-branch-filters.js +4 -0
- package/dist/rules/require-codeql-branch-filters.js.map +1 -1
- package/dist/rules/require-codeql-category-when-language-matrix.d.ts.map +1 -1
- package/dist/rules/require-codeql-category-when-language-matrix.js +4 -0
- package/dist/rules/require-codeql-category-when-language-matrix.js.map +1 -1
- package/dist/rules/require-codeql-pull-request-trigger.d.ts.map +1 -1
- package/dist/rules/require-codeql-pull-request-trigger.js +4 -0
- package/dist/rules/require-codeql-pull-request-trigger.js.map +1 -1
- package/dist/rules/require-codeql-schedule.d.ts.map +1 -1
- package/dist/rules/require-codeql-schedule.js +4 -0
- package/dist/rules/require-codeql-schedule.js.map +1 -1
- package/dist/rules/require-codeql-security-events-write.d.ts.map +1 -1
- package/dist/rules/require-codeql-security-events-write.js +4 -0
- package/dist/rules/require-codeql-security-events-write.js.map +1 -1
- package/dist/rules/require-dependabot-automation-permissions.d.ts.map +1 -1
- package/dist/rules/require-dependabot-automation-permissions.js +4 -0
- package/dist/rules/require-dependabot-automation-permissions.js.map +1 -1
- package/dist/rules/require-dependabot-automation-pull-request-trigger.d.ts.map +1 -1
- package/dist/rules/require-dependabot-automation-pull-request-trigger.js +4 -0
- package/dist/rules/require-dependabot-automation-pull-request-trigger.js.map +1 -1
- package/dist/rules/require-dependabot-bot-actor-guard.d.ts.map +1 -1
- package/dist/rules/require-dependabot-bot-actor-guard.js +4 -0
- package/dist/rules/require-dependabot-bot-actor-guard.js.map +1 -1
- package/dist/rules/require-dependabot-open-pull-requests-limit.d.ts.map +1 -1
- package/dist/rules/require-dependabot-open-pull-requests-limit.js +32 -2
- package/dist/rules/require-dependabot-open-pull-requests-limit.js.map +1 -1
- package/dist/rules/require-dependency-review-fail-on-severity.d.ts.map +1 -1
- package/dist/rules/require-dependency-review-fail-on-severity.js +4 -0
- package/dist/rules/require-dependency-review-fail-on-severity.js.map +1 -1
- package/dist/rules/require-dependency-review-permissions-contents-read.d.ts.map +1 -1
- package/dist/rules/require-dependency-review-permissions-contents-read.js +23 -18
- package/dist/rules/require-dependency-review-permissions-contents-read.js.map +1 -1
- package/dist/rules/require-dependency-review-pull-request-trigger.d.ts.map +1 -1
- package/dist/rules/require-dependency-review-pull-request-trigger.js +4 -0
- package/dist/rules/require-dependency-review-pull-request-trigger.js.map +1 -1
- package/dist/rules/require-fetch-metadata-github-token.d.ts.map +1 -1
- package/dist/rules/require-fetch-metadata-github-token.js +4 -0
- package/dist/rules/require-fetch-metadata-github-token.js.map +1 -1
- package/dist/rules/require-job-name.d.ts.map +1 -1
- package/dist/rules/require-job-name.js +4 -0
- package/dist/rules/require-job-name.js.map +1 -1
- package/dist/rules/require-job-step-name.d.ts.map +1 -1
- package/dist/rules/require-job-step-name.js +4 -0
- package/dist/rules/require-job-step-name.js.map +1 -1
- package/dist/rules/require-job-timeout-minutes.d.ts.map +1 -1
- package/dist/rules/require-job-timeout-minutes.js +4 -0
- package/dist/rules/require-job-timeout-minutes.js.map +1 -1
- package/dist/rules/require-merge-group-trigger.d.ts.map +1 -1
- package/dist/rules/require-merge-group-trigger.js +4 -0
- package/dist/rules/require-merge-group-trigger.js.map +1 -1
- package/dist/rules/require-pull-request-target-branches.d.ts.map +1 -1
- package/dist/rules/require-pull-request-target-branches.js +4 -0
- package/dist/rules/require-pull-request-target-branches.js.map +1 -1
- package/dist/rules/require-run-step-shell.d.ts.map +1 -1
- package/dist/rules/require-run-step-shell.js +4 -0
- package/dist/rules/require-run-step-shell.js.map +1 -1
- package/dist/rules/require-sarif-upload-security-events-write.d.ts.map +1 -1
- package/dist/rules/require-sarif-upload-security-events-write.js +4 -0
- package/dist/rules/require-sarif-upload-security-events-write.js.map +1 -1
- package/dist/rules/require-scorecard-results-format-sarif.d.ts.map +1 -1
- package/dist/rules/require-scorecard-results-format-sarif.js +4 -0
- package/dist/rules/require-scorecard-results-format-sarif.js.map +1 -1
- package/dist/rules/require-scorecard-upload-sarif-step.d.ts.map +1 -1
- package/dist/rules/require-scorecard-upload-sarif-step.js +4 -0
- package/dist/rules/require-scorecard-upload-sarif-step.js.map +1 -1
- package/dist/rules/require-secret-scan-contents-read.d.ts.map +1 -1
- package/dist/rules/require-secret-scan-contents-read.js +7 -3
- package/dist/rules/require-secret-scan-contents-read.js.map +1 -1
- package/dist/rules/require-secret-scan-fetch-depth-zero.d.ts.map +1 -1
- package/dist/rules/require-secret-scan-fetch-depth-zero.js +4 -0
- package/dist/rules/require-secret-scan-fetch-depth-zero.js.map +1 -1
- package/dist/rules/require-secret-scan-schedule.d.ts.map +1 -1
- package/dist/rules/require-secret-scan-schedule.js +4 -0
- package/dist/rules/require-secret-scan-schedule.js.map +1 -1
- package/dist/rules/require-trigger-types.d.ts.map +1 -1
- package/dist/rules/require-trigger-types.js +4 -0
- package/dist/rules/require-trigger-types.js.map +1 -1
- package/dist/rules/require-trufflehog-verified-results-mode.d.ts.map +1 -1
- package/dist/rules/require-trufflehog-verified-results-mode.js +4 -0
- package/dist/rules/require-trufflehog-verified-results-mode.js.map +1 -1
- package/dist/rules/require-workflow-call-input-type.d.ts.map +1 -1
- package/dist/rules/require-workflow-call-input-type.js +4 -0
- package/dist/rules/require-workflow-call-input-type.js.map +1 -1
- package/dist/rules/require-workflow-call-output-value.d.ts.map +1 -1
- package/dist/rules/require-workflow-call-output-value.js +4 -0
- package/dist/rules/require-workflow-call-output-value.js.map +1 -1
- package/dist/rules/require-workflow-concurrency.d.ts.map +1 -1
- package/dist/rules/require-workflow-concurrency.js +4 -0
- package/dist/rules/require-workflow-concurrency.js.map +1 -1
- package/dist/rules/require-workflow-dispatch-input-type.d.ts.map +1 -1
- package/dist/rules/require-workflow-dispatch-input-type.js +4 -0
- package/dist/rules/require-workflow-dispatch-input-type.js.map +1 -1
- package/dist/rules/require-workflow-interface-description.d.ts.map +1 -1
- package/dist/rules/require-workflow-interface-description.js +4 -0
- package/dist/rules/require-workflow-interface-description.js.map +1 -1
- package/dist/rules/require-workflow-run-branches.d.ts.map +1 -1
- package/dist/rules/require-workflow-run-branches.js +4 -0
- package/dist/rules/require-workflow-run-branches.js.map +1 -1
- package/dist/rules/valid-timeout-minutes.d.ts.map +1 -1
- package/dist/rules/valid-timeout-minutes.js +4 -0
- package/dist/rules/valid-timeout-minutes.js.map +1 -1
- package/dist/rules/valid-trigger-events.d.ts.map +1 -1
- package/dist/rules/valid-trigger-events.js +4 -0
- package/dist/rules/valid-trigger-events.js.map +1 -1
- package/docs/rules/guides/authoring-rules.md +34 -0
- package/docs/rules/guides/docs-authoring.md +34 -0
- package/docs/rules/guides/index.md +15 -0
- package/docs/rules/guides/testing-rules.md +34 -0
- package/docs/rules/no-top-level-permissions.md +4 -4
- package/docs/rules/presets/action-metadata.md +8 -8
- package/docs/rules/presets/all.md +123 -124
- package/docs/rules/presets/code-scanning.md +8 -8
- package/docs/rules/presets/dependabot.md +8 -8
- package/docs/rules/presets/index.md +119 -123
- package/docs/rules/presets/recommended.md +8 -8
- package/docs/rules/presets/security.md +8 -8
- package/docs/rules/presets/strict.md +8 -8
- package/docs/rules/presets/workflow-template-properties.md +8 -8
- package/docs/rules/presets/workflow-templates.md +8 -8
- package/docs/rules/require-dependabot-open-pull-requests-limit.md +21 -4
- package/docs/rules/require-dependency-review-permissions-contents-read.md +15 -4
- package/docs/rules/require-secret-scan-contents-read.md +10 -2
- package/docs/rules/require-workflow-permissions.md +4 -4
- package/package.json +1 -1
|
@@ -37,7 +37,7 @@ export const githubActionsConfigMetadataByName = {
|
|
|
37
37
|
presetName: "github-actions:action-metadata",
|
|
38
38
|
},
|
|
39
39
|
all: {
|
|
40
|
-
description: "Enables
|
|
40
|
+
description: "Enables the complete bundled rule set across workflows, action metadata, workflow templates, and Dependabot configuration, while leaving explicitly opt-in policy rules manual.",
|
|
41
41
|
files: [
|
|
42
42
|
...WORKFLOW_FILE_GLOBS,
|
|
43
43
|
...ACTION_METADATA_FILE_GLOBS,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"github-actions-config-references.js","sourceRoot":"","sources":["../../src/_internal/github-actions-config-references.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACH,0BAA0B,EAC1B,qBAAqB,EACrB,4BAA4B,EAC5B,uCAAuC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACpC,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,4BAA4B;IAC5B,mBAAmB;IACnB,aAAa;IACb,UAAU;IACV,QAAQ;IACR,KAAK;CACC,CAAC;AAKX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAE3C;IACA,uCAAuC,EAAE,gBAAgB;IACzD,4BAA4B,EAAE,KAAK;IACnC,qCAAqC,EAAE,cAAc;IACrD,mCAAmC,EAAE,YAAY;IACjD,oCAAoC,EAAE,aAAa;IACnD,iCAAiC,EAAE,UAAU;IAC7C,+BAA+B,EAAE,QAAQ;IACzC,mDAAmD,EAC/C,4BAA4B;IAChC,0CAA0C,EAAE,mBAAmB;CACP,CAAC;AAM7D,yEAAyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAU1C;IACA,cAAc,EAAE;QACZ,WAAW,EACP,mFAAmF;QACvF,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,gCAAgC;KAC/C;IACD,GAAG,EAAE;QACD,WAAW,EACP,
|
|
1
|
+
{"version":3,"file":"github-actions-config-references.js","sourceRoot":"","sources":["../../src/_internal/github-actions-config-references.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACH,0BAA0B,EAC1B,qBAAqB,EACrB,4BAA4B,EAC5B,uCAAuC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACpC,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,4BAA4B;IAC5B,mBAAmB;IACnB,aAAa;IACb,UAAU;IACV,QAAQ;IACR,KAAK;CACC,CAAC;AAKX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAE3C;IACA,uCAAuC,EAAE,gBAAgB;IACzD,4BAA4B,EAAE,KAAK;IACnC,qCAAqC,EAAE,cAAc;IACrD,mCAAmC,EAAE,YAAY;IACjD,oCAAoC,EAAE,aAAa;IACnD,iCAAiC,EAAE,UAAU;IAC7C,+BAA+B,EAAE,QAAQ;IACzC,mDAAmD,EAC/C,4BAA4B;IAChC,0CAA0C,EAAE,mBAAmB;CACP,CAAC;AAM7D,yEAAyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAU1C;IACA,cAAc,EAAE;QACZ,WAAW,EACP,mFAAmF;QACvF,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,gCAAgC;KAC/C;IACD,GAAG,EAAE;QACD,WAAW,EACP,iLAAiL;QACrL,KAAK,EAAE;YACH,GAAG,mBAAmB;YACtB,GAAG,0BAA0B;YAC7B,GAAG,qBAAqB;YACxB,GAAG,4BAA4B;SAClC;QACD,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,oBAAoB;KACnC;IACD,YAAY,EAAE;QACV,WAAW,EACP,kHAAkH;QACtH,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,8BAA8B;KAC7C;IACD,UAAU,EAAE;QACR,WAAW,EACP,4FAA4F;QAChG,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,2BAA2B;KAC1C;IACD,WAAW,EAAE;QACT,WAAW,EACP,6EAA6E;QACjF,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,4BAA4B;KAC3C;IACD,QAAQ,EAAE;QACN,WAAW,EACP,8EAA8E;QAClF,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,yBAAyB;KACxC;IACD,MAAM,EAAE;QACJ,WAAW,EACP,iEAAiE;QACrE,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,uBAAuB;KACtC;IACD,0BAA0B,EAAE;QACxB,WAAW,EACP,8EAA8E;QAClF,KAAK,EAAE,uCAAuC;QAC9C,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,6CAA6C;KAC5D;IACD,iBAAiB,EAAE;QACf,WAAW,EACP,8EAA8E;QAClF,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,mCAAmC;KAClD;CACK,CAAC"}
|
|
@@ -6,7 +6,7 @@ import type { Rule } from "eslint";
|
|
|
6
6
|
import type { GithubActionsConfigReference } from "./github-actions-config-references.js";
|
|
7
7
|
/** Custom docs metadata stored alongside each ESLint rule definition. */
|
|
8
8
|
export type GithubActionsRuleDocs = Rule.RuleMetaData["docs"] & {
|
|
9
|
-
readonly configs
|
|
9
|
+
readonly configs?: GithubActionsConfigReference | readonly GithubActionsConfigReference[];
|
|
10
10
|
readonly recommended: boolean;
|
|
11
11
|
readonly requiresTypeChecking: boolean;
|
|
12
12
|
readonly ruleId: `R${number}`;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rule-docs.d.ts","sourceRoot":"","sources":["../../src/_internal/rule-docs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEnC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAE1F,yEAAyE;AACzE,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG;IAC5D,QAAQ,CAAC,OAAO,
|
|
1
|
+
{"version":3,"file":"rule-docs.d.ts","sourceRoot":"","sources":["../../src/_internal/rule-docs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEnC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAE1F,yEAAyE;AACzE,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG;IAC5D,QAAQ,CAAC,OAAO,CAAC,EACX,4BAA4B,GAC5B,SAAS,4BAA4B,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB,CAAC"}
|
|
@@ -8,4 +8,6 @@ import { type WorkflowJobEntry } from "./workflow-yaml.js";
|
|
|
8
8
|
export type WorkflowPermissionLevel = "read" | "write";
|
|
9
9
|
/** Determine whether a workflow/job has the required effective permission level. */
|
|
10
10
|
export declare const hasRequiredWorkflowPermission: (root: AST.YAMLMapping, job: WorkflowJobEntry, permissionName: string, requiredLevel: WorkflowPermissionLevel) => boolean;
|
|
11
|
+
/** Determine whether a workflow/job has an exact effective permission level. */
|
|
12
|
+
export declare const hasExactWorkflowPermission: (root: AST.YAMLMapping, job: WorkflowJobEntry, permissionName: string, requiredLevel: WorkflowPermissionLevel) => boolean;
|
|
11
13
|
//# sourceMappingURL=workflow-permissions.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"workflow-permissions.d.ts","sourceRoot":"","sources":["../../src/_internal/workflow-permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAIH,KAAK,gBAAgB,EACxB,MAAM,oBAAoB,CAAC;AAE5B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"workflow-permissions.d.ts","sourceRoot":"","sources":["../../src/_internal/workflow-permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAIH,KAAK,gBAAgB,EACxB,MAAM,oBAAoB,CAAC;AAE5B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,CAAC;AA6IvD,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,GACtC,MAAM,GAAG,CAAC,WAAW,EACrB,KAAK,gBAAgB,EACrB,gBAAgB,MAAM,EACtB,eAAe,uBAAuB,KACvC,OAgBF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,GACnC,MAAM,GAAG,CAAC,WAAW,EACrB,KAAK,gBAAgB,EACrB,gBAAgB,MAAM,EACtB,eAAe,uBAAuB,KACvC,OAcF,CAAC"}
|
|
@@ -1,30 +1,67 @@
|
|
|
1
1
|
import { getMappingPair, getScalarStringValue, unwrapYamlValue, } from "./workflow-yaml.js";
|
|
2
2
|
/** Read the permissions node for a workflow or job mapping. */
|
|
3
3
|
const getPermissionsNode = (mapping) => getMappingPair(mapping, "permissions")?.value ?? null;
|
|
4
|
-
/**
|
|
5
|
-
const
|
|
4
|
+
/** Convert a scalar permissions shorthand into an exact effective level. */
|
|
5
|
+
const getScalarPermissionLevel = (scalarValue) => {
|
|
6
6
|
const normalizedValue = scalarValue.trim().toLowerCase();
|
|
7
|
+
if (normalizedValue === "read-all") {
|
|
8
|
+
return "read";
|
|
9
|
+
}
|
|
7
10
|
if (normalizedValue === "write-all") {
|
|
11
|
+
return "write";
|
|
12
|
+
}
|
|
13
|
+
return null;
|
|
14
|
+
};
|
|
15
|
+
/** Determine whether a permissions scalar satisfies the required access level. */
|
|
16
|
+
const scalarPermissionSatisfies = (scalarValue, requiredLevel) => {
|
|
17
|
+
const permissionLevel = getScalarPermissionLevel(scalarValue);
|
|
18
|
+
if (permissionLevel === "write") {
|
|
8
19
|
return true;
|
|
9
20
|
}
|
|
10
21
|
if (requiredLevel === "read") {
|
|
11
|
-
return
|
|
22
|
+
return permissionLevel === "read";
|
|
12
23
|
}
|
|
13
24
|
return false;
|
|
14
25
|
};
|
|
26
|
+
/** Resolve an exact permission level from a permissions mapping. */
|
|
27
|
+
const getMappingPermissionLevel = (permissionsMapping, permissionName) => {
|
|
28
|
+
const permissionValue = getScalarStringValue(getMappingPair(permissionsMapping, permissionName)?.value ?? null)?.trim();
|
|
29
|
+
if (permissionValue === undefined || permissionValue.length === 0) {
|
|
30
|
+
return null;
|
|
31
|
+
}
|
|
32
|
+
if (permissionValue === "read") {
|
|
33
|
+
return "read";
|
|
34
|
+
}
|
|
35
|
+
if (permissionValue === "write") {
|
|
36
|
+
return "write";
|
|
37
|
+
}
|
|
38
|
+
return null;
|
|
39
|
+
};
|
|
15
40
|
/**
|
|
16
41
|
* Determine whether a permissions mapping satisfies a required permission
|
|
17
42
|
* level.
|
|
18
43
|
*/
|
|
19
44
|
const mappingPermissionSatisfies = (permissionsMapping, permissionName, requiredLevel) => {
|
|
20
|
-
const
|
|
21
|
-
if (
|
|
45
|
+
const permissionLevel = getMappingPermissionLevel(permissionsMapping, permissionName);
|
|
46
|
+
if (permissionLevel === null) {
|
|
22
47
|
return false;
|
|
23
48
|
}
|
|
24
49
|
if (requiredLevel === "read") {
|
|
25
|
-
return
|
|
50
|
+
return permissionLevel === "read" || permissionLevel === "write";
|
|
26
51
|
}
|
|
27
|
-
return
|
|
52
|
+
return permissionLevel === "write";
|
|
53
|
+
};
|
|
54
|
+
/** Resolve the exact permission level declared by a permissions node. */
|
|
55
|
+
const getPermissionsNodeLevel = (permissionsNode, permissionName) => {
|
|
56
|
+
const scalarValue = getScalarStringValue(permissionsNode)?.trim();
|
|
57
|
+
if (scalarValue !== undefined && scalarValue.length > 0) {
|
|
58
|
+
return getScalarPermissionLevel(scalarValue);
|
|
59
|
+
}
|
|
60
|
+
const unwrappedPermissionsNode = unwrapYamlValue(permissionsNode);
|
|
61
|
+
if (unwrappedPermissionsNode?.type === "YAMLMapping") {
|
|
62
|
+
return getMappingPermissionLevel(unwrappedPermissionsNode, permissionName);
|
|
63
|
+
}
|
|
64
|
+
return null;
|
|
28
65
|
};
|
|
29
66
|
/** Determine whether a permissions node satisfies a required permission level. */
|
|
30
67
|
const permissionsNodeSatisfies = (permissionsNode, permissionName, requiredLevel) => {
|
|
@@ -46,5 +83,15 @@ export const hasRequiredWorkflowPermission = (root, job, permissionName, require
|
|
|
46
83
|
}
|
|
47
84
|
return permissionsNodeSatisfies(getPermissionsNode(root), permissionName, requiredLevel);
|
|
48
85
|
};
|
|
86
|
+
/** Determine whether a workflow/job has an exact effective permission level. */
|
|
87
|
+
export const hasExactWorkflowPermission = (root, job, permissionName, requiredLevel) => {
|
|
88
|
+
const jobPermissionsNode = getPermissionsNode(job.mapping);
|
|
89
|
+
if (jobPermissionsNode !== null) {
|
|
90
|
+
return (getPermissionsNodeLevel(jobPermissionsNode, permissionName) ===
|
|
91
|
+
requiredLevel);
|
|
92
|
+
}
|
|
93
|
+
return (getPermissionsNodeLevel(getPermissionsNode(root), permissionName) ===
|
|
94
|
+
requiredLevel);
|
|
95
|
+
};
|
|
49
96
|
/* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Re-enable readonly-parameter checks outside parser AST helper signatures. */
|
|
50
97
|
//# sourceMappingURL=workflow-permissions.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"workflow-permissions.js","sourceRoot":"","sources":["../../src/_internal/workflow-permissions.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,cAAc,EACd,oBAAoB,EACpB,eAAe,GAElB,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"workflow-permissions.js","sourceRoot":"","sources":["../../src/_internal/workflow-permissions.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,cAAc,EACd,oBAAoB,EACpB,eAAe,GAElB,MAAM,oBAAoB,CAAC;AAQ5B,+DAA+D;AAC/D,MAAM,kBAAkB,GAAG,CAAC,OAAwB,EAAmB,EAAE,CACrE,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AAE1D,4EAA4E;AAC5E,MAAM,wBAAwB,GAAG,CAC7B,WAAmB,EACW,EAAE;IAChC,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEzD,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,yBAAyB,GAAG,CAC9B,WAAmB,EACnB,aAAsC,EAC/B,EAAE;IACT,MAAM,eAAe,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAE9D,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,eAAe,KAAK,MAAM,CAAC;IACtC,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,oEAAoE;AACpE,MAAM,yBAAyB,GAAG,CAC9B,kBAAmC,EACnC,cAAsB,EACQ,EAAE;IAChC,MAAM,eAAe,GAAG,oBAAoB,CACxC,cAAc,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAAE,KAAK,IAAI,IAAI,CACpE,EAAE,IAAI,EAAE,CAAC;IAEV,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CAC/B,kBAAmC,EACnC,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,eAAe,GAAG,yBAAyB,CAC7C,kBAAkB,EAClB,cAAc,CACjB,CAAC;IAEF,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO,CAAC;IACrE,CAAC;IAED,OAAO,eAAe,KAAK,OAAO,CAAC;AACvC,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,uBAAuB,GAAG,CAC5B,eAAgC,EAChC,cAAsB,EACQ,EAAE;IAChC,MAAM,WAAW,GAAG,oBAAoB,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;IAElE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,wBAAwB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAElE,IAAI,wBAAwB,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,yBAAyB,CAC5B,wBAAwB,EACxB,cAAc,CACjB,CAAC;IACN,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,CAC7B,eAAgC,EAChC,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,WAAW,GAAG,oBAAoB,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;IAElE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,yBAAyB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,wBAAwB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAElE,IAAI,wBAAwB,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,0BAA0B,CAC7B,wBAAwB,EACxB,cAAc,EACd,aAAa,CAChB,CAAC;IACN,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CACzC,IAAqB,EACrB,GAAqB,EACrB,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE3D,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,wBAAwB,CAC3B,kBAAkB,EAClB,cAAc,EACd,aAAa,CAChB,CAAC;IACN,CAAC;IAED,OAAO,wBAAwB,CAC3B,kBAAkB,CAAC,IAAI,CAAC,EACxB,cAAc,EACd,aAAa,CAChB,CAAC;AACN,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACtC,IAAqB,EACrB,GAAqB,EACrB,cAAsB,EACtB,aAAsC,EAC/B,EAAE;IACT,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE3D,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,CACH,uBAAuB,CAAC,kBAAkB,EAAE,cAAc,CAAC;YAC3D,aAAa,CAChB,CAAC;IACN,CAAC;IAED,OAAO,CACH,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;QACjE,aAAa,CAChB,CAAC;AACN,CAAC,CAAC;AAEF,mJAAmJ"}
|