tamperward 2.25.1 → 2.25.2

package/dist/cli/index.js

@@ -526,7 +526,22 @@ function defaultPolicy(version = 1) {
         "**/codecov.yml",
         "**/.codecov.yml"
       ],
-      ci: [".github/workflows/**"],
+      // A workflow's checks can live in a composite action it `uses:` (the workflow
+      // keeps `uses: ./.github/actions/test` while the action's `run: npm test`
+      // becomes `echo ok`), and in the entry file of a CI system that is not GitHub
+      // Actions at all. Each is read by ci-tampering: the action's `runs.steps` get
+      // the workflow's removal/neutralisation pass, the other systems' entry files
+      // the generic check-line pass and no trigger logic (issue #437).
+      ci: [
+        ".github/workflows/**",
+        ".github/actions/**/action.y?(a)ml",
+        ".gitlab-ci.yml",
+        ".circleci/config.yml",
+        "Jenkinsfile",
+        "azure-pipelines.yml",
+        "bitbucket-pipelines.yml",
+        ".travis.yml"
+      ],
       // Recorded expected outputs. An assertion stored as data is still an assertion;
       // rewriting it from current output is the snapshot-update move the affordance
       // experiment measured at a 70% attempt / 100% through rate (snapshot-rewrite).
@@ -5951,6 +5966,8 @@ function survives(removedCore, isUses, afterCores, addedCores) {
       if (w && (canonical(w[1]) === r || canonical(w[1]).startsWith(r + " "))) neutralised ??= raw;
     }
   }
+  const maskOf = (args) => (" " + args).match(NEUTRALISING_SUFFIX)?.[0]?.trim() ?? null;
+  const priorMask = r.includes(" ") ? maskOf(r.slice(r.indexOf(" ") + 1)) : null;
   let respelled = false;
   for (const raw of addedCores) {
     if (!kind || checkKind(raw) !== kind) continue;
@@ -5965,7 +5982,9 @@ function survives(removedCore, isUses, afterCores, addedCores) {
       continue;
     }
     const args = a.slice(a.indexOf(" ") + 1 || a.length);
-    if (a.includes(" ") && (NEUTRALISING_SUFFIX.test(" " + args) || narrowed(args) || runnerNarrowed(a, args))) neutralised ??= raw;
+    const mask = maskOf(args);
+    const newMask = mask !== null && mask !== priorMask;
+    if (a.includes(" ") && (newMask || narrowed(args) || runnerNarrowed(a, args))) neutralised ??= raw;
     else respelled = true;
   }
   if (respelled) return { state: "kept" };
@@ -6189,7 +6208,7 @@ function isActiveWorkflow(path) {
   return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
 }
 function commandCore(line) {
-  return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses):\s*/, "").replace(/\s+/g, " ").trim();
+  return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses|script|command|before_script|after_script|sh|bash|pwsh|powershell):\s*/, "").replace(/\s+/g, " ").trim();
 }
 function expressionOf(raw) {
   const v = uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim();
@@ -6405,6 +6424,12 @@ function triggerNarrowings(before, after, opts) {
   }
   return out3;
 }
+function localUses(line) {
+  const wf = line.match(REUSED_WORKFLOW)?.[1];
+  if (wf) return [wf];
+  const action = line.match(LOCAL_ACTION)?.[1];
+  return action ? [`${action}/action.yml`, `${action}/action.yaml`] : [];
+}
 function literalValue(raw) {
   const v = foldExpressions(uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim());
   return v.includes(EXPR_TOKEN) || v.includes(MATRIX_TOKEN) ? null : v;
@@ -6439,7 +6464,7 @@ function ancestorOf(lines, i) {
   while (h >= 0 && (lines[h].trim() === "" || /^\s*#/.test(lines[h]) || indentOf(lines[h]) >= ind)) h--;
   return h >= 0 ? h : null;
 }
-var RULE7, USES, CHECK, YAML_KEY, invokesCheck2, uncommented, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
+var RULE7, USES, CHECK, YAML_KEY, isCompositeAction, isGithubFile, GH_RUN_KEY, GENERIC_RUN_KEY, invokesCheck2, uncommented, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, LOCAL_ACTION, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
 var init_ci_tampering = __esm({
   "src/detectors/ci-tampering.ts"() {
     "use strict";
@@ -6456,6 +6481,10 @@ var init_ci_tampering = __esm({
     USES = /^\s*-\s*uses:/;
     CHECK = /\b(test|tests|lint|typecheck|type-check|tsc|eslint|jest|vitest|playwright|coverage|tamperward)\b/i;
     YAML_KEY = /^\s*-?\s*[A-Za-z_][\w-]*:\s*(?:$|\S)/;
+    isCompositeAction = (path) => /(^|\/)\.github\/actions\/.+\/action\.ya?ml$/.test(path);
+    isGithubFile = (path) => /(^|\/)\.github\//.test(path);
+    GH_RUN_KEY = /^\s*-?\s*run:/;
+    GENERIC_RUN_KEY = /^\s*-?\s*(?:run|script|command|before_script|after_script|sh|bash|pwsh|powershell):/;
     invokesCheck2 = (line) => invokesCheck(line) || INVOKES_TOOL.test(commandCore(line));
     uncommented = (v) => v.replace(/\s+#.*$/, "").trim();
     SHELL_ERREXIT = /(?:^|\s)-[a-zA-Z]*e[a-zA-Z]*(?:\s|$)|-o\s+errexit\b/;
@@ -6486,7 +6515,8 @@ var init_ci_tampering = __esm({
     pathsMatchSource = (globs4, sources) => sources.some((s) => admits(globs4, s));
     ignoresEverySource = (globs4, sources) => sources.length > 0 && sources.every((s) => admits(globs4, s));
     CODE_PROBES = ["src/index.ts", "src/index.js", "lib/index.js", "index.ts", "main.go", "src/main.py", "src/lib.rs", "packages/a/src/index.ts", "test/a.test.ts"];
-    REUSED_WORKFLOW = /^\s*uses:\s*\.\/(\.github\/workflows\/[^\s@]+)/;
+    REUSED_WORKFLOW = /^\s*-?\s*uses:\s*\.\/(\.github\/workflows\/[^\s@]+)/;
+    LOCAL_ACTION = /^\s*-?\s*uses:\s*\.\/(\.github\/actions\/[^\s@]+?)\/?\s*(?:#.*)?$/;
     MANIFEST = /(?:^|\/)(?:package\.json|pyproject\.toml|setup\.py|setup\.cfg|Cargo\.toml|go\.mod|Makefile|build\.gradle(?:\.kts)?|pom\.xml|Gemfile|deno\.jsonc?)$/;
     WORKDIR_LINE = /^\s*-?\s*working-directory:\s*(.+?)\s*$/;
     REF_LINE = /^\s*ref:\s*(.+?)\s*$/;
@@ -6516,7 +6546,8 @@ var init_ci_tampering = __esm({
           if (!isProtected(c.path, policy, "ci")) continue;
           const afterLines = c.after != null ? c.after.split("\n") : null;
           const addedAt = new Set(addedLines(c).map((l) => l.newLine).filter((n) => n != null));
-          for (const l of addedLines(c)) {
+          const github = isGithubFile(c.path);
+          for (const l of github ? addedLines(c) : []) {
             const coe = l.content.match(/^\s*-?\s*continue-on-error:\s*(.+?)\s*$/);
             const cond = l.content.match(/^\s*-?\s*if:\s*(.+?)\s*$/);
             if (!coe && !cond) continue;
@@ -6548,7 +6579,7 @@ var init_ci_tampering = __esm({
               );
             }
           }
-          if (afterLines) {
+          if (afterLines && github) {
             for (const b of runBlocks(afterLines)) {
               if (!b.body.some(invokesCheck2)) continue;
               const propagates = b.body.some((l) => /\bexit\s+"?\$/.test(l));
@@ -6626,7 +6657,7 @@ var init_ci_tampering = __esm({
                 })
               );
             }
-            if (c.before != null && c.after != null) {
+            if (c.before != null && c.after != null && !isCompositeAction(c.path)) {
               triggerOpts ??= { defaultBranch: defaultBranch(ctx), sources: sourceProbes(ctx), hasBranch: (b) => branchExists(b, ctx) };
               for (const reason of triggerNarrowings(parseTriggers(c.before), parseTriggers(c.after), triggerOpts)) {
                 out3.push(
@@ -6644,17 +6675,27 @@ var init_ci_tampering = __esm({
           const afterCores = (afterCommands ?? addedLines(c).map((l) => l.content)).map(commandCore);
           const addedCores = addedLines(c).map((l) => commandCore(afterCommands && l.newLine != null ? afterCommands[l.newLine - 1] : l.content));
           for (const l of afterLines ?? []) {
-            const reused = l.match(REUSED_WORKFLOW)?.[1];
-            const content = reused ? afterByPath.get(reused) : void 0;
-            if (content == null || reused === c.path) continue;
-            const cores = commandLines(content.split("\n")).map(commandCore);
-            afterCores.push(...cores);
-            addedCores.push(...cores);
+            for (const reused of localUses(l)) {
+              const content = afterByPath.get(reused);
+              if (content == null || reused === c.path) continue;
+              const cores = commandLines(content.split("\n")).map(commandCore);
+              afterCores.push(...cores);
+              addedCores.push(...cores);
+            }
+          }
+          if (!github && c.after == null) {
+            for (const o of changes) {
+              if (o.kind !== "file" || o.op !== "add" || o.after == null || !isProtected(o.path, policy, "ci")) continue;
+              const cores = commandLines(o.after.split("\n")).map(commandCore);
+              afterCores.push(...cores);
+              addedCores.push(...cores);
+            }
           }
+          const runKey = github ? GH_RUN_KEY : GENERIC_RUN_KEY;
           for (const l of removedLines(c)) {
             if (/^\s*#/.test(l.content)) continue;
             const isUsesLine = usesCheck(l.content);
-            const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? /^\s*-?\s*run:/.test(l.content) : true) && invokesCheck2(l.content);
+            const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? runKey.test(l.content) : true) && invokesCheck2(l.content);
             if (!isUsesLine && !isCheckCommand) continue;
             const s = survives(commandCore(l.content), isUsesLine, afterCores, addedCores);
             if (s.state === "kept") continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.25.1",
+  "version": "2.25.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",