pr-checkmate 1.22.8 → 1.23.0

package/dist/core/checks/security/diff-security.js

@@ -0,0 +1,262 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diffSecurityCheck = void 0;
+const utils_1 = require("../../../utils");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const MD5_LABEL = 'MD5 (weak hash — use sha256 or stronger)';
+const SHA1_LABEL = 'SHA-1 (weak hash — use sha256 or stronger)';
+const SECURITY_PATTERNS = [
+    {
+        pattern: /^\+(?!\+).*dangerouslySetInnerHTML\s*=/,
+        label: 'dangerouslySetInnerHTML (XSS risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\.innerHTML\s*=/,
+        label: 'innerHTML assignment (XSS risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*document\.write\s*\(/,
+        label: 'document.write() (XSS risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+)(?![^'"`]*['"`]).*\beval\s*\(/,
+        label: 'eval() (code injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bnew\s+Function\s*\(/,
+        label: 'new Function() (code injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*__proto__\s*[=:[]/,
+        label: '__proto__ mutation (prototype pollution)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\.constructor\.prototype\b/,
+        label: 'constructor.prototype access (prototype pollution)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]md5['"]/,
+        label: MD5_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]sha1['"]/,
+        label: SHA1_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bcreateDecipher\s*\(/,
+        label: 'deprecated createDecipher() — use createDecipheriv()',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bcreateCipher\s*\(/,
+        label: 'deprecated createCipher() — use createCipheriv()',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/,
+        label: "CORS wildcard origin: '*' (allows any domain)",
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/,
+        label: "Access-Control-Allow-Origin: '*' header (CORS wildcard)",
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|http\.get|http\.request)\s*\(\s*['"]http:\/\//,
+        label: 'Insecure HTTP (non-HTTPS) in external call',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*(exec|execSync|spawn|spawnSync)\s*\(\s*`[^`]*\$\{/,
+        label: 'exec/spawn with template literal (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*(exec|execSync)\s*\(\s*['"][^'"]*['"\s]*\+/,
+        label: 'exec/spawn with string concatenation (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\b(query|execute|raw)\s*\(\s*`[^`]*\$\{/,
+        label: 'SQL query with template literal interpolation (SQL injection risk)',
+        severity: 'error',
+    },
+    {
+        // A quoted string that contains a whole SQL keyword, concatenated with a
+        // variable — the real injection shape. Word boundaries + the quote context
+        // stop identifiers like `insertions + deletions` from false-positiving.
+        pattern: /^\+(?!\+).*['"`][^'"`]*\b(SELECT|INSERT|UPDATE|DELETE|WHERE)\b[^'"`]*['"`]\s*\+\s*\w/i,
+        label: 'SQL string concatenation (SQL injection risk)',
+        severity: 'error',
+    },
+];
+/** Python-specific dangerous constructs, scanned in *.py diffs. */
+const PYTHON_SECURITY_PATTERNS = [
+    { pattern: /^\+(?!\+).*\beval\s*\(/, label: 'eval() (code injection risk)', severity: 'error' },
+    { pattern: /^\+(?!\+).*\bexec\s*\(/, label: 'exec() (code injection risk)', severity: 'error' },
+    {
+        pattern: /^\+(?!\+).*\bos\.system\s*\(/,
+        label: 'os.system() (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bsubprocess\.\w+\([^)]*shell\s*=\s*True/,
+        label: 'subprocess with shell=True (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bpickle\.loads?\s*\(/,
+        label: 'pickle load (insecure deserialization)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\byaml\.load\s*\((?![^)]*Safe)/,
+        label: 'yaml.load without SafeLoader (unsafe deserialization)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bhashlib\.md5\s*\(/,
+        label: MD5_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bhashlib\.sha1\s*\(/,
+        label: SHA1_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bverify\s*=\s*False\b/,
+        label: 'TLS verification disabled (verify=False)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*['"][^'"]*\b(SELECT|INSERT|UPDATE|DELETE)\b[^'"]*['"]\s*%\s*/i,
+        label: 'SQL string formatting (SQL injection risk)',
+        severity: 'error',
+    },
+];
+/** Go-specific dangerous constructs, scanned in *.go diffs. */
+const GO_SECURITY_PATTERNS = [
+    {
+        pattern: /^\+(?!\+).*\bmd5\.New\s*\(/,
+        label: MD5_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bsha1\.New\s*\(/,
+        label: SHA1_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*InsecureSkipVerify\s*:\s*true/,
+        label: 'InsecureSkipVerify: true (TLS verification disabled)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bexec\.Command\s*\([^)]*\+/,
+        label: 'exec.Command with string concatenation (command injection risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bfmt\.Sprintf\s*\([^)]*\b(SELECT|INSERT|UPDATE|DELETE)\b/i,
+        label: 'SQL built with fmt.Sprintf (SQL injection risk)',
+        severity: 'warn',
+    },
+    { pattern: /^\+(?!\+).*"crypto\/des"/, label: 'DES (weak cipher)', severity: 'warn' },
+];
+/** Kotlin/Java-specific dangerous constructs, scanned in *.kt/*.kts/*.java diffs. */
+const KOTLIN_SECURITY_PATTERNS = [
+    {
+        pattern: /^\+(?!\+).*\bRuntime\.getRuntime\(\)\.exec\s*\(/,
+        label: 'Runtime.exec() (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bMessageDigest\.getInstance\s*\(\s*"(MD5|SHA-1)"/,
+        label: 'weak hash (MD5/SHA-1 via MessageDigest — use SHA-256+)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bCipher\.getInstance\s*\(\s*"(DES|.*ECB)/,
+        label: 'weak cipher (DES / ECB mode)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*ALLOW_ALL_HOSTNAME_VERIFIER/,
+        label: 'ALLOW_ALL_HOSTNAME_VERIFIER (TLS hostname verification disabled)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bObjectInputStream\b/,
+        label: 'ObjectInputStream (insecure deserialization risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*"[^"]*\b(SELECT|INSERT|UPDATE|DELETE)\b[^"]*"\s*\+\s*\w/i,
+        label: 'SQL string concatenation (SQL injection risk)',
+        severity: 'error',
+    },
+];
+const JS_GLOBS = ['*.ts', '*.tsx', '*.js', '*.jsx', '*.mjs', '*.cjs'];
+/** Scan a diff with a pattern set, accumulating matches into severity buckets. */
+function scanInto(stdout, patterns, errors, warnings) {
+    for (const line of stdout.split('\n')) {
+        // Match against the comment-stripped line so `eval(x)` in a comment isn't
+        // flagged, but report the original line for context.
+        const scanned = (0, findings_1.stripInlineComment)(line);
+        for (const { pattern, label, severity } of patterns) {
+            if (pattern.test(scanned)) {
+                const bucket = severity === 'error' ? errors : warnings;
+                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
+            }
+        }
+    }
+}
+exports.diffSecurityCheck = {
+    name: 'Diff Security',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.diffSecurity?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        try {
+            const errors = {};
+            const warnings = {};
+            // JS/TS patterns always run; language-specific sets scan their own globs
+            // only when that language is present, so a Python repo gets Python rules.
+            scanInto(await (0, findings_1.diffAddedLines)(ctx, JS_GLOBS), SECURITY_PATTERNS, errors, warnings);
+            if (ctx.languages.includes('python')) {
+                scanInto(await (0, findings_1.diffAddedLines)(ctx, ['*.py']), PYTHON_SECURITY_PATTERNS, errors, warnings);
+            }
+            if (ctx.languages.includes('go')) {
+                scanInto(await (0, findings_1.diffAddedLines)(ctx, ['*.go']), GO_SECURITY_PATTERNS, errors, warnings);
+            }
+            if (ctx.languages.includes('kotlin')) {
+                const ktOut = await (0, findings_1.diffAddedLines)(ctx, ['*.kt', '*.kts', '*.java']);
+                scanInto(ktOut, KOTLIN_SECURITY_PATTERNS, errors, warnings);
+            }
+            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+                prefix: 'Diff Security',
+                errorSummary: n => `${n} issue(s)`,
+                warningSummary: n => `${n} warning(s)`,
+                sampleLimit: 3,
+                ignore: ctx.config.diffSecurity?.ignore,
+            });
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/security/dockerfile-security.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const dockerfileSecurityCheck: Check;

package/dist/core/checks/security/dockerfile-security.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dockerfileSecurityCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const DOCKERFILE_GLOBS = ['**/Dockerfile', '**/Dockerfile.*', '**/*.Dockerfile'];
+/** Common Dockerfile security smells, matched on added diff lines. */
+const DOCKER_PATTERNS = [
+    {
+        pattern: /^\+(?!\+)\s*FROM\s+\S+:latest\b/i,
+        label: 'FROM …:latest (pin the base image to a version/digest)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+)\s*USER\s+root\b/i,
+        label: 'USER root (run the container as a non-root user)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\b(?:curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(?:sh|bash)\b/i,
+        label: 'piping a download straight to a shell (curl/wget … | sh)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+)\s*ADD\s+https?:\/\//i,
+        label: 'ADD from a URL (prefer COPY, or verify a checksum)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+)\s*(?:ENV|ARG)\s+\w*(?:PASSWORD|SECRET|TOKEN|API_?KEY|ACCESS_KEY)\w*\s*[=\s]/i,
+        label: 'secret baked into ENV/ARG (use build secrets / runtime injection)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*(?:--no-check-certificate|--insecure)\b/,
+        label: 'insecure download flag (--insecure / --no-check-certificate)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+)\s*RUN\s+.*\bsudo\b/,
+        label: 'sudo inside RUN (unnecessary and risky in a container build)',
+        severity: 'warn',
+    },
+];
+function scanDiff(stdout) {
+    const errors = {};
+    const warnings = {};
+    for (const line of stdout.split('\n')) {
+        if (line.includes('pr-checkmate-ignore'))
+            continue;
+        for (const { pattern, label, severity } of DOCKER_PATTERNS) {
+            if (pattern.test(line)) {
+                const bucket = severity === 'error' ? errors : warnings;
+                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
+            }
+        }
+    }
+    return { errors, warnings };
+}
+exports.dockerfileSecurityCheck = {
+    name: 'Dockerfile Security',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.dockerfileSecurity?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        const files = await (0, targets_1.resolveTargetFiles)(ctx, ['*']);
+        if (files === null)
+            return (0, types_1.skip)('git unavailable');
+        const dockerfiles = files.filter(f => (0, utils_1.matchesAnyGlob)(f, DOCKERFILE_GLOBS));
+        if (dockerfiles.length === 0)
+            return (0, types_1.pass)();
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...dockerfiles], { cwd: ctx.cwd });
+            const { errors, warnings } = scanDiff(stdout);
+            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+                prefix: 'Dockerfile Security',
+                errorSummary: n => `${n} issue(s)`,
+                warningSummary: n => `${n} warning(s)`,
+                sampleLimit: 3,
+                ignore: ctx.config.dockerfileSecurity?.ignore,
+            });
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Dockerfile Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/security/migration-safety.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const migrationSafetyCheck: Check;

package/dist/core/checks/security/migration-safety.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrationSafetyCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * Paths treated as database migrations. A client overrides via
+ * `migrationSafety.paths` (REPLACES this list).
+ */
+const DEFAULT_MIGRATION_GLOBS = [
+    '**/migrations/**',
+    '**/migrate/**',
+    '**/db/migrate/**', // Rails
+    '**/versions/**', // Alembic
+    '**/*.sql',
+];
+/** Destructive / locking operations, matched on added diff lines. */
+const DDL_PATTERNS = [
+    { pattern: /^\+(?!\+).*\bDROP\s+TABLE\b/i, label: 'DROP TABLE — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bDROP\s+COLUMN\b/i, label: 'DROP COLUMN — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bTRUNCATE\b/i, label: 'TRUNCATE — irreversible data loss' },
+    {
+        pattern: /^\+(?!\+).*\bRENAME\s+(?:COLUMN|TABLE)\b/i,
+        label: 'RENAME — breaks code still reading the old name',
+    },
+    { pattern: /^\+(?!\+).*\bDROP\s+(?:CONSTRAINT|INDEX)\b/i, label: 'DROP CONSTRAINT/INDEX' },
+    {
+        pattern: /^\+(?!\+).*\bALTER\s+COLUMN\b.*\bSET\s+NOT\s+NULL\b/i,
+        label: 'SET NOT NULL — locks the table, rejects existing NULL rows',
+    },
+    // Alembic (Python) operations.
+    { pattern: /^\+(?!\+).*\bop\.drop_column\b/, label: 'op.drop_column — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bop\.drop_table\b/, label: 'op.drop_table — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bop\.drop_constraint\b/, label: 'op.drop_constraint' },
+];
+const NOT_NULL_NO_DEFAULT = 'ADD COLUMN … NOT NULL without DEFAULT — fails/locks on a non-empty table';
+/**
+ * A new NOT NULL column with no DEFAULT: the classic migration that breaks on a
+ * populated table. Split out because it's a conjunction (ADD COLUMN + NOT NULL,
+ * and NO DEFAULT on the line), not a single keyword.
+ */
+function isAddNotNullNoDefault(line) {
+    return (/^\+(?!\+)/.test(line) &&
+        /\bADD\s+COLUMN\b/i.test(line) &&
+        /\bNOT\s+NULL\b/i.test(line) &&
+        !/\bDEFAULT\b/i.test(line));
+}
+/** Bucket dangerous added lines by risk label, honouring the opt-out directive. */
+function scan(stdout, findings) {
+    for (const line of stdout.split('\n')) {
+        if (line.includes('pr-checkmate-ignore'))
+            continue;
+        for (const { pattern, label } of DDL_PATTERNS) {
+            if (pattern.test(line))
+                (findings[label] ?? (findings[label] = [])).push(line.slice(1).trim().substring(0, 120));
+        }
+        if (isAddNotNullNoDefault(line)) {
+            (findings[NOT_NULL_NO_DEFAULT] ?? (findings[NOT_NULL_NO_DEFAULT] = [])).push(line.slice(1).trim().substring(0, 120));
+        }
+    }
+}
+exports.migrationSafetyCheck = {
+    name: 'Migration Safety',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.migrationSafety?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        // Not sourcePath-scoped: migrations commonly live outside `src` (db/, alembic/).
+        // ignoreDirs still applies via resolveTargetFiles.
+        const files = await (0, targets_1.resolveTargetFiles)(ctx, ['*']);
+        if (files === null)
+            return (0, types_1.skip)('git unavailable');
+        const globs = ctx.config.migrationSafety?.paths ?? DEFAULT_MIGRATION_GLOBS;
+        const migrationFiles = files.filter(f => (0, utils_1.matchesAnyGlob)(f, globs));
+        if (migrationFiles.length === 0)
+            return (0, types_1.pass)();
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', [
+                'diff',
+                '--unified=0',
+                ctx.baseSha,
+                ctx.headSha ?? 'HEAD',
+                '--',
+                ...migrationFiles,
+            ], { cwd: ctx.cwd });
+            const findings = {};
+            scan(stdout, findings);
+            if ((0, findings_1.bucketTotal)(findings) === 0)
+                return (0, types_1.pass)();
+            const sev = (0, findings_1.severityEmitter)(ctx.config.migrationSafety?.severity, 'warn');
+            (0, findings_1.logFindings)(findings, {
+                prefix: 'Migration Safety',
+                sampleLimit: 2,
+                isError: sev.icon === '❌',
+            });
+            const summary = Object.entries(findings)
+                .map(([label, arr]) => `${arr.length}× ${label.split(' — ')[0]}`)
+                .join(', ');
+            return sev.emit(summary);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Migration Safety]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/{security.d.ts → security/security.d.ts}

@@ -1,4 +1,4 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 /**
  * Secret scanning via the bundled gitleaks package. Language-agnostic — runs on
  * every repo (Node, Python, C++, mobile). Secrets found → fail (blocking).

package/dist/core/checks/{security.js → security/security.js}

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.securityCheck = void 0;
-const config_1 = require("../../config");
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const config_1 = require("../../../config");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
 /**
  * Secret scanning via the bundled gitleaks package. Language-agnostic — runs on
  * every repo (Node, Python, C++, mobile). Secrets found → fail (blocking).

package/dist/core/checks/{sensitive-file-guard.d.ts → security/sensitive-file-guard.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const sensitiveFileGuardCheck: Check;

package/dist/core/checks/{sensitive-file-guard.js → security/sensitive-file-guard.js}

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sensitiveFileGuardCheck = void 0;
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
-const findings_1 = require("./findings");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
 const SENSITIVE_CATEGORIES = [
     {
         label: 'Environment files (.env)',

package/dist/core/checks/security/workflow-security.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const workflowSecurityCheck: Check;

package/dist/core/checks/security/workflow-security.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.workflowSecurityCheck = void 0;
+const utils_1 = require("../../../utils");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * GitHub Actions workflow risks, matched on added diff lines of workflow files.
+ * These are the high-frequency supply-chain / injection footguns.
+ */
+const WORKFLOW_PATTERNS = [
+    {
+        // Untrusted PR-controlled input interpolated into an expression — the classic
+        // `run:` script-injection vector when it reaches a shell.
+        pattern: /^\+(?!\+).*\$\{\{\s*github\.event\.(?:issue|pull_request|comment|review|discussion|head_commit|commits)[^}]*\.(?:title|body|head_ref|ref|label|name|email|message|url)/,
+        label: 'untrusted github.event input in expression (script injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\$\{\{\s*github\.head_ref\s*\}\}/,
+        label: 'github.head_ref interpolation (injection risk — use an env var)',
+        severity: 'warn',
+    },
+    {
+        // Third-party action not pinned to a full 40-char commit SHA.
+        pattern: /^\+(?!\+).*\buses:\s*['"]?[\w.-]+\/[\w.-]+@(?![0-9a-fA-F]{40}\b)[\w./-]+/,
+        label: 'action not pinned to a full commit SHA (supply-chain risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bpull_request_target\b/,
+        label: 'pull_request_target trigger (runs with repo secrets on untrusted PRs)',
+        severity: 'warn',
+    },
+];
+function scanDiff(stdout) {
+    const errors = {};
+    const warnings = {};
+    for (const line of stdout.split('\n')) {
+        for (const { pattern, label, severity } of WORKFLOW_PATTERNS) {
+            if (pattern.test(line)) {
+                const bucket = severity === 'error' ? errors : warnings;
+                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
+            }
+        }
+    }
+    return { errors, warnings };
+}
+exports.workflowSecurityCheck = {
+    name: 'Workflow Security',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.workflowSecurity?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        try {
+            const stdout = await (0, findings_1.diffAddedLines)(ctx, [
+                '.github/workflows/*.yml',
+                '.github/workflows/*.yaml',
+            ]);
+            const { errors, warnings } = scanDiff(stdout);
+            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+                prefix: 'Workflow Security',
+                errorSummary: n => `${n} issue(s)`,
+                warningSummary: n => `${n} warning(s)`,
+                sampleLimit: 3,
+                ignore: ctx.config.workflowSecurity?.ignore,
+            });
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Workflow Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/context.js

@@ -30,6 +30,19 @@ async function resolveRef(cwd, ref) {
     return stdout.trim() || undefined;
 }
 async function resolveDiffRange(cwd, opts) {
+    // Pre-commit mode: diff HEAD against the current index. `git write-tree`
+    // materialises the staged index as a real tree object, so every check that
+    // diffs baseSha..headSha sees exactly the staged changes — no per-check code.
+    if (opts.staged) {
+        try {
+            const head = (await (0, execa_1.execa)('git', ['rev-parse', 'HEAD'], { cwd })).stdout.trim();
+            const tree = (await (0, execa_1.execa)('git', ['write-tree'], { cwd })).stdout.trim();
+            return { baseSha: head, headSha: tree };
+        }
+        catch {
+            return {};
+        }
+    }
     if (opts.baseSha || opts.headSha) {
         return { baseSha: opts.baseSha, headSha: opts.headSha };
     }
@@ -81,5 +94,6 @@ async function buildContext(opts = {}) {
         write: opts.write ?? false,
         baseSha,
         headSha,
+        cache: new Map(),
     };
 }