mandrel-platform 1.1.0 → 1.3.0

package/scripts/check-action-pins.test.mjs

@@ -10,6 +10,12 @@
  * a full content scan with both a SHA-pinned (pass) and a tag-pinned (fail)
  * fixture. Pure helpers + a temp-dir fixture keep the whole pipeline offline.
  *
+ * The first-party ratchet block (Story #354 audit) covers what used to be a
+ * three-way blind spot: a self-reference on a moving ref passed this lint (as
+ * exempt), the portability lint's Rule 3 (which skips non-SHA refs), and
+ * check-first-party-pin-freshness.mjs (which files it under a non-failing
+ * informational note) all at once.
+ *
  * Run: node scripts/check-action-pins.test.mjs   (or `node --test scripts/`)
  */
 
@@ -138,7 +144,7 @@ test("scanContent fails a tag-pinned third-party uses", () => {
   assert.match(violations[0].reason, /not a full 40-char commit SHA/);
 });
 
-test("scanContent ignores first-party, local, docker, and comment lines", () => {
+test("scanContent ignores local, docker, and comment lines", () => {
   const yaml = [
     "# uses: actions/checkout@v4  (this is a comment example, must be ignored)",
     "    steps:",
@@ -146,11 +152,102 @@ test("scanContent ignores first-party, local, docker, and comment lines", () =>
     "      - uses: ./.github/actions/local-thing",
     "      - uses: docker://alpine:3.19",
   ].join("\n");
-  const { violations, scanned } = scanContent(yaml, "wf.yml");
-  assert.equal(scanned, 0); // none are third-party
+  const res = scanContent(yaml, "wf.yml");
+  assert.equal(res.scanned, 0); // none are third-party
+  assert.deepEqual(res.violations, []);
+  // The first-party ref IS counted now, and passes because it is SHA-pinned.
+  // A local `./path` and a `docker://` ref remain exempt from both classes.
+  assert.equal(res.firstPartyScanned, 1);
+  assert.deepEqual(res.firstPartyViolations, []);
+});
+
+// ---------------------------------------------------------------------------
+// First-party SHA ratchet (Story #354 audit)
+//
+// A first-party self-reference on a moving ref used to be green on all three
+// first-party guards at once: this ratchet skipped it as exempt, the
+// portability lint's Rule 3 skips any ref that is not already a 40-hex SHA,
+// and check-first-party-pin-freshness.mjs files it under an informational
+// note that never fails. These tests pin the hole shut.
+// ---------------------------------------------------------------------------
+
+test("scanContent flags a branch-pinned first-party self-reference", () => {
+  const yaml = "      - uses: dsj1984/mandrel-platform/.github/actions/gitleaks-scan@main";
+  const { firstPartyViolations, firstPartyScanned, violations } = scanContent(yaml, "wf.yml");
+  assert.equal(firstPartyScanned, 1);
+  assert.equal(firstPartyViolations.length, 1);
+  assert.equal(firstPartyViolations[0].line, 1);
+  assert.equal(firstPartyViolations[0].owner, "dsj1984/mandrel-platform");
+  assert.match(firstPartyViolations[0].reason, /not a full 40-char commit SHA/);
+  // Never misfiled as a third-party violation — the remediation differs.
   assert.deepEqual(violations, []);
 });
 
+test("scanContent flags a tag-pinned and a short-SHA first-party self-reference", () => {
+  const yaml = [
+    "      - uses: dsj1984/mandrel-platform/.github/workflows/pr-quality.yml@v1.1.0",
+    `      - uses: dsj1984/mandrel-platform/.github/actions/osv-scan@${SHORT}`,
+  ].join("\n");
+  const { firstPartyViolations } = scanContent(yaml, "wf.yml");
+  assert.equal(firstPartyViolations.length, 2);
+  assert.deepEqual(
+    firstPartyViolations.map((v) => v.line),
+    [1, 2],
+  );
+});
+
+test("scanContent ratchets a bare first-party self-reference carrying no subpath", () => {
+  // No subpath means no manifest for the freshness checker to resolve, but the
+  // ref still moves — so the ratchet must still apply.
+  const yaml = "      - uses: dsj1984/mandrel-platform@main";
+  const { firstPartyViolations, firstPartyScanned } = scanContent(yaml, "wf.yml");
+  assert.equal(firstPartyScanned, 1);
+  assert.equal(firstPartyViolations.length, 1);
+});
+
+test("scanContent honours --first-party-owner when ratcheting a fork's self-refs", () => {
+  const yaml = "      - uses: my-org/my-fork/.github/actions/thing@main";
+  const asFirstParty = scanContent(yaml, "wf.yml", "my-org/my-fork");
+  assert.equal(asFirstParty.firstPartyViolations.length, 1);
+  assert.deepEqual(asFirstParty.violations, []);
+
+  // Under the default owner the SAME line is a third-party violation instead —
+  // still caught, just under the other class.
+  const asThirdParty = scanContent(yaml, "wf.yml");
+  assert.equal(asThirdParty.violations.length, 1);
+  assert.deepEqual(asThirdParty.firstPartyViolations, []);
+});
+
+test("runLint / runCli are red on a branch-pinned first-party self-reference", () => {
+  const root = fixtureRepo({
+    workflow: [
+      "    steps:",
+      `      - uses: actions/checkout@${SHA} # v4`,
+      "      - uses: dsj1984/mandrel-platform/.github/actions/gitleaks-scan@main",
+    ].join("\n"),
+  });
+  try {
+    const res = runLint({
+      cwd: root,
+      workflowsDir: ".github/workflows",
+      actionsDir: ".github/actions",
+      firstPartyOwner: "dsj1984/mandrel-platform",
+    });
+    assert.equal(res.ok, false);
+    assert.equal(res.firstPartyViolations.length, 1);
+    assert.deepEqual(res.violations, []); // the third-party pin is fine
+
+    const errs = [];
+    const code = runCli(["--cwd", root], { log: () => {}, err: (m) => errs.push(m) });
+    assert.equal(code, 1);
+    assert.ok(errs.some((m) => /first-party self-reference\(s\) pinned to a moving ref/.test(m)));
+    // The remedy names the blast radius, not just the rule.
+    assert.ok(errs.some((m) => /inherited by every consumer/.test(m)));
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test("scanContent flags a short-SHA third-party pin", () => {
   const yaml = `      - uses: actions/setup-node@${SHORT}`;
   const { violations } = scanContent(yaml, "wf.yml");
@@ -205,7 +302,9 @@ test("runLint is green when every third-party action is SHA-pinned", () => {
       firstPartyOwner: "dsj1984/mandrel-platform",
     });
     assert.equal(res.ok, true);
-    assert.equal(res.scanned, 1); // only the third-party checkout counts
+    assert.equal(res.scanned, 1); // only the third-party checkout counts here
+    assert.equal(res.firstPartyScanned, 1); // the self-reference is counted separately
+    assert.deepEqual(res.firstPartyViolations, []);
   } finally {
     rmSync(root, { recursive: true, force: true });
   }

package/scripts/check-affected-mode.test.mjs

@@ -40,45 +40,18 @@ import { join, resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { tmpdir } from "node:os";
 
+import { stepByName, runScript } from "./lib/yaml-step.mjs";
+
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const WORKFLOW = ".github/workflows/pr-quality.yml";
 const content = readFileSync(join(repoRoot, WORKFLOW), "utf8");
 
 // ---------------------------------------------------------------------------
-// Minimal indentation-based extraction (dependency-free, mirrors
-// check-ci-required-aggregator.test.mjs). A step spans from its `- ` bullet to
-// the next sibling bullet at the same indent (or a dedent below it).
+// Local extraction helper. Step-block and `run:` extraction are shared via
+// scripts/lib/yaml-step.mjs; only the `if:` reader is specific to this suite,
+// which is the only one asserting on step gating.
 // ---------------------------------------------------------------------------
 
-function stepByName(text, name) {
-  const lines = text.split("\n");
-  const nameIdx = lines.findIndex((l) => /^\s+(- )?name:\s/.test(l) && l.includes(name));
-  assert.notEqual(nameIdx, -1, `step "${name}" not found`);
-  let start = -1;
-  for (let i = nameIdx; i >= 0; i--) {
-    if (/^\s*-\s/.test(lines[i])) {
-      start = i;
-      break;
-    }
-  }
-  assert.notEqual(start, -1, `opening bullet for step "${name}" not found`);
-  const bulletIndent = lines[start].match(/^(\s*)/)[1].length;
-  let end = lines.length;
-  for (let i = start + 1; i < lines.length; i++) {
-    if (/^\s*$/.test(lines[i])) continue;
-    const indent = lines[i].match(/^(\s*)/)[1].length;
-    if (indent < bulletIndent) {
-      end = i;
-      break;
-    }
-    if (indent === bulletIndent && /^\s*-\s/.test(lines[i])) {
-      end = i;
-      break;
-    }
-  }
-  return lines.slice(start, end).join("\n");
-}
-
 /** The (first) `if:` expression on a step block, trimmed. */
 function ifCondition(stepBlock) {
   const m = stepBlock.match(/^\s+if:\s*(.+?)\s*$/m);
@@ -86,25 +59,6 @@ function ifCondition(stepBlock) {
   return m[1].trim();
 }
 
-/** The dedented body of the step's `run: |` block scalar. */
-function runScript(stepBlock) {
-  const lines = stepBlock.split("\n");
-  const start = lines.findIndex((l) => /^\s+run:\s*\|\s*$/.test(l));
-  assert.notEqual(start, -1, "`run: |` block not found");
-  const runIndent = lines[start].match(/^(\s*)/)[1].length;
-  const body = [];
-  for (let i = start + 1; i < lines.length; i++) {
-    if (/^\s*$/.test(lines[i])) {
-      body.push("");
-      continue;
-    }
-    const indent = lines[i].match(/^(\s*)/)[1].length;
-    if (indent <= runIndent) break;
-    body.push(lines[i].slice(runIndent + 2));
-  }
-  return body.join("\n");
-}
-
 // ---------------------------------------------------------------------------
 // 1. GATING — coverage-gate steps gated OUT of affected mode; bypass step gated IN
 // ---------------------------------------------------------------------------