flecto 3.0.1 → 3.0.2

package/package.json

@@ -4,7 +4,7 @@
     "access": "public",
     "provenance": true
   },
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "Flecto \u2014 semantic config watcher that reports meaningful changes in plain English",
   "license": "MIT",
   "keywords": [
@@ -43,7 +43,10 @@
   "scripts": {
     "test": "node --test test/*.test.js",
     "test:watch": "node --test --watch test/*.test.js",
+    "test:coverage": "node --test --experimental-test-coverage --test-reporter=spec --test-reporter-destination=stdout --test-reporter=lcov --test-reporter-destination=coverage.lcov test/*.test.js",
+    "coverage": "npm run test:coverage && node scripts/coverage-report.js",
     "bench": "node bench/run.js",
+    "fuzz": "node test/fuzz/run.js",
     "pack:check": "npm pack --dry-run"
   },
   "dependencies": {

package/schemas/flecto-policy-pack-2.0.json

@@ -45,6 +45,7 @@
         "beforeLooksSecret": { "const": true },
         "afterLooksSecret": { "const": true },
         "afterMatches": { "type": "string" },
+        "afterAnyMatches": { "type": "string" },
         "numericJump": {
           "type": "object",
           "additionalProperties": false,
@@ -95,6 +96,7 @@
         "beforeLooksSecret": { "const": true },
         "afterLooksSecret": { "const": true },
         "afterMatches": { "type": "string" },
+        "afterAnyMatches": { "type": "string" },
         "numericJump": { "$ref": "#/$defs/numericJump" },
         "numericDelta": { "$ref": "#/$defs/numericDelta" }
       }

package/src/baseline.js

@@ -0,0 +1,193 @@
+import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { relative, resolve } from 'path';
+
+/**
+ * Adoption baseline for `flecto ci`. Records the policy findings that already
+ * exist in a repository so the gate fails only on *new* ones, the way every
+ * durable policy tool lets a team turn on enforcement without first fixing
+ * years of accumulated config.
+ *
+ * The fingerprint is the crux (#118). It is `(rule id, file, path)` and
+ * deliberately excludes the finding's value:
+ *
+ * - **Excluding the value** keeps a baseline from churning on every edit. A
+ *   `pool-size-jump` that was accepted at 5→20 should stay accepted when it
+ *   becomes 5→21; re-flagging it would make the file thrash and get deleted.
+ * - **Including the path** — which for multi-document YAML already carries the
+ *   document identity (`Deployment/prod/api.…`) — keeps two findings of the same
+ *   rule in the same file distinct.
+ * - **The file is stored repo-relative and POSIX-slashed**, so a baseline is
+ *   portable across machines and clean in a diff.
+ *
+ * The tradeoff, documented for the user: renaming a file or restructuring a path
+ * re-introduces its findings as new. That is the honest failure mode — a
+ * fingerprint stable across a rename would have to ignore location, which would
+ * make it too coarse to tell two findings apart.
+ */
+
+const BASELINE_VERSION = 1;
+
+/**
+ * @typedef {{
+ *   rule: string,
+ *   file: string,
+ *   path: string,
+ *   severity?: string,
+ *   message?: string,
+ *   pack?: string,
+ *   acceptedAt?: string,
+ *   reason?: string
+ * }} BaselineEntry
+ *
+ * @typedef {{ version: number, generatedAt?: string, findings: BaselineEntry[] }} BaselineFile
+ */
+
+/**
+ * The stable identity of a finding: rule, file, path. NUL-joined so no two
+ * different triples can collide by concatenation.
+ * @param {{ rule: string, file: string, path: string }} entry
+ * @returns {string}
+ */
+export function fingerprint(entry) {
+  return `${entry.rule}\u0000${entry.file}\u0000${entry.path}`;
+}
+
+/**
+ * Normalize a file path to the repo-relative, POSIX form stored in a baseline.
+ * @param {string} file
+ * @param {string} cwd
+ * @returns {string}
+ */
+export function baselineRelativePath(file, cwd) {
+  const rel = relative(cwd, file);
+  if (!rel || rel.startsWith('..')) return file.split(/[\\/]/).join('/');
+  return rel.split('\\').join('/');
+}
+
+/**
+ * Read and validate a baseline file. A missing file is not an error — it is the
+ * first run, before anyone has recorded anything — so it reads as empty. A file
+ * that exists but is malformed *is* an error: silently treating it as empty
+ * would turn every recorded finding new and fail the build in a way that looks
+ * like a regression.
+ * @param {string} path
+ * @returns {{ entries: Map<string, BaselineEntry>, existed: boolean }}
+ */
+export function loadBaseline(path) {
+  if (!existsSync(path)) return { entries: new Map(), existed: false };
+
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, 'utf8'));
+  } catch (err) {
+    throw new Error(`Baseline file is not valid JSON: ${path}: ${err.message}`);
+  }
+  if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.findings)) {
+    throw new Error(`Baseline file is malformed (expected a "findings" array): ${path}`);
+  }
+
+  /** @type {Map<string, BaselineEntry>} */
+  const entries = new Map();
+  for (const [index, entry] of parsed.findings.entries()) {
+    for (const field of ['rule', 'file', 'path']) {
+      if (typeof entry?.[field] !== 'string') {
+        throw new Error(`Baseline findings[${index}].${field} must be a string: ${path}`);
+      }
+    }
+    entries.set(fingerprint(entry), entry);
+  }
+  return { entries, existed: true };
+}
+
+/**
+ * Partition this run's findings against a loaded baseline.
+ *
+ * `located` is the run's findings paired with their repo-relative file. Result:
+ * - `active`   — findings not in the baseline; these still gate the build
+ * - `accepted` — findings the baseline already records; suppressed from the gate
+ * - `stale`    — baseline entries that did not occur this run; reported so the
+ *                file shrinks rather than accreting forever
+ * @param {Array<{ file: string, finding: import('./policy.js').PolicyFinding }>} located
+ * @param {Map<string, BaselineEntry>} baseline
+ * @returns {{
+ *   active: Array<{ file: string, finding: import('./policy.js').PolicyFinding }>,
+ *   accepted: Array<{ file: string, finding: import('./policy.js').PolicyFinding }>,
+ *   stale: BaselineEntry[]
+ * }}
+ */
+export function applyBaseline(located, baseline) {
+  const active = [];
+  const accepted = [];
+  const seen = new Set();
+
+  for (const item of located) {
+    const fp = fingerprint({
+      rule: String(item.finding.id),
+      file: item.file,
+      path: String(item.finding.path ?? ''),
+    });
+    seen.add(fp);
+    if (baseline.has(fp)) accepted.push(item);
+    else active.push(item);
+  }
+
+  const stale = [];
+  for (const [fp, entry] of baseline) {
+    if (!seen.has(fp)) stale.push(entry);
+  }
+
+  return { active, accepted, stale };
+}
+
+/**
+ * Build the baseline file content from this run's findings, preserving the
+ * `acceptedAt` and `reason` of entries that already existed so an update does
+ * not reset the provenance of findings that were accepted long ago. Entries are
+ * sorted by (file, rule, path) for a stable, review-friendly diff.
+ * @param {Array<{ file: string, finding: import('./policy.js').PolicyFinding }>} located
+ * @param {Map<string, BaselineEntry>} previous
+ * @param {{ now?: string }} [options]
+ * @returns {BaselineFile}
+ */
+export function buildBaselineFile(located, previous, options = {}) {
+  const now = options.now ?? new Date().toISOString();
+
+  /** @type {Map<string, BaselineEntry>} */
+  const byFingerprint = new Map();
+  for (const { file, finding } of located) {
+    const entry = {
+      rule: String(finding.id),
+      file,
+      path: String(finding.path ?? ''),
+    };
+    const fp = fingerprint(entry);
+    // One entry per fingerprint even if a rule fires twice on the same path.
+    if (byFingerprint.has(fp)) continue;
+    const prior = previous.get(fp);
+    byFingerprint.set(fp, {
+      ...entry,
+      severity: finding.severity,
+      ...(finding.pack ? { pack: String(finding.pack) } : {}),
+      message: String(finding.message ?? ''),
+      acceptedAt: prior?.acceptedAt ?? now,
+      ...(prior?.reason ? { reason: prior.reason } : {}),
+    });
+  }
+
+  const findings = [...byFingerprint.values()].sort((a, b) =>
+    a.file.localeCompare(b.file)
+    || a.rule.localeCompare(b.rule)
+    || a.path.localeCompare(b.path));
+
+  return { version: BASELINE_VERSION, generatedAt: now, findings };
+}
+
+/**
+ * Write a baseline file with a trailing newline and stable 2-space indent, so it
+ * reviews and diffs cleanly.
+ * @param {string} path
+ * @param {BaselineFile} content
+ */
+export function writeBaselineFile(path, content) {
+  writeFileSync(resolve(path), `${JSON.stringify(content, null, 2)}\n`, 'utf8');
+}

package/src/config.js

@@ -1,14 +1,34 @@
-import { existsSync, readFileSync, readdirSync, writeFileSync } from 'fs';
-import { resolve, sep } from 'path';
+import { existsSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from 'fs';
+import { basename, dirname, join, relative, resolve, sep } from 'path';
 import fg from 'fast-glob';
 import yaml from 'js-yaml';
-import { isEnvFilename } from './parser.js';
+import { isEnvFilename, parseContent } from './parser.js';
+import { encryptionState } from './encrypted.js';
 
 const RC_CANDIDATES = ['.flectorc', '.flectorc.json', '.flectorc.yaml', '.flectorc.yml'];
 const COMPOSE_FILENAMES = ['docker-compose.yml', 'docker-compose.yaml', 'compose.yml', 'compose.yaml'];
 const CONFIG_DIR_PATTERN = 'config/**/*.{yaml,yml,json,toml,ini}';
 const ENV_FILE_PATTERNS = ['.env', '.env.*', '*.env'];
 const GENERIC_FILE_PATTERNS = [CONFIG_DIR_PATTERN, ...ENV_FILE_PATTERNS];
+const GITHUB_ACTIONS_WORKFLOW_PATTERN = '.github/workflows/**/*.{yaml,yml}';
+
+// Conventional places a Kubernetes/SOPS repo keeps manifests, searched in
+// addition to the repo root. Detection is content-based (see sniffManifestDirs),
+// so these only bound *where* Flecto looks — a manifest named deploy.yaml still
+// has to actually carry `apiVersion` + `kind` to count.
+const MANIFEST_DIRS = ['k8s', 'kubernetes', 'manifests', 'deploy'];
+
+// Cost guards. `flecto init` must not read a large repo exhaustively: the issue
+// (#123) is explicit that reading every YAML file is the wrong trade. Sniffing
+// stops after this many files, and a single file larger than the byte cap is
+// skipped rather than read — a hand-written manifest is never megabytes, and a
+// generated blob that large is not what we want to gate on anyway.
+const MAX_SNIFF_FILES = 50;
+const MAX_SNIFF_BYTES = 256 * 1024;
+const SNIFF_EXTENSIONS = ['.yaml', '.yml', '.json'];
+
+const K8S_ROOT_PATTERN = '*.{yaml,yml}';
+const K8S_DIR_PATTERN = '**/*.{yaml,yml}';
 
 /**
  * @typedef {{
@@ -89,6 +109,113 @@ function rcPluginsAllowed() {
   return raw === '1' || String(raw).toLowerCase() === 'true';
 }
 
+/**
+ * Has the operator explicitly opted in to targets that leave the project through
+ * a symlink?
+ * @returns {boolean}
+ */
+function symlinkTargetsAllowed() {
+  const raw = process.env.FLECTO_ALLOW_SYMLINK_TARGETS;
+  return raw === '1' || String(raw).toLowerCase() === 'true';
+}
+
+/**
+ * Resolve symlinks where possible, falling back to the input for a path that
+ * does not exist yet.
+ *
+ * `realpathSync.native` first because on Windows it asks the OS for the final
+ * path, resolving 8.3 short names and normalizing case — two spellings of one
+ * directory would otherwise compare as different and make a contained path look
+ * like an escape.
+ * @param {string} path
+ * @returns {string}
+ */
+function canonical(path) {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    // Falls through for a path that does not exist yet.
+  }
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve(path);
+  }
+}
+
+/**
+ * @param {string} candidate
+ * @param {string} root both already canonical
+ * @returns {boolean}
+ */
+function isInside(candidate, root) {
+  return candidate === root || candidate.startsWith(root + sep);
+}
+
+/**
+ * Refuse a path that lives inside the project but reads from outside it through
+ * a symlink.
+ *
+ * On an untrusted pull request the file *names* are attacker-controlled, and so
+ * is what they point at. A pull request adding `config/app.ini` as a symlink to
+ * `~/.aws/credentials` gets that file parsed and its contents emitted — into the
+ * job log, the JSON envelope, and, with `--format pr-comment --pr-comment-post`,
+ * into a comment on the pull request itself. The attacker never controls the
+ * linked-to file, which is exactly what makes it worth reading.
+ *
+ * The rule is deliberately narrow, and it is about *escape*, not about location:
+ *
+ * - A path given from outside the project is operator intent — `flecto compare
+ *   /etc/a.yaml /etc/b.yaml` is a real thing to do — and is untouched.
+ * - A path inside the project that resolves to somewhere inside it is fine, so
+ *   symlinks within a repository keep working.
+ * - A path inside the project that resolves *out* of it is refused, because that
+ *   is the one shape an untrusted pull request can author to reach a file it
+ *   could not otherwise commit.
+ *
+ * `FLECTO_ALLOW_SYMLINK_TARGETS=1` opts out, for a checkout that genuinely links
+ * config in from a sibling directory. Refusing loudly rather than skipping is
+ * deliberate, for the reason rc-declared plugins are: a target that stops being
+ * scanned without saying so weakens a gate the operator believes is in place.
+ * @param {string} file absolute path as Flecto was given it
+ * @param {string} [cwd]
+ * @throws {Error} when the path escapes the project through a link
+ */
+export function assertTargetContained(file, cwd = process.cwd()) {
+  if (symlinkTargetsAllowed()) return;
+
+  const root = canonical(resolve(cwd));
+  const given = resolve(file);
+  // A path with nothing readable behind it cannot leak a file: either it does
+  // not exist, or it is a symlink whose target does not exist (existsSync
+  // follows the link). Missing targets are reported elsewhere; refusing one here
+  // as an "escape" is a false positive -- and canonical() cannot resolve a
+  // nonexistent path, so its symlink-normalized fallback would not even match
+  // `root` on a platform where the temp root is itself a symlink (macOS /var).
+  if (!existsSync(given)) return;
+  // Whether the target is *nominally* inside the project. Canonicalize its
+  // containing directory rather than the path itself: the directory is a real
+  // directory, never the symlink under test, so this normalizes Windows drive-
+  // letter case and 8.3 short names -- which would otherwise make an in-repo
+  // path compare as external and skip the check entirely -- without following
+  // the final link. On POSIX the two forms already agree, so this is a no-op
+  // there.
+  const nominal = join(canonical(dirname(given)), basename(given));
+  // Named from outside the project: nothing was escaped, it was never inside.
+  if (!isInside(nominal, root)) return;
+
+  const real = canonical(given);
+  if (isInside(real, root)) return;
+
+  throw new Error(
+    `Refusing to read "${relative(root, nominal).split(sep).join('/') || given}": it is a link out of the project, `
+    + `resolving to ${real}.\n`
+    + 'File names and links are attacker-controlled on an untrusted pull request, and '
+    + 'reading one would put a file from outside the repository into Flecto\'s output.\n'
+    + 'Set FLECTO_ALLOW_SYMLINK_TARGETS=1 if this link is intentional.',
+  );
+}
+
 /**
  * Split a policy list that may arrive as an array or a comma-separated string.
  * @param {unknown} raw
@@ -162,29 +289,249 @@ export function resolvePolicyOptions(effective, provenance = {}) {
   return { policies, plugins, severityRemap };
 }
 
+/**
+ * Convert a glob pattern to the separators `fast-glob` requires.
+ *
+ * fast-glob only understands POSIX separators and treats a backslash as an
+ * escape character, so a Windows path used as a pattern matches nothing at all:
+ * `config\*.yaml` asks for a file literally named `config*.yaml`. Since
+ * PowerShell and cmd tab-completion produce backslash paths, that is the
+ * default way a Windows user would invoke Flecto, and the failure looks like
+ * "no files matched" rather than like a platform bug.
+ *
+ * The rewrite is deliberately **Windows-only**. On POSIX a backslash is a legal
+ * character in a filename *and* a meaningful glob escape, so rewriting there
+ * would break patterns that work today. On Windows a backslash can only ever be
+ * a separator — the filesystem forbids it in a name — so there is nothing to
+ * lose.
+ *
+ * Only patterns are rewritten. Resolved paths stay native, which is what every
+ * `fs` call and the snapshot key derivation expect.
+ * @param {string} pattern
+ * @param {NodeJS.Platform} [platform] Injectable so the Windows behavior is
+ *   testable from any host.
+ * @returns {string}
+ */
+export function normalizeGlobPattern(pattern, platform = process.platform) {
+  if (platform !== 'win32') return pattern;
+  return String(pattern).replaceAll('\\', '/');
+}
+
 /**
  * Expand file patterns from rc include/files and direct CLI inputs.
- * @param {{ cwd?: string, files?: string[], include?: string[], exclude?: string[] }} input
+ * @param {{
+ *  cwd?: string,
+ *  files?: string[],
+ *  include?: string[],
+ *  exclude?: string[],
+ *  platform?: NodeJS.Platform
+ * }} input
  * @returns {Promise<string[]>}
  */
 export async function resolveFiles(input) {
   const cwd = input.cwd ?? process.cwd();
+  const platform = input.platform ?? process.platform;
   const files = input.files ?? [];
   const include = input.include ?? [];
   const exclude = input.exclude ?? [];
-  const patterns = [...files, ...include].filter(Boolean);
+  const patterns = [...files, ...include]
+    .filter(Boolean)
+    .map((pattern) => normalizeGlobPattern(pattern, platform));
   if (patterns.length === 0) return [];
+  // `exclude` is matched against the same pattern syntax, so it needs the same
+  // rewrite -- an exclude that silently stops excluding is the worse failure.
+  const ignore = exclude.filter(Boolean).map((pattern) => normalizeGlobPattern(pattern, platform));
   const matches = await fg(patterns, {
     cwd,
     absolute: true,
     onlyFiles: true,
     unique: true,
-    ignore: exclude,
+    ignore,
     dot: true,
   });
+  // Back to native separators: everything downstream reads these off disk.
   return matches.map((p) => resolve(p));
 }
 
+/**
+ * Collect candidate files to sniff: YAML/JSON at the repo root plus, one level
+ * of recursion deep, the conventional manifest directories. Bounded by
+ * MAX_SNIFF_FILES so a large repo never turns `init` into a full-tree read.
+ * @param {string} cwd
+ * @param {string[]} rootFileNames
+ * @param {Set<string>} dirNames
+ * @returns {string[]} absolute paths, root files first
+ */
+function sniffCandidates(cwd, rootFileNames, dirNames) {
+  /** @type {string[]} */
+  const candidates = [];
+  const push = (abs) => {
+    if (candidates.length < MAX_SNIFF_FILES) candidates.push(abs);
+  };
+
+  for (const name of rootFileNames) {
+    if (SNIFF_EXTENSIONS.includes(extLower(name))) push(resolve(cwd, name));
+  }
+
+  for (const dir of MANIFEST_DIRS) {
+    if (!dirNames.has(dir)) continue;
+    for (const abs of walkYamlish(resolve(cwd, dir))) {
+      push(abs);
+      if (candidates.length >= MAX_SNIFF_FILES) break;
+    }
+  }
+
+  return candidates.slice(0, MAX_SNIFF_FILES);
+}
+
+/**
+ * Depth-first list of sniffable files under a directory, skipping node_modules
+ * and dot directories, capped by MAX_SNIFF_FILES so a deep tree cannot run away.
+ * @param {string} root
+ * @returns {string[]}
+ */
+function walkYamlish(root) {
+  /** @type {string[]} */
+  const out = [];
+  /** @type {string[]} */
+  const stack = [root];
+  while (stack.length > 0 && out.length < MAX_SNIFF_FILES) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (entry.name === 'node_modules' || entry.name.startsWith('.')) continue;
+        stack.push(join(dir, entry.name));
+      } else if (entry.isFile() && SNIFF_EXTENSIONS.includes(extLower(entry.name))) {
+        out.push(join(dir, entry.name));
+        if (out.length >= MAX_SNIFF_FILES) break;
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * @param {string} name
+ * @returns {string} lower-cased extension including the dot, or ''
+ */
+function extLower(name) {
+  const dot = name.lastIndexOf('.');
+  return dot === -1 ? '' : name.slice(dot).toLowerCase();
+}
+
+/**
+ * Parse a candidate file for detection, cheaply and defensively. Returns null
+ * for anything too large, unreadable, or unparseable — detection never fails a
+ * run, it just learns less. The byte cap is enforced before the read so a huge
+ * file is skipped rather than slurped.
+ * @param {string} abs
+ * @returns {unknown}
+ */
+function sniffParse(abs) {
+  try {
+    if (statSync(abs).size > MAX_SNIFF_BYTES) return null;
+    return parseContent(abs, readFileSync(abs, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * True when a parsed tree (single- or multi-document) contains a
+ * Kubernetes-shaped document: `apiVersion` + `kind`. A multi-document file is
+ * the identity-keyed wrapper, so its documents are one level down.
+ * @param {unknown} tree
+ * @returns {boolean}
+ */
+function hasKubernetesDocument(tree) {
+  if (!isPlainObjectLike(tree)) return false;
+  if (isKubernetesShaped(tree)) return true;
+  return Object.values(tree).some((value) => isKubernetesShaped(value));
+}
+
+/**
+ * @param {unknown} doc
+ * @returns {boolean}
+ */
+function isKubernetesShaped(doc) {
+  return isPlainObjectLike(doc)
+    && typeof doc.apiVersion === 'string' && doc.apiVersion.trim() !== ''
+    && typeof doc.kind === 'string' && doc.kind.trim() !== '';
+}
+
+/**
+ * @param {unknown} v
+ * @returns {v is Record<string, unknown>}
+ */
+function isPlainObjectLike(v) {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+
+/**
+ * Sniff the manifest locations for Kubernetes and SOPS signals. Content-based
+ * and cost-bounded; see MAX_SNIFF_FILES / MAX_SNIFF_BYTES. `.sops.yaml` is a
+ * plaintext creation-rules config, not an encrypted file, but its presence is
+ * still a reliable sign the repo uses SOPS, so it counts on its own.
+ * @param {string} cwd
+ * @param {string[]} rootFileNames
+ * @param {Set<string>} dirNames
+ * @returns {{
+ *   kubernetes: { files: string[] } | null,
+ *   sops: { files: string[], creationRules: boolean } | null
+ * }}
+ */
+function sniffManifestDirs(cwd, rootFileNames, dirNames) {
+  const candidates = sniffCandidates(cwd, rootFileNames, dirNames);
+
+  /** @type {Set<string>} */
+  const k8sRel = new Set();
+  /** @type {Set<string>} */
+  const sopsRel = new Set();
+  const creationRules = rootFileNames.some((name) => name === '.sops.yaml' || name === '.sops.yml');
+
+  for (const abs of candidates) {
+    const tree = sniffParse(abs);
+    if (tree == null) continue;
+    const rel = relative(cwd, abs).split(sep).join('/');
+    if (hasKubernetesDocument(tree)) k8sRel.add(rel);
+    if (encryptionState(tree) !== 'plaintext') sopsRel.add(rel);
+  }
+
+  return {
+    kubernetes: k8sRel.size > 0 ? { files: [...k8sRel].sort() } : null,
+    sops: sopsRel.size > 0 || creationRules
+      ? { files: [...sopsRel].sort(), creationRules }
+      : null,
+  };
+}
+
+/**
+ * Watch patterns for the directories that held Kubernetes manifests, plus the
+ * repo root when a manifest lived there. One pattern per conventional dir keeps
+ * the generated config short instead of listing every file.
+ * @param {string[]} relFiles
+ * @returns {string[]}
+ */
+function manifestWatchPatterns(relFiles) {
+  /** @type {Set<string>} */
+  const patterns = new Set();
+  for (const rel of relFiles) {
+    const top = rel.includes('/') ? rel.slice(0, rel.indexOf('/')) : null;
+    if (top && MANIFEST_DIRS.includes(top)) {
+      patterns.add(`${top}/${K8S_DIR_PATTERN}`);
+    } else {
+      patterns.add(K8S_ROOT_PATTERN);
+    }
+  }
+  return [...patterns].sort();
+}
+
 /**
  * Detect stack signals in a directory and map them to policy packs and file
  * patterns. Only built-in pack ids and patterns Flecto can actually parse are
@@ -235,6 +582,18 @@ export function detectStack(cwd = process.cwd()) {
     });
   }
 
+  const githubWorkflowsDir = resolve(cwd, '.github', 'workflows');
+  if (dirNames.has('.github') && existsSync(githubWorkflowsDir) && statSync(githubWorkflowsDir).isDirectory()) {
+    packs.push('github-actions');
+    files.push(GITHUB_ACTIONS_WORKFLOW_PATTERN);
+    signals.push({
+      id: 'github-actions',
+      evidence: ['.github/workflows/'],
+      pack: 'github-actions',
+      summary: 'Detected .github/workflows/ → enabled the `github-actions` policy pack and watched workflow YAML',
+    });
+  }
+
   const terraformFiles = fileNames.filter((name) => name.toLowerCase().endsWith('.tf')).sort();
   if (terraformFiles.length > 0) {
     signals.push({
@@ -266,6 +625,45 @@ export function detectStack(cwd = process.cwd()) {
     });
   }
 
+  // Content-based signals for the two shapes 3.0 was built around. Sniffed, not
+  // guessed from filenames, and bounded (#123). Enabling `kubernetes` on a repo
+  // that is not Kubernetes would produce confusing findings on the first run, so
+  // a manifest must actually carry apiVersion + kind to count.
+  const manifests = sniffManifestDirs(cwd, fileNames, dirNames);
+
+  if (manifests.kubernetes) {
+    packs.push('kubernetes');
+    const watched = manifestWatchPatterns(manifests.kubernetes.files);
+    files.push(...watched);
+    const shown = manifests.kubernetes.files.slice(0, 3);
+    const more = manifests.kubernetes.files.length - shown.length;
+    const evidenceList = more > 0 ? `${shown.join(', ')}, +${more} more` : shown.join(', ');
+    signals.push({
+      id: 'kubernetes',
+      evidence: manifests.kubernetes.files,
+      pack: 'kubernetes',
+      summary: `Detected Kubernetes manifests (${evidenceList}) → enabled the \`kubernetes\` policy pack and watched ${watched.join(', ')}`,
+    });
+  }
+
+  if (manifests.sops) {
+    packs.push('sops');
+    if (manifests.sops.files.length > 0) files.push(...manifests.sops.files);
+    const evidence = [
+      ...(manifests.sops.creationRules ? ['.sops.yaml'] : []),
+      ...manifests.sops.files,
+    ];
+    const watchedNote = manifests.sops.files.length > 0
+      ? ` and watched ${manifests.sops.files.join(', ')}`
+      : ' (no encrypted files found yet; the pack applies when they appear)';
+    signals.push({
+      id: 'sops',
+      evidence,
+      pack: 'sops',
+      summary: `Detected SOPS usage (${evidence.join(', ')}) → enabled the \`sops\` policy pack${watchedNote}`,
+    });
+  }
+
   return { signals, packs, files: [...new Set(files)] };
 }