tamperward 2.25.0 → 2.25.2

package/dist/cli/index.js

@@ -526,7 +526,22 @@ function defaultPolicy(version = 1) {
         "**/codecov.yml",
         "**/.codecov.yml"
       ],
-      ci: [".github/workflows/**"],
+      // A workflow's checks can live in a composite action it `uses:` (the workflow
+      // keeps `uses: ./.github/actions/test` while the action's `run: npm test`
+      // becomes `echo ok`), and in the entry file of a CI system that is not GitHub
+      // Actions at all. Each is read by ci-tampering: the action's `runs.steps` get
+      // the workflow's removal/neutralisation pass, the other systems' entry files
+      // the generic check-line pass and no trigger logic (issue #437).
+      ci: [
+        ".github/workflows/**",
+        ".github/actions/**/action.y?(a)ml",
+        ".gitlab-ci.yml",
+        ".circleci/config.yml",
+        "Jenkinsfile",
+        "azure-pipelines.yml",
+        "bitbucket-pipelines.yml",
+        ".travis.yml"
+      ],
       // Recorded expected outputs. An assertion stored as data is still an assertion;
       // rewriting it from current output is the snapshot-update move the affordance
       // experiment measured at a 70% attempt / 100% through rate (snapshot-rewrite).
@@ -3456,9 +3471,62 @@ function assertedType(node) {
   while (ts.isParenthesizedTypeNode(t)) t = t.type;
   return t;
 }
-function isDoubleCast(node) {
+function bareKind(type) {
+  let x = type;
+  while (ts.isParenthesizedTypeNode(x)) x = x.type;
+  switch (x.kind) {
+    case ts.SyntaxKind.AnyKeyword:
+      return "any";
+    case ts.SyntaxKind.NeverKeyword:
+      return "never";
+    case ts.SyntaxKind.UnknownKeyword:
+      return "unknown";
+    case ts.SyntaxKind.ObjectKeyword:
+      return "objectish";
+  }
+  if (ts.isTypeLiteralNode(x) && x.members.length === 0) return "empty";
+  if (ts.isTypeReferenceNode(x) && ts.isIdentifier(x.typeName) && !x.typeArguments) {
+    if (x.typeName.text === "Object") return "objectish";
+    if (x.typeName.text === "const") return "const";
+  }
+  return null;
+}
+function kindOfType(type, resolveName) {
+  const bare = bareKind(type);
+  if (bare) return bare;
+  let x = type;
+  while (ts.isParenthesizedTypeNode(x)) x = x.type;
+  if (ts.isTypeReferenceNode(x) && ts.isIdentifier(x.typeName) && !x.typeArguments) return resolveName(x.typeName.text);
+  return null;
+}
+function buildAliasMap(sf) {
+  const decls = /* @__PURE__ */ new Map();
+  const collect2 = (node) => {
+    if (ts.isTypeAliasDeclaration(node) && (!node.typeParameters || node.typeParameters.length === 0)) decls.set(node.name.text, node.type);
+    ts.forEachChild(node, collect2);
+  };
+  collect2(sf);
+  const resolve16 = (name, seen) => {
+    if (seen.has(name)) return null;
+    seen.add(name);
+    const t = decls.get(name);
+    return t ? kindOfType(t, (n) => resolve16(n, seen)) : null;
+  };
+  const resolved = /* @__PURE__ */ new Map();
+  for (const name of decls.keys()) {
+    const k = resolve16(name, /* @__PURE__ */ new Set());
+    if (k) resolved.set(name, k);
+  }
+  return resolved;
+}
+function assertedLaunderKind(node, aliasMap) {
+  return kindOfType(assertedType(node), (n) => aliasMap.get(n) ?? null);
+}
+function isDoubleCast(node, aliasMap) {
   const inner = unparenthesized(node.expression);
-  return (ts.isAsExpression(inner) || ts.isTypeAssertionExpression(inner)) && assertedType(inner).kind === ts.SyntaxKind.UnknownKeyword;
+  if (!(ts.isAsExpression(inner) || ts.isTypeAssertionExpression(inner))) return false;
+  const k = assertedLaunderKind(inner, aliasMap ?? EMPTY_ALIASES);
+  return k != null && DOUBLE_CAST_INNER.has(k);
 }
 function surfaceOf(path, src) {
   const sf = parseSource(path, src, scriptKind(path));
@@ -3467,20 +3535,26 @@ function surfaceOf(path, src) {
   if (diagnostics.length > 0) return null;
   const surface = { type: 0, nonNull: 0, assertions: [] };
   const lines = src.split("\n");
+  const aliasMap = buildAliasMap(sf);
   const record = (kind, node) => {
     const line = sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
     surface.assertions.push({ kind, line, text: node.getText(sf).replace(/\s+/g, " "), lineText: (lines[line - 1] ?? "").trim() });
     if (kind === "type") surface.type++;
     else surface.nonNull++;
   };
+  const launderInner = /* @__PURE__ */ new Set();
+  const collectInners = (node) => {
+    if ((ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) && isDoubleCast(node, aliasMap)) launderInner.add(unparenthesized(node.expression));
+    ts.forEachChild(node, collectInners);
+  };
+  collectInners(sf);
   const isRow4OrHonest = (node) => {
-    const type = assertedType(node);
-    if (type.kind === ts.SyntaxKind.AnyKeyword || type.kind === ts.SyntaxKind.UnknownKeyword) return true;
-    return ts.isTypeReferenceNode(type) && ts.isIdentifier(type.typeName) && type.typeName.text === "const";
+    const k = assertedLaunderKind(node, aliasMap);
+    return k === "any" || k === "never" || k === "unknown" || k === "const";
   };
   const visit = (node) => {
     if (ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) {
-      if (!isDoubleCast(node) && !isRow4OrHonest(node)) record("type", node);
+      if (!isDoubleCast(node, aliasMap) && !isRow4OrHonest(node) && !launderInner.has(node)) record("type", node);
     } else if (ts.isNonNullExpression(node)) {
       record("non-null", node);
     }
@@ -3515,7 +3589,7 @@ function unmatchedAfter(before, after) {
   }
   return out3;
 }
-var RULE2, DECLARATION, OUT_OF_BUDGET_PATH, GENERATED_HEADER, HEADER_LINES, tsCastGrowth;
+var RULE2, DECLARATION, OUT_OF_BUDGET_PATH, GENERATED_HEADER, HEADER_LINES, DOUBLE_CAST_INNER, EMPTY_ALIASES, tsCastGrowth;
 var init_ts_cast_growth = __esm({
   "src/detectors/ts-cast-growth.ts"() {
     "use strict";
@@ -3529,6 +3603,8 @@ var init_ts_cast_growth = __esm({
     OUT_OF_BUDGET_PATH = /(?:^|\/)(?:node_modules|vendor|third_party|dist|build|generated|__generated__)\/|\.(?:generated|gen)\.[cm]?[jt]sx?$/;
     GENERATED_HEADER = /@generated\b|\bAUTO-?GENERATED\b|\bDO NOT EDIT\b/i;
     HEADER_LINES = 20;
+    DOUBLE_CAST_INNER = /* @__PURE__ */ new Set(["any", "never", "unknown", "empty", "objectish"]);
+    EMPTY_ALIASES = /* @__PURE__ */ new Map();
     tsCastGrowth = {
       id: RULE2,
       surface: ["file"],
@@ -3570,13 +3646,51 @@ var init_ts_cast_growth = __esm({
 });
 
 // src/detectors/ts-any-cast.ts
-function countAny(src) {
-  const r = { cast: 0, broad: 0, double: 0 };
+function commentIsLiveDirective(text) {
+  let inner = text;
+  if (inner.startsWith("//")) inner = inner.replace(/^\/+/, "");
+  else inner = inner.replace(/^\/\*+/, "").replace(/\*+\/$/, "");
+  for (const raw of inner.split("\n")) {
+    if (DIRECTIVE_START.test(raw.replace(/^\s*\*+/, "").trim())) return true;
+  }
+  return false;
+}
+function countLiveDirectives(src) {
+  let n = 0;
+  try {
+    const scanner = ts.createScanner(
+      ts.ScriptTarget.Latest,
+      /* skipTrivia */
+      false,
+      ts.LanguageVariant.Standard,
+      src
+    );
+    let tok = scanner.scan();
+    while (tok !== ts.SyntaxKind.EndOfFileToken) {
+      if (tok === ts.SyntaxKind.SingleLineCommentTrivia || tok === ts.SyntaxKind.MultiLineCommentTrivia) {
+        if (commentIsLiveDirective(scanner.getTokenText())) n++;
+      }
+      tok = scanner.scan();
+    }
+  } catch {
+  }
+  return n;
+}
+function countAny(src, path) {
+  const r = { cast: 0, never: 0, broad: 0, double: 0, suppress: 0, jsdoc: 0 };
+  r.suppress = countLiveDirectives(src);
+  r.jsdoc = JS_FILE.test(path) ? countMatches(src, JSDOC_ANY_CAST) : 0;
   try {
     const sf = parseSource("f.ts", src);
     if (!sf) return r;
+    const aliasMap = buildAliasMap(sf);
     const visit = (node) => {
-      if ((ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) && isDoubleCast(node)) r.double++;
+      if (ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) {
+        const k = assertedLaunderKind(node, aliasMap);
+        if (k === "any") r.cast++;
+        else if (k === "never") r.never++;
+        if (isDoubleCast(node, aliasMap)) r.double++;
+      }
       if (node.kind === ts.SyntaxKind.AnyKeyword) {
         let target = node;
         let p = target.parent;
@@ -3585,8 +3699,7 @@ function countAny(src) {
           p = p.parent;
         }
         const isCast = p && ts.isAsExpression(p) && p.type === target || p && ts.isTypeAssertionExpression(p) && p.type === target;
-        if (isCast) r.cast++;
-        else r.broad++;
+        if (!isCast) r.broad++;
       }
       ts.forEachChild(node, visit);
     };
@@ -3595,22 +3708,33 @@ function countAny(src) {
   }
   return r;
 }
-function lineHasDoubleCast(line) {
+function lineHasLiveDirective(line) {
+  return countLiveDirectives(line) > 0 || FRAGMENT_DIRECTIVE.test(line);
+}
+function lineHasRow4Cast(line, aliasMap) {
   const sf = parseSource("line.ts", line);
   if (!sf) return false;
   let found = false;
   const visit = (n) => {
     if (found) return;
-    if ((ts.isAsExpression(n) || ts.isTypeAssertionExpression(n)) && isDoubleCast(n)) {
-      found = true;
-      return;
+    if (ts.isAsExpression(n) || ts.isTypeAssertionExpression(n)) {
+      const k = assertedLaunderKind(n, aliasMap);
+      if (k === "any" || k === "never" || isDoubleCast(n, aliasMap)) {
+        found = true;
+        return;
+      }
     }
     ts.forEachChild(n, visit);
   };
   visit(sf);
   return found;
 }
-var BLOCK_RULE, WARN_RULE, DOUBLE_CAST, SUPPRESS, JSDOC_ANY_CAST, JS_FILE, countMatches, NARROW_LINE, BROAD_LINE, BLOCK_REMEDIATION, WARN_REMEDIATION, tsAnyCast;
+function aliasMapForAddedLines(c) {
+  const snippet = addedLines(c).map((l) => l.content).join("\n");
+  const sf = parseSource("lines.ts", snippet);
+  return sf ? buildAliasMap(sf) : /* @__PURE__ */ new Map();
+}
+var BLOCK_RULE, WARN_RULE, JSDOC_ANY_CAST, JS_FILE, countMatches, DIRECTIVE_START, NARROW_LINE, BROAD_LINE, FRAGMENT_DIRECTIVE, BLOCK_REMEDIATION, WARN_REMEDIATION, tsAnyCast;
 var init_ts_any_cast = __esm({
   "src/detectors/ts-any-cast.ts"() {
     "use strict";
@@ -3622,13 +3746,13 @@ var init_ts_any_cast = __esm({
     init_ts_cast_growth();
     BLOCK_RULE = "ts-any-cast";
     WARN_RULE = "ts-any-launder";
-    DOUBLE_CAST = /\bas\s+\(*\s*unknown\s*\)*\s+as\b/g;
-    SUPPRESS = /@ts-(?:ignore|expect-error|nocheck)\b/g;
-    JSDOC_ANY_CAST = /\/\*\*\s*@type\s*\{\s*any\s*\}\s*\*\/\s*\(/g;
+    JSDOC_ANY_CAST = /\/\*\*\s*@type\s*\{\s*(?:any|\*|\?)\s*\}\s*\*\/\s*\(/g;
     JS_FILE = /\.(?:js|jsx|mjs|cjs)$/;
     countMatches = (s, re) => (s.match(re) || []).length;
-    NARROW_LINE = /\bas\s+\(*\s*any\b|<\s*any\s*>|@ts-(?:ignore|expect-error|nocheck)\b/;
+    DIRECTIVE_START = /^@ts-(?:ignore|expect-error|nocheck)\b/;
+    NARROW_LINE = /\bas\s+\(*\s*any\b|<\s*any\s*>/;
     BROAD_LINE = /:\s*any\b|<[^<>]*\bany\b[^<>]*>/;
+    FRAGMENT_DIRECTIVE = /^\s*\*?\s*@ts-(?:ignore|expect-error|nocheck)\b/;
     BLOCK_REMEDIATION = "Fix the underlying type instead of silencing the checker; do not cast to `any`.";
     WARN_REMEDIATION = "Prefer a precise type or `unknown` + a guard over `any` here \u2014 flagged for review.";
     tsAnyCast = {
@@ -3642,15 +3766,17 @@ var init_ts_any_cast = __esm({
           const inTest = protectedCategory(c.path, policy) === "tests";
           if (c.after != null && c.op !== "delete") {
             const before = c.before ?? "";
-            const a = countAny(c.after);
-            const b = countAny(before);
+            const a = countAny(c.after, c.path);
+            const b = countAny(before, c.path);
             const dCast = a.cast - b.cast;
+            const dNever = a.never - b.never;
             const dBroad = a.broad - b.broad;
-            const dDouble = Math.max(a.double - b.double, countMatches(c.after, DOUBLE_CAST) - countMatches(before, DOUBLE_CAST));
-            const dSuppr = countMatches(c.after, SUPPRESS) - countMatches(before, SUPPRESS);
-            const dJsdoc = JS_FILE.test(c.path) ? countMatches(c.after, JSDOC_ANY_CAST) - countMatches(before, JSDOC_ANY_CAST) : 0;
+            const dDouble = a.double - b.double;
+            const dSuppr = a.suppress - b.suppress;
+            const dJsdoc = a.jsdoc - b.jsdoc;
             const blockReasons = [];
             if (dCast > 0) blockReasons.push("`as any` cast");
+            if (dNever > 0) blockReasons.push("`as never` cast");
             if (dDouble > 0) blockReasons.push("`as unknown as` double cast");
             if (dSuppr > 0) blockReasons.push("@ts-ignore/@ts-expect-error/@ts-nocheck suppression");
             if (dJsdoc > 0) blockReasons.push("JSDoc `@type {any}` cast");
@@ -3679,8 +3805,9 @@ var init_ts_any_cast = __esm({
             continue;
           }
           const jsdocCast = JS_FILE.test(c.path) ? new RegExp(JSDOC_ANY_CAST.source) : null;
+          const aliasMap = aliasMapForAddedLines(c);
           for (const l of addedLines(c)) {
-            if (NARROW_LINE.test(l.content) || lineHasDoubleCast(l.content) || jsdocCast && jsdocCast.test(l.content)) {
+            if (NARROW_LINE.test(l.content) || lineHasRow4Cast(l.content, aliasMap) || lineHasLiveDirective(l.content) || jsdocCast && jsdocCast.test(l.content)) {
               out3.push(
                 makeFinding(inTest ? WARN_RULE : BLOCK_RULE, policy, {
                   file: c.path,
@@ -5839,6 +5966,8 @@ function survives(removedCore, isUses, afterCores, addedCores) {
       if (w && (canonical(w[1]) === r || canonical(w[1]).startsWith(r + " "))) neutralised ??= raw;
     }
   }
+  const maskOf = (args) => (" " + args).match(NEUTRALISING_SUFFIX)?.[0]?.trim() ?? null;
+  const priorMask = r.includes(" ") ? maskOf(r.slice(r.indexOf(" ") + 1)) : null;
   let respelled = false;
   for (const raw of addedCores) {
     if (!kind || checkKind(raw) !== kind) continue;
@@ -5853,7 +5982,9 @@ function survives(removedCore, isUses, afterCores, addedCores) {
       continue;
     }
     const args = a.slice(a.indexOf(" ") + 1 || a.length);
-    if (a.includes(" ") && (NEUTRALISING_SUFFIX.test(" " + args) || narrowed(args) || runnerNarrowed(a, args))) neutralised ??= raw;
+    const mask = maskOf(args);
+    const newMask = mask !== null && mask !== priorMask;
+    if (a.includes(" ") && (newMask || narrowed(args) || runnerNarrowed(a, args))) neutralised ??= raw;
     else respelled = true;
   }
   if (respelled) return { state: "kept" };
@@ -6077,7 +6208,7 @@ function isActiveWorkflow(path) {
   return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
 }
 function commandCore(line) {
-  return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses):\s*/, "").replace(/\s+/g, " ").trim();
+  return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses|script|command|before_script|after_script|sh|bash|pwsh|powershell):\s*/, "").replace(/\s+/g, " ").trim();
 }
 function expressionOf(raw) {
   const v = uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim();
@@ -6293,6 +6424,12 @@ function triggerNarrowings(before, after, opts) {
   }
   return out3;
 }
+function localUses(line) {
+  const wf = line.match(REUSED_WORKFLOW)?.[1];
+  if (wf) return [wf];
+  const action = line.match(LOCAL_ACTION)?.[1];
+  return action ? [`${action}/action.yml`, `${action}/action.yaml`] : [];
+}
 function literalValue(raw) {
   const v = foldExpressions(uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim());
   return v.includes(EXPR_TOKEN) || v.includes(MATRIX_TOKEN) ? null : v;
@@ -6327,7 +6464,7 @@ function ancestorOf(lines, i) {
   while (h >= 0 && (lines[h].trim() === "" || /^\s*#/.test(lines[h]) || indentOf(lines[h]) >= ind)) h--;
   return h >= 0 ? h : null;
 }
-var RULE7, USES, CHECK, YAML_KEY, invokesCheck2, uncommented, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
+var RULE7, USES, CHECK, YAML_KEY, isCompositeAction, isGithubFile, GH_RUN_KEY, GENERIC_RUN_KEY, invokesCheck2, uncommented, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, LOCAL_ACTION, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
 var init_ci_tampering = __esm({
   "src/detectors/ci-tampering.ts"() {
     "use strict";
@@ -6344,6 +6481,10 @@ var init_ci_tampering = __esm({
     USES = /^\s*-\s*uses:/;
     CHECK = /\b(test|tests|lint|typecheck|type-check|tsc|eslint|jest|vitest|playwright|coverage|tamperward)\b/i;
     YAML_KEY = /^\s*-?\s*[A-Za-z_][\w-]*:\s*(?:$|\S)/;
+    isCompositeAction = (path) => /(^|\/)\.github\/actions\/.+\/action\.ya?ml$/.test(path);
+    isGithubFile = (path) => /(^|\/)\.github\//.test(path);
+    GH_RUN_KEY = /^\s*-?\s*run:/;
+    GENERIC_RUN_KEY = /^\s*-?\s*(?:run|script|command|before_script|after_script|sh|bash|pwsh|powershell):/;
     invokesCheck2 = (line) => invokesCheck(line) || INVOKES_TOOL.test(commandCore(line));
     uncommented = (v) => v.replace(/\s+#.*$/, "").trim();
     SHELL_ERREXIT = /(?:^|\s)-[a-zA-Z]*e[a-zA-Z]*(?:\s|$)|-o\s+errexit\b/;
@@ -6374,7 +6515,8 @@ var init_ci_tampering = __esm({
     pathsMatchSource = (globs4, sources) => sources.some((s) => admits(globs4, s));
     ignoresEverySource = (globs4, sources) => sources.length > 0 && sources.every((s) => admits(globs4, s));
     CODE_PROBES = ["src/index.ts", "src/index.js", "lib/index.js", "index.ts", "main.go", "src/main.py", "src/lib.rs", "packages/a/src/index.ts", "test/a.test.ts"];
-    REUSED_WORKFLOW = /^\s*uses:\s*\.\/(\.github\/workflows\/[^\s@]+)/;
+    REUSED_WORKFLOW = /^\s*-?\s*uses:\s*\.\/(\.github\/workflows\/[^\s@]+)/;
+    LOCAL_ACTION = /^\s*-?\s*uses:\s*\.\/(\.github\/actions\/[^\s@]+?)\/?\s*(?:#.*)?$/;
     MANIFEST = /(?:^|\/)(?:package\.json|pyproject\.toml|setup\.py|setup\.cfg|Cargo\.toml|go\.mod|Makefile|build\.gradle(?:\.kts)?|pom\.xml|Gemfile|deno\.jsonc?)$/;
     WORKDIR_LINE = /^\s*-?\s*working-directory:\s*(.+?)\s*$/;
     REF_LINE = /^\s*ref:\s*(.+?)\s*$/;
@@ -6404,7 +6546,8 @@ var init_ci_tampering = __esm({
           if (!isProtected(c.path, policy, "ci")) continue;
           const afterLines = c.after != null ? c.after.split("\n") : null;
           const addedAt = new Set(addedLines(c).map((l) => l.newLine).filter((n) => n != null));
-          for (const l of addedLines(c)) {
+          const github = isGithubFile(c.path);
+          for (const l of github ? addedLines(c) : []) {
             const coe = l.content.match(/^\s*-?\s*continue-on-error:\s*(.+?)\s*$/);
             const cond = l.content.match(/^\s*-?\s*if:\s*(.+?)\s*$/);
             if (!coe && !cond) continue;
@@ -6436,7 +6579,7 @@ var init_ci_tampering = __esm({
               );
             }
           }
-          if (afterLines) {
+          if (afterLines && github) {
             for (const b of runBlocks(afterLines)) {
               if (!b.body.some(invokesCheck2)) continue;
               const propagates = b.body.some((l) => /\bexit\s+"?\$/.test(l));
@@ -6514,7 +6657,7 @@ var init_ci_tampering = __esm({
                 })
               );
             }
-            if (c.before != null && c.after != null) {
+            if (c.before != null && c.after != null && !isCompositeAction(c.path)) {
               triggerOpts ??= { defaultBranch: defaultBranch(ctx), sources: sourceProbes(ctx), hasBranch: (b) => branchExists(b, ctx) };
               for (const reason of triggerNarrowings(parseTriggers(c.before), parseTriggers(c.after), triggerOpts)) {
                 out3.push(
@@ -6532,17 +6675,27 @@ var init_ci_tampering = __esm({
           const afterCores = (afterCommands ?? addedLines(c).map((l) => l.content)).map(commandCore);
           const addedCores = addedLines(c).map((l) => commandCore(afterCommands && l.newLine != null ? afterCommands[l.newLine - 1] : l.content));
           for (const l of afterLines ?? []) {
-            const reused = l.match(REUSED_WORKFLOW)?.[1];
-            const content = reused ? afterByPath.get(reused) : void 0;
-            if (content == null || reused === c.path) continue;
-            const cores = commandLines(content.split("\n")).map(commandCore);
-            afterCores.push(...cores);
-            addedCores.push(...cores);
+            for (const reused of localUses(l)) {
+              const content = afterByPath.get(reused);
+              if (content == null || reused === c.path) continue;
+              const cores = commandLines(content.split("\n")).map(commandCore);
+              afterCores.push(...cores);
+              addedCores.push(...cores);
+            }
+          }
+          if (!github && c.after == null) {
+            for (const o of changes) {
+              if (o.kind !== "file" || o.op !== "add" || o.after == null || !isProtected(o.path, policy, "ci")) continue;
+              const cores = commandLines(o.after.split("\n")).map(commandCore);
+              afterCores.push(...cores);
+              addedCores.push(...cores);
+            }
           }
+          const runKey = github ? GH_RUN_KEY : GENERIC_RUN_KEY;
           for (const l of removedLines(c)) {
             if (/^\s*#/.test(l.content)) continue;
             const isUsesLine = usesCheck(l.content);
-            const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? /^\s*-?\s*run:/.test(l.content) : true) && invokesCheck2(l.content);
+            const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? runKey.test(l.content) : true) && invokesCheck2(l.content);
             if (!isUsesLine && !isCheckCommand) continue;
             const s = survives(commandCore(l.content), isUsesLine, afterCores, addedCores);
             if (s.state === "kept") continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.25.0",
+  "version": "2.25.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",