tutanus 0.12.0

package/dist/analysts/github-actions/analysts/analyst-github-actions.js

@@ -0,0 +1,490 @@
+import { parseDocument } from 'yaml';
+import { detectorDependenciasVulneraveis } from '../detectors/detector-dependencies-vulnerable.js';
+import { detectarProblemasAcessibilidade } from '../detectors/detector-workflow-accessibility.js';
+import { detectarProblemasCompliance } from '../detectors/detector-workflow-compliance.js';
+import { detectorWorkflowPerformance } from '../detectors/detector-workflow-performance.js';
+import { detectorWorkflowSecurity } from '../detectors/detector-workflow-security.js';
+import { detectarJobsPassivos, detectorWorkflowEstrutura } from '../detectors/detector-workflow-structure.js';
+import { detectorWorkflowTriggerInseguro } from '../detectors/detector-workflow-trigger-unsafe.js';
+import { isOrgVerificada } from '../detectors/org-verified.js';
+let _workflowNeedsFullHistory = false;
+const detectoresRegistrados = [];
+export function registrarDetectorGithubActions(detector) {
+    detectoresRegistrados.push(detector);
+}
+export function obterDetectoresGithubActions() {
+    return [...detectoresRegistrados];
+}
+export const analistaGithubActions = {
+    nome: 'github-actions',
+    categoria: 'workflows',
+    descricao: 'Analista avançado de workflows do GitHub Actions com suporte a plugins',
+    test: (relPath) => relPath.startsWith('.github/workflows/'),
+    async aplicar(conteudo, relPath, _ast = null, _fc, contexto) {
+        const ocorrencias = [];
+        try {
+            const doc = parseDocument(conteudo);
+            const workflow = doc.toJS();
+            const problemas = await executarDetectoresNativos(workflow, conteudo);
+            const caminhos = contexto?.arquivos.map(arquivo => arquivo.relPath) || [];
+            const plugResults = await Promise.all(detectoresRegistrados.map(diretorio => Promise.resolve(diretorio.testar(workflow, {
+                conteudo,
+                caminhos
+            })).catch(() => [])));
+            const securityResults = await Promise.resolve(detectorWorkflowSecurity.aplicar(conteudo, relPath, _ast, _fc, contexto));
+            const performanceResults = await Promise.resolve(detectorWorkflowPerformance.aplicar(conteudo, relPath, _ast, _fc, contexto));
+            const estruturaResults = await Promise.resolve(detectorWorkflowEstrutura.aplicar(conteudo, relPath, _ast, _fc, contexto));
+            const depsResults = await Promise.resolve(detectorDependenciasVulneraveis.aplicar(conteudo, relPath, _ast, _fc, contexto));
+            const triggerResults = await Promise.resolve(detectorWorkflowTriggerInseguro.aplicar(conteudo, relPath, _ast, _fc, contexto));
+            const todos = [...problemas, ...plugResults.flat()];
+            ocorrencias.push(...securityResults, ...performanceResults, ...estruturaResults, ...depsResults, ...triggerResults);
+            for (const caminho of todos) {
+                ocorrencias.push({
+                    tipo: `GITHUB_ACTIONS_${caminho.tipo.toUpperCase().replace(/-/g, '_')}`,
+                    mensagem: caminho.descricao,
+                    relPath,
+                    linha: caminho.linha || 1,
+                    coluna: 1,
+                    sugestao: caminho.sugestao || '',
+                    nivel: caminho.severidade === 'critica' || caminho.severidade === 'alta' ? 'erro' : caminho.severidade === 'media' ? 'aviso' : 'info'
+                });
+            }
+        }
+        catch {
+        }
+        return ocorrencias;
+    }
+};
+export const analistaGithubActionsGlobal = {
+    nome: 'github-actions-global',
+    categoria: 'workflows',
+    descricao: 'Governança Global do GitHub',
+    test: () => false,
+    async aplicar(_c, _p, _a, _f, ctx) {
+        if (!ctx)
+            return [];
+        const ores = [];
+        const paths = ctx.arquivos.map(arquivo => arquivo.relPath);
+        if (!paths.some(caminho => /CODEOWNERS/i.test(caminho))) {
+            ores.push({
+                tipo: 'GITHUB_ACTIONS_CODEOWNERS_MISSING',
+                mensagem: 'CODEOWNERS faltando',
+                relPath: '.github/',
+                linha: 0,
+                coluna: 0,
+                nivel: 'info'
+            });
+        }
+        const readme = ctx.arquivos?.find(arquivo => /README\.md/i.test(arquivo.relPath ?? ''));
+        const content = readme ? readme.content || '' : '';
+        if (readme && !/Code of Conduct|Código de Conduta/i.test(content)) {
+            ores.push({
+                tipo: 'GITHUB_ACTIONS_DOC_GOVERNANCE_MISSING',
+                mensagem: 'README sem Código de Conduta',
+                relPath: readme.relPath,
+                linha: 1,
+                coluna: 0,
+                nivel: 'info'
+            });
+        }
+        if (!paths.some(caminho => /stale/i.test(caminho))) {
+            ores.push({
+                tipo: 'GITHUB_ACTIONS_STALE_BOT_MISSING',
+                mensagem: 'Stale bot faltando',
+                relPath: '.github/workflows/',
+                linha: 0,
+                coluna: 0,
+                nivel: 'info'
+            });
+        }
+        if (!paths.some(caminho => /release|deploy/i.test(caminho))) {
+            ores.push({
+                tipo: 'GITHUB_ACTIONS_RELEASE_AUTOMATION_MISSING',
+                mensagem: 'Release automation faltando',
+                relPath: '.github/workflows/',
+                linha: 0,
+                coluna: 0,
+                nivel: 'info'
+            });
+        }
+        if (!paths.some(caminho => /\.github\/ISSUE_TEMPLATE/i.test(caminho))) {
+            ores.push({
+                tipo: 'GITHUB_ACTIONS_ISSUE_TEMPLATES_MISSING',
+                mensagem: 'Issue templates faltando',
+                relPath: '.github/ISSUE_TEMPLATE/',
+                linha: 0,
+                coluna: 0,
+                nivel: 'info'
+            });
+        }
+        if (!paths.some(caminho => /pull_request_template/i.test(caminho))) {
+            ores.push({
+                tipo: 'GITHUB_ACTIONS_PR_TEMPLATE_MISSING',
+                mensagem: 'PR template faltando',
+                relPath: '.github/',
+                linha: 0,
+                coluna: 0,
+                nivel: 'info'
+            });
+        }
+        const hasSemanticRelease = paths.some(caminho => /semantic-release|semrel/i.test(caminho));
+        const hasChangelog = paths.some(caminho => /changelog/i.test(caminho));
+        if (!hasSemanticRelease) {
+            ores.push({
+                tipo: 'GITHUB_ACTIONS_SEMANTIC_VERSIONING_MISSING',
+                mensagem: 'Automação de versionamento semântico não detectada',
+                relPath: '.github/workflows/',
+                linha: 0,
+                coluna: 0,
+                nivel: 'info'
+            });
+        }
+        if (!hasChangelog) {
+            ores.push({
+                tipo: 'GITHUB_ACTIONS_CHANGELOG_AUTOMATION_MISSING',
+                mensagem: 'Automação de changelog faltando',
+                relPath: '.github/workflows/',
+                linha: 0,
+                coluna: 0,
+                nivel: 'info'
+            });
+        }
+        const sourceFiles = ctx.arquivos.filter(arquivo => /\.(ts|js)$/.test(arquivo.relPath));
+        const missingLicense = sourceFiles.filter(arquivo => !/SPDX-License-Identifier/i.test(arquivo.content || ''));
+        if (missingLicense.length > sourceFiles.length / 2) {
+            ores.push({
+                tipo: 'GITHUB_ACTIONS_LICENSE_HEADERS_MISSING',
+                mensagem: 'Muitos arquivos sem cabeçalho de licença (SPDX)',
+                relPath: './',
+                linha: 0,
+                coluna: 0,
+                nivel: 'info'
+            });
+        }
+        return ores;
+    }
+};
+function workflowRequerHistoricoCompleto(wf, raw) {
+    const gitCommandsQuePrecisamDeHistorico = /\b(git\s+(rev-parse|tag|describe|log|shortlog|diff|bisect|blame)|git\s+checkout\s+-b|git\s+fetch\s+--unshallow|git\s+clone\s+--depth)/gi;
+    if (gitCommandsQuePrecisamDeHistorico.test(raw)) {
+        return true;
+    }
+    const jobs = wf?.jobs ? Object.values(wf.jobs) : [];
+    const allSteps = jobs.flatMap(job => job?.steps || []);
+    for (const step of allSteps) {
+        if (step?.run && gitCommandsQuePrecisamDeHistorico.test(step.run)) {
+            return true;
+        }
+    }
+    return false;
+}
+async function executarDetectoresNativos(wf, raw) {
+    const probs = [];
+    if (!wf)
+        return probs;
+    _workflowNeedsFullHistory = workflowRequerHistoricoCompleto(wf, raw);
+    const candidates = Array.isArray(wf) ? wf : [wf];
+    for (const item of candidates) {
+        if (typeof item === 'object' && item !== null) {
+            analisarEstrutura(item, probs);
+        }
+    }
+    probs.push(...detectarProblemasCompliance(wf, raw));
+    probs.push(...detectarProblemasAcessibilidade(wf));
+    if (typeof wf === 'object' && 'jobs' in wf) {
+        const wfJobs = wf.jobs;
+        if (wfJobs) {
+            for (const [, job] of Object.entries(wfJobs)) {
+                if (detectarJobsPassivos(job)) {
+                    probs.push({
+                        tipo: 'job-passivo-workflow',
+                        descricao: 'Job passivo detectado',
+                        severidade: 'baixa'
+                    });
+                }
+            }
+        }
+    }
+    if (/sudo\s+/.test(raw)) {
+        probs.push({
+            tipo: 'uso-sudo',
+            descricao: 'Uso de sudo detectado',
+            severidade: 'alta'
+        });
+    }
+    if (raw.includes('pull_request_target:')) {
+        probs.push({
+            tipo: 'estrutura-workflow',
+            descricao: 'Uso de pull_request_target',
+            severidade: 'alta'
+        });
+    }
+    return probs;
+}
+function analisarEstrutura(wf, probs) {
+    if (!wf.name) {
+        probs.push({
+            tipo: 'workflow-sem-nome',
+            descricao: 'Workflow sem nome definido',
+            severidade: 'baixa'
+        });
+    }
+    if (wf.container && typeof wf.container === 'string') {
+        probs.push({
+            tipo: 'container-sem-user',
+            descricao: 'Container sem user',
+            severidade: 'media'
+        });
+    }
+    if (wf.strategy?.matrix && wf.strategy['fail-fast'] === undefined) {
+        probs.push({
+            tipo: 'matrix-sem-fail-fast',
+            descricao: 'Matrix sem fail-fast',
+            severidade: 'baixa'
+        });
+    }
+    for (const [chave, valor] of Object.entries(wf)) {
+        if (/(KEY|TOKEN|SECRET|PASSWORD)/i.test(chave) && valor && typeof valor !== 'object' && !String(valor).includes('${{')) {
+            probs.push({
+                tipo: 'env-sensivel',
+                descricao: `Secret hardcoded em ${chave}`,
+                severidade: 'critica'
+            });
+        }
+    }
+    if (wf.jobs) {
+        const jobEntries = Object.entries(wf.jobs);
+        for (const [id, job] of jobEntries) {
+            if (job?.strategy?.matrix && job.strategy['fail-fast'] === undefined) {
+                probs.push({
+                    tipo: 'matrix-sem-fail-fast',
+                    descricao: `Job ${id} sem fail-fast`,
+                    severidade: 'baixa'
+                });
+            }
+            if (job?.container && typeof job.container === 'string') {
+                probs.push({
+                    tipo: 'container-sem-user',
+                    descricao: 'Container rodando como root',
+                    severidade: 'media'
+                });
+            }
+            if (/^(job\d+|step\d+|build\d*|test\d*|j\d+)$/i.test(id) && !job?.name) {
+                probs.push({
+                    tipo: 'job-sem-nome',
+                    descricao: `Job '${id}' usa ID genérico sem campo 'name'`,
+                    severidade: 'baixa',
+                    sugestao: 'Usar nomes semânticos como build-backend, test-integration'
+                });
+            }
+            if (job?.steps) {
+                for (const string of job.steps)
+                    analisarStep(string, probs);
+                analisarStepsSemNome(job.steps, probs);
+                if (job.steps.length > 15) {
+                    probs.push({
+                        tipo: 'job-longo',
+                        descricao: `Job '${id}' possui ${job.steps.length} steps, o que dificulta a manutenção`,
+                        severidade: 'baixa',
+                        sugestao: 'Considere quebrar em jobs menores ou usar composite actions'
+                    });
+                }
+            }
+        }
+        analisarParalelismo(jobEntries, probs);
+        analisarDownloadArtifacts(jobEntries, probs);
+        analisarMultiplasInstalacoesDeps(jobEntries, probs);
+    }
+    if (wf.steps && Array.isArray(wf.steps)) {
+        for (const string of wf.steps)
+            analisarStep(string, probs);
+        analisarStepsSemNome(wf.steps, probs);
+    }
+    if (wf.uses || wf.run)
+        analisarStep(wf, probs);
+}
+function analisarStep(string, probs) {
+    if (!string)
+        return;
+    if (string.uses && /@v\d+/.test(string.uses)) {
+        const actionRef = string.uses.split('@')[0];
+        if (!isOrgVerificada(actionRef)) {
+            probs.push({
+                tipo: 'falta-sha-pinning',
+                descricao: 'Pinning por SHA faltando',
+                severidade: 'media'
+            });
+        }
+    }
+    if (string.uses?.includes('upload-artifact') && string.with?.path?.includes('.env')) {
+        probs.push({
+            tipo: 'upload-sensivel',
+            descricao: 'Upload de .env',
+            severidade: 'critica'
+        });
+    }
+    if (string.env) {
+        for (const [chave, valor] of Object.entries(string.env)) {
+            if (/(KEY|TOKEN|SECRET|PASSWORD)/i.test(chave) && valor && typeof valor !== 'object' && !String(valor).includes('${{')) {
+                probs.push({
+                    tipo: 'env-sensivel',
+                    descricao: `Env ${chave} hardcoded`,
+                    severidade: 'critica'
+                });
+            }
+        }
+    }
+    if (string.run && /\$\{\{\s*github\.event\./.test(string.run)) {
+        probs.push({
+            tipo: 'script-injection',
+            descricao: 'Script injection',
+            severidade: 'alta'
+        });
+    }
+    if (string.uses && /docker\/build-push-action/.test(string.uses)) {
+        const hasCacheFrom = string.with?.['cache-from'] !== undefined;
+        const hasCacheTo = string.with?.['cache-to'] !== undefined;
+        if (!hasCacheFrom && !hasCacheTo) {
+            probs.push({
+                tipo: 'docker-sem-layer-cache',
+                descricao: 'Docker build sem cache de layers configurado',
+                severidade: 'media',
+                sugestao: 'Adicionar cache-from e cache-to para otimizar builds Docker'
+            });
+        }
+    }
+    if (string.uses && /actions\/checkout/.test(string.uses) && string.with) {
+        const fd = string.with['fetch-depth'];
+        if (fd === 0 || fd === '0') {
+            if (!_workflowNeedsFullHistory) {
+                probs.push({
+                    tipo: 'fetch-depth-desnecessario',
+                    descricao: 'checkout com fetch-depth: 0 baixa todo o histórico do repositório',
+                    severidade: 'baixa',
+                    sugestao: 'Usar fetch-depth: 1 (default) a menos que precise do histórico completo para tags/changelog'
+                });
+            }
+        }
+    }
+}
+const ACTIONS_AUTO_EXPLICATIVAS = [
+    'actions/checkout',
+    'actions/setup-node',
+    'actions/setup-python',
+    'actions/setup-java',
+    'actions/setup-go',
+    'actions/setup-dotnet',
+    'actions/setup-ruby',
+    'actions/upload-artifact',
+    'actions/download-artifact',
+    'actions/cache',
+    'actions/stale',
+    'actions/labeler',
+    'actions/dependency-review',
+    'actions/attest-build-provenance',
+    'docker/login-action',
+    'docker/build-push-action',
+    'docker/metadata-action',
+    'docker/setup-buildx-action',
+    'docker/setup-qemu-action',
+    'azure/login',
+    'azure/webapps-deploy',
+    'aws-actions/configure-aws-credentials',
+    'google-github-actions/auth',
+    'github/codeql-action/init',
+    'github/codeql-action/analyze',
+    'github/codeql-action/autobuild',
+    'softprops/action-gh-release',
+    'cypress-io/github-action',
+];
+function analisarStepsSemNome(steps, probs) {
+    for (const string of steps) {
+        if (!string || string.name)
+            continue;
+        if (string.uses || string.run) {
+            if (string.uses && ACTIONS_AUTO_EXPLICATIVAS.some(action => string.uses?.startsWith(action))) {
+                continue;
+            }
+            const ident = string.uses ? `uses: ${string.uses}` : 'run command';
+            probs.push({
+                tipo: 'step-sem-nome',
+                descricao: `Step sem campo 'name' (${ident})`,
+                severidade: 'baixa',
+                sugestao: 'Adicionar campo name: para melhor legibilidade nos logs do Actions'
+            });
+        }
+    }
+}
+function analisarParalelismo(jobEntries, probs) {
+    if (jobEntries.length < 3)
+        return;
+    const workflowName = jobEntries[0]?.[1]?.name?.toLowerCase() || '';
+    const jobNames = jobEntries.map(([, j]) => j?.name?.toLowerCase() || '').join(' ');
+    const isReleaseWorkflow = /release|deploy|publish|ship/i.test(workflowName) || /release|deploy|publish|ship/i.test(jobNames);
+    if (isReleaseWorkflow)
+        return;
+    let totalWithNeeds = 0;
+    for (const [, job] of jobEntries) {
+        if (job?.needs)
+            totalWithNeeds++;
+    }
+    if (totalWithNeeds === jobEntries.length - 1) {
+        probs.push({
+            tipo: 'build-sem-parallelismo',
+            descricao: 'Todos os jobs estão em cadeia linear - considere paralelizar jobs independentes',
+            severidade: 'media',
+            sugestao: 'Remover dependências (needs) desnecessárias para permitir execução paralela'
+        });
+    }
+}
+function analisarDownloadArtifacts(jobEntries, probs) {
+    let downloadCount = 0;
+    for (const [, job] of jobEntries) {
+        if (!job?.steps)
+            continue;
+        for (const string of job.steps) {
+            if (string.uses && /download-artifact/.test(string.uses))
+                downloadCount++;
+        }
+    }
+    if (downloadCount >= 3) {
+        probs.push({
+            tipo: 'download-artifacts-desnecessario',
+            descricao: `${downloadCount} download-artifact encontrados - considere consolidar artifacts`,
+            severidade: 'baixa',
+            sugestao: 'Consolidar artifacts ou usar cache compartilhado'
+        });
+    }
+}
+function analisarMultiplasInstalacoesDeps(jobEntries, probs) {
+    let installCount = 0;
+    let hasCacheStep = false;
+    let hasSetupNodeWithCache = false;
+    for (const [, job] of jobEntries) {
+        if (!job?.steps)
+            continue;
+        let jobHasInstall = false;
+        for (const string of job.steps) {
+            if (string.run && /\b(npm\s+(ci|install)|yarn\s+install|pnpm\s+install)\b/.test(string.run)) {
+                jobHasInstall = true;
+            }
+            if (string.uses && /actions\/cache/.test(string.uses)) {
+                hasCacheStep = true;
+            }
+            if (string.uses && /actions\/setup-node/.test(string.uses) && string.with?.cache) {
+                hasSetupNodeWithCache = true;
+            }
+        }
+        if (jobHasInstall)
+            installCount++;
+    }
+    if (installCount >= 2 && !hasCacheStep && !hasSetupNodeWithCache) {
+        probs.push({
+            tipo: 'multiplas-instalacoes-deps',
+            descricao: `Instalação de dependências em ${installCount} jobs sem cache compartilhado`,
+            severidade: 'media',
+            sugestao: 'Usar actions/cache ou artifact de node_modules para evitar instalações duplicadas'
+        });
+    }
+}
+//# sourceMappingURL=analyst-github-actions.js.map

package/dist/analysts/github-actions/analysts/analyst-github-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyst-github-actions.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/analysts/analyst-github-actions.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAIrC,OAAO,EAAE,+BAA+B,EAAE,MAAM,kDAAkD,CAAC;AACnG,OAAO,EAAE,+BAA+B,EAAE,MAAM,iDAAiD,CAAC;AAClG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,kDAAkD,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAsC/D,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC,MAAM,qBAAqB,GAAqB,EAAE,CAAC;AACnD,MAAM,UAAU,8BAA8B,CAAC,QAAwB;IACrE,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AACD,MAAM,UAAU,4BAA4B;IAC1C,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;AACpC,CAAC;AACD,MAAM,CAAC,MAAM,qBAAqB,GAAa;IAC7C,IAAI,EAAE,gBAAgB;IACtB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,wEAAwE;IACnF,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;IACnE,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,OAAe,EAAE,OAAgB,IAAI,EAAE,GAAY,EAAE,QAA2B;QAC9G,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1E,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;gBACtH,QAAQ;gBACR,QAAQ;aACT,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAuB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3I,MAAM,kBAAkB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAuB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjJ,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAuB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC7I,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAuB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9I,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAuB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjJ,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,WAAW,CAAC,IAAI,CAAC,GAAI,eAAgC,EAAE,GAAI,kBAAmC,EAAE,GAAI,gBAAiC,EAAE,GAAI,WAA4B,EAAE,GAAI,cAA+B,CAAC,CAAC;YAC9M,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;gBAC5B,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,kBAAkB,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;oBACvE,QAAQ,EAAE,OAAO,CAAC,SAAS;oBAC3B,OAAO;oBACP,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;oBACzB,MAAM,EAAE,CAAC;oBACT,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;oBAChC,KAAK,EAAE,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;iBACtI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC;AACF,MAAM,CAAC,MAAM,2BAA2B,GAAa;IACnD,IAAI,EAAE,uBAAuB;IAC7B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,6BAA6B;IACxC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK;IACjB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAsB;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAiB,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAG3D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,qBAAqB;gBAC/B,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAwB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,MAAM,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,uCAAuC;gBAC7C,QAAQ,EAAE,8BAA8B;gBACxC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,kCAAkC;gBACxC,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,2CAA2C;gBACjD,QAAQ,EAAE,6BAA6B;gBACvC,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,wCAAwC;gBAC9C,QAAQ,EAAE,0BAA0B;gBACpC,OAAO,EAAE,yBAAyB;gBAClC,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,oCAAoC;gBAC1C,QAAQ,EAAE,sBAAsB;gBAChC,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3F,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,4CAA4C;gBAClD,QAAQ,EAAE,oDAAoD;gBAC9D,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,6CAA6C;gBACnD,QAAQ,EAAE,iCAAiC;gBAC3C,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACvF,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;QACxH,IAAI,cAAc,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,wCAAwC;gBAC9C,QAAQ,EAAE,iDAAiD;gBAC3D,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC;AAIF,SAAS,+BAA+B,CAAC,EAAgB,EAAE,GAAW;IAEpE,MAAM,iCAAiC,GAAG,yIAAyI,CAAC;IACpL,IAAI,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,MAAM,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,EAAE,GAAG,IAAI,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,EAAW,EAAE,GAAW;IAC/D,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEtB,yBAAyB,GAAG,+BAA+B,CAAC,EAAkB,EAAE,GAAG,CAAC,CAAC;IAGrF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,iBAAiB,CAAC,IAAoB,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAGpD,KAAK,CAAC,IAAI,CAAC,GAAG,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC;IAGnD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAI,EAOd,CAAC,IAAI,CAAC;QACR,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7C,IAAI,oBAAoB,CAAC,GAKxB,CAAC,EAAE,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,sBAAsB;wBAC5B,SAAS,EAAE,uBAAuB;wBAClC,UAAU,EAAE,OAAO;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAGD,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,uBAAuB;YAClC,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB;YAC1B,SAAS,EAAE,4BAA4B;YACvC,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,iBAAiB,CAAC,EAAgB,EAAE,KAAyB;IAEpE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,mBAAmB;YACzB,SAAS,EAAE,4BAA4B;YACvC,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,EAAE,CAAC,SAAS,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB;YAC1B,SAAS,EAAE,oBAAoB;YAC/B,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,sBAAsB;YAC5B,SAAS,EAAE,sBAAsB;YACjC,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAChD,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvH,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,uBAAuB,KAAK,EAAE;gBACzC,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAGD,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;gBACrE,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,sBAAsB;oBAC5B,SAAS,EAAE,OAAO,EAAE,gBAAgB;oBACpC,UAAU,EAAE,OAAO;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,GAAG,EAAE,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACxD,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,oBAAoB;oBAC1B,SAAS,EAAE,6BAA6B;oBACxC,UAAU,EAAE,OAAO;iBACpB,CAAC,CAAC;YACL,CAAC;YAGD,IAAI,2CAA2C,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBACvE,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,QAAQ,EAAE,oCAAoC;oBACzD,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,4DAA4D;iBACvE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;gBACf,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK;oBAAE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAG5D,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAGvC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,WAAW;wBACjB,SAAS,EAAE,QAAQ,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,sCAAsC;wBACvF,UAAU,EAAE,OAAO;wBACnB,QAAQ,EAAE,6DAA6D;qBACxE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAGD,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAGvC,yBAAyB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAG7C,gCAAgC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAGD,IAAI,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,KAAK;YAAE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAGD,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG;QAAE,YAAY,CAAC,EAAkB,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AACD,SAAS,YAAY,CAAC,MAAoB,EAAE,KAAyB;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,mBAAmB;gBACzB,SAAS,EAAE,0BAA0B;gBACrC,UAAU,EAAE,OAAO;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpF,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,SAAS,EAAE,gBAAgB;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvH,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,OAAO,KAAK,YAAY;oBACnC,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,MAAM,CAAC,IAAI,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC;QAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,wBAAwB;gBAC9B,SAAS,EAAE,8CAA8C;gBACzD,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,6DAA6D;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAGD,IAAI,MAAM,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACxE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACtC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAE3B,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,2BAA2B;oBACjC,SAAS,EAAE,mEAAmE;oBAC9E,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,6FAA6F;iBACxG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,yBAAyB,GAAG;IAChC,kBAAkB;IAClB,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;IACpB,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;IACpB,yBAAyB;IACzB,2BAA2B;IAC3B,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,2BAA2B;IAC3B,iCAAiC;IACjC,qBAAqB;IACrB,0BAA0B;IAC1B,wBAAwB;IACxB,4BAA4B;IAC5B,0BAA0B;IAC1B,aAAa;IACb,sBAAsB;IACtB,uCAAuC;IACvC,4BAA4B;IAC5B,2BAA2B;IAC3B,8BAA8B;IAC9B,gCAAgC;IAChC,6BAA6B;IAC7B,0BAA0B;CAC3B,CAAC;AAMF,SAAS,oBAAoB,CAAC,KAAqB,EAAE,KAAyB;IAC5E,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;YAAE,SAAS;QACrC,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAE9B,IAAI,MAAM,CAAC,IAAI,IAAI,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC7F,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;YACnE,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,0BAA0B,KAAK,GAAG;gBAC7C,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,oEAAoE;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAOD,SAAS,mBAAmB,CAAC,UAAmC,EAAE,KAAyB;IACzF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAGlC,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnF,MAAM,iBAAiB,GAAG,8BAA8B,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7H,IAAI,iBAAiB;QAAE,OAAO;IAE9B,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,GAAG,EAAE,KAAK;YAAE,cAAc,EAAE,CAAC;IACnC,CAAC;IAGD,IAAI,cAAc,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,iFAAiF;YAC5F,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,6EAA6E;SACxF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAKD,SAAS,yBAAyB,CAAC,UAAmC,EAAE,KAAyB;IAC/F,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,KAAK;YAAE,SAAS;QAC1B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,aAAa,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,kCAAkC;YACxC,SAAS,EAAE,GAAG,aAAa,iEAAiE;YAC5F,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,kDAAkD;SAC7D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAKD,SAAS,gCAAgC,CAAC,UAAmC,EAAE,KAAyB;IACtG,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,KAAK;YAAE,SAAS;QAC1B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,GAAG,IAAI,wDAAwD,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5F,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;gBACjF,qBAAqB,GAAG,IAAI,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,IAAI,aAAa;YAAE,YAAY,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,4BAA4B;YAClC,SAAS,EAAE,iCAAiC,YAAY,+BAA+B;YACvF,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,mFAAmF;SAC9F,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n\n/**\n * @fileoverview Analista de qualidade para workflows do GitHub Actions (v0.6.0)\n */\n\nimport type { NodePath } from '@babel/traverse';\nimport { parseDocument } from 'yaml';\n\nimport type { Analista, ContextoExecucao, DeteccaoCustom, Ocorrencia, ProblemaWorkflow } from '@';\n\nimport { detectorDependenciasVulneraveis } from '../detectors/detector-dependencies-vulnerable.js';\nimport { detectarProblemasAcessibilidade } from '../detectors/detector-workflow-accessibility.js';\nimport { detectarProblemasCompliance } from '../detectors/detector-workflow-compliance.js';\nimport { detectorWorkflowPerformance } from '../detectors/detector-workflow-performance.js';\nimport { detectorWorkflowSecurity } from '../detectors/detector-workflow-security.js';\nimport { detectarJobsPassivos, detectorWorkflowEstrutura } from '../detectors/detector-workflow-structure.js';\nimport { detectorWorkflowTriggerInseguro } from '../detectors/detector-workflow-trigger-unsafe.js';\nimport { isOrgVerificada } from '../detectors/org-verified.js';\n\ninterface WorkflowStep {\n  name?: string;\n  uses?: string;\n  with?: {\n    path?: string;\n    'fetch-depth'?: number | string;\n    'cache-from'?: string;\n    'cache-to'?: string;\n    [chave: string]: unknown;\n  };\n  env?: Record<string, unknown>;\n  run?: string;\n}\ninterface WorkflowJob {\n  name?: string;\n  needs?: string | string[];\n  strategy?: {\n    matrix?: unknown;\n    'fail-fast'?: unknown;\n  };\n  container?: unknown;\n  steps?: WorkflowStep[];\n}\ninterface WorkflowNode extends Record<string, unknown> {\n  name?: string;\n  container?: unknown;\n  strategy?: {\n    matrix?: unknown;\n    'fail-fast'?: unknown;\n  };\n  jobs?: Record<string, WorkflowJob>;\n  steps?: WorkflowStep[];\n  uses?: string;\n  run?: string;\n}\n/** Flag global temporária (resetada a cada execução) para indicar se o workflow precisa de histórico completo do git */\nlet _workflowNeedsFullHistory = false;\n\nconst detectoresRegistrados: DeteccaoCustom[] = [];\nexport function registrarDetectorGithubActions(detector: DeteccaoCustom): void {\n  detectoresRegistrados.push(detector);\n}\nexport function obterDetectoresGithubActions(): DeteccaoCustom[] {\n  return [...detectoresRegistrados];\n}\nexport const analistaGithubActions: Analista = {\n  nome: 'github-actions',\n  categoria: 'workflows',\n  descricao: 'Analista avançado de workflows do GitHub Actions com suporte a plugins',\n  test: (relPath: string) => relPath.startsWith('.github/workflows/'),\n  async aplicar(conteudo: string, relPath: string, _ast: unknown = null, _fc?: string, contexto?: ContextoExecucao): Promise<Ocorrencia[]> {\n    const ocorrencias: Ocorrencia[] = [];\n    try {\n      const doc = parseDocument(conteudo);\n      const workflow = doc.toJS();\n      const problemas = await executarDetectoresNativos(workflow, conteudo);\n      const caminhos = contexto?.arquivos.map(arquivo => arquivo.relPath) || [];\n      const plugResults = await Promise.all(detectoresRegistrados.map(diretorio => Promise.resolve(diretorio.testar(workflow, {\n        conteudo,\n        caminhos\n      })).catch(() => [])));\n      const securityResults = await Promise.resolve(detectorWorkflowSecurity.aplicar(conteudo, relPath, _ast as NodePath | null, _fc, contexto));\n      const performanceResults = await Promise.resolve(detectorWorkflowPerformance.aplicar(conteudo, relPath, _ast as NodePath | null, _fc, contexto));\n      const estruturaResults = await Promise.resolve(detectorWorkflowEstrutura.aplicar(conteudo, relPath, _ast as NodePath | null, _fc, contexto));\n      const depsResults = await Promise.resolve(detectorDependenciasVulneraveis.aplicar(conteudo, relPath, _ast as NodePath | null, _fc, contexto));\n      const triggerResults = await Promise.resolve(detectorWorkflowTriggerInseguro.aplicar(conteudo, relPath, _ast as NodePath | null, _fc, contexto));\n      const todos = [...problemas, ...plugResults.flat()];\n      ocorrencias.push(...(securityResults as Ocorrencia[]), ...(performanceResults as Ocorrencia[]), ...(estruturaResults as Ocorrencia[]), ...(depsResults as Ocorrencia[]), ...(triggerResults as Ocorrencia[]));\n      for (const caminho of todos) {\n        ocorrencias.push({\n          tipo: `GITHUB_ACTIONS_${caminho.tipo.toUpperCase().replace(/-/g, '_')}`,\n          mensagem: caminho.descricao,\n          relPath,\n          linha: caminho.linha || 1,\n          coluna: 1,\n          sugestao: caminho.sugestao || '',\n          nivel: caminho.severidade === 'critica' || caminho.severidade === 'alta' ? 'erro' : caminho.severidade === 'media' ? 'aviso' : 'info'\n        });\n      }\n    } catch {\n      // Basic regex fallback if YAML fails\n    }\n    return ocorrencias;\n  }\n};\nexport const analistaGithubActionsGlobal: Analista = {\n  nome: 'github-actions-global',\n  categoria: 'workflows',\n  descricao: 'Governança Global do GitHub',\n  test: () => false,\n  async aplicar(_c, _p, _a, _f, ctx?: ContextoExecucao): Promise<Ocorrencia[]> {\n    if (!ctx) return [];\n    const ores: Ocorrencia[] = [];\n    const paths = ctx.arquivos.map(arquivo => arquivo.relPath);\n\n    // CODEOWNERS\n    if (!paths.some(caminho => /CODEOWNERS/i.test(caminho))) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_CODEOWNERS_MISSING',\n        mensagem: 'CODEOWNERS faltando',\n        relPath: '.github/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // README\n    const readme = ctx.arquivos?.find(arquivo => /README\\.md/i.test(arquivo.relPath ?? ''));\n    const content = readme ? readme.content as string | null || '' : '';\n    if (readme && !/Code of Conduct|Código de Conduta/i.test(content)) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_DOC_GOVERNANCE_MISSING',\n        mensagem: 'README sem Código de Conduta',\n        relPath: readme.relPath,\n        linha: 1,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // Stale Bot\n    if (!paths.some(caminho => /stale/i.test(caminho))) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_STALE_BOT_MISSING',\n        mensagem: 'Stale bot faltando',\n        relPath: '.github/workflows/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // Release\n    if (!paths.some(caminho => /release|deploy/i.test(caminho))) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_RELEASE_AUTOMATION_MISSING',\n        mensagem: 'Release automation faltando',\n        relPath: '.github/workflows/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // Issue Templates\n    if (!paths.some(caminho => /\\.github\\/ISSUE_TEMPLATE/i.test(caminho))) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_ISSUE_TEMPLATES_MISSING',\n        mensagem: 'Issue templates faltando',\n        relPath: '.github/ISSUE_TEMPLATE/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // PR Template\n    if (!paths.some(caminho => /pull_request_template/i.test(caminho))) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_PR_TEMPLATE_MISSING',\n        mensagem: 'PR template faltando',\n        relPath: '.github/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // Semantic Versioning & Changelog\n    const hasSemanticRelease = paths.some(caminho => /semantic-release|semrel/i.test(caminho));\n    const hasChangelog = paths.some(caminho => /changelog/i.test(caminho));\n    if (!hasSemanticRelease) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_SEMANTIC_VERSIONING_MISSING',\n        mensagem: 'Automação de versionamento semântico não detectada',\n        relPath: '.github/workflows/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n    if (!hasChangelog) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_CHANGELOG_AUTOMATION_MISSING',\n        mensagem: 'Automação de changelog faltando',\n        relPath: '.github/workflows/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // License Headers\n    const sourceFiles = ctx.arquivos.filter(arquivo => /\\.(ts|js)$/.test(arquivo.relPath));\n    const missingLicense = sourceFiles.filter(arquivo => !/SPDX-License-Identifier/i.test(arquivo.content as string || ''));\n    if (missingLicense.length > sourceFiles.length / 2) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_LICENSE_HEADERS_MISSING',\n        mensagem: 'Muitos arquivos sem cabeçalho de licença (SPDX)',\n        relPath: './',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n    return ores;\n  }\n};\n/**\n * Verifica se o workflow contém comandos git que exigem histórico completo.\n */\nfunction workflowRequerHistoricoCompleto(wf: WorkflowNode, raw: string): boolean {\n  // Verificar no raw por comandos git conhecidos que precisam de histórico completo\n  const gitCommandsQuePrecisamDeHistorico = /\\b(git\\s+(rev-parse|tag|describe|log|shortlog|diff|bisect|blame)|git\\s+checkout\\s+-b|git\\s+fetch\\s+--unshallow|git\\s+clone\\s+--depth)/gi;\n  if (gitCommandsQuePrecisamDeHistorico.test(raw)) {\n    return true;\n  }\n\n  // Verificar nas ações steps por comandos que indicam necessidade de histórico\n  const jobs = wf?.jobs ? Object.values(wf.jobs) : [];\n  const allSteps = jobs.flatMap(job => job?.steps || []);\n  for (const step of allSteps) {\n    if (step?.run && gitCommandsQuePrecisamDeHistorico.test(step.run)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nasync function executarDetectoresNativos(wf: unknown, raw: string): Promise<ProblemaWorkflow[]> {\n  const probs: ProblemaWorkflow[] = [];\n  if (!wf) return probs;\n\n  _workflowNeedsFullHistory = workflowRequerHistoricoCompleto(wf as WorkflowNode, raw);\n\n  // Handle various snippet styles for tests\n  const candidates = Array.isArray(wf) ? wf : [wf];\n  for (const item of candidates) {\n    if (typeof item === 'object' && item !== null) {\n      analisarEstrutura(item as WorkflowNode, probs);\n    }\n  }\n\n  // Compliance checks\n  probs.push(...detectarProblemasCompliance(wf, raw));\n\n  // Accessibility checks\n  probs.push(...detectarProblemasAcessibilidade(wf));\n\n  // Passive jobs check\n  if (typeof wf === 'object' && 'jobs' in wf) {\n    const wfJobs = (wf as {\n      jobs?: Record<string, {\n        steps?: Array<{\n          uses?: string;\n          run?: string;\n        }>;\n      }>;\n    }).jobs;\n    if (wfJobs) {\n      for (const [, job] of Object.entries(wfJobs)) {\n        if (detectarJobsPassivos(job as {\n          steps?: Array<{\n            uses?: string;\n            run?: string;\n          }>;\n        })) {\n          probs.push({\n            tipo: 'job-passivo-workflow',\n            descricao: 'Job passivo detectado',\n            severidade: 'baixa'\n          });\n        }\n      }\n    }\n  }\n\n  // Final check for raw string patterns (like sudo)\n  if (/sudo\\s+/.test(raw)) {\n    probs.push({\n      tipo: 'uso-sudo',\n      descricao: 'Uso de sudo detectado',\n      severidade: 'alta'\n    });\n  }\n  if (raw.includes('pull_request_target:')) {\n    probs.push({\n      tipo: 'estrutura-workflow',\n      descricao: 'Uso de pull_request_target',\n      severidade: 'alta'\n    });\n  }\n  return probs;\n}\nfunction analisarEstrutura(wf: WorkflowNode, probs: ProblemaWorkflow[]) {\n  // Workflow sem nome\n  if (!wf.name) {\n    probs.push({\n      tipo: 'workflow-sem-nome',\n      descricao: 'Workflow sem nome definido',\n      severidade: 'baixa'\n    });\n  }\n\n  // Container (Root level for snippets)\n  if (wf.container && typeof wf.container === 'string') {\n    probs.push({\n      tipo: 'container-sem-user',\n      descricao: 'Container sem user',\n      severidade: 'media'\n    });\n  }\n\n  // Strategy\n  if (wf.strategy?.matrix && wf.strategy['fail-fast'] === undefined) {\n    probs.push({\n      tipo: 'matrix-sem-fail-fast',\n      descricao: 'Matrix sem fail-fast',\n      severidade: 'baixa'\n    });\n  }\n\n  // Detect Secrets in generic maps (for environment snippets in tests)\n  for (const [chave, valor] of Object.entries(wf)) {\n    if (/(KEY|TOKEN|SECRET|PASSWORD)/i.test(chave) && valor && typeof valor !== 'object' && !String(valor).includes('${{')) {\n      probs.push({\n        tipo: 'env-sensivel',\n        descricao: `Secret hardcoded em ${chave}`,\n        severidade: 'critica'\n      });\n    }\n  }\n\n  // Jobs\n  if (wf.jobs) {\n    const jobEntries = Object.entries(wf.jobs);\n    for (const [id, job] of jobEntries) {\n      if (job?.strategy?.matrix && job.strategy['fail-fast'] === undefined) {\n        probs.push({\n          tipo: 'matrix-sem-fail-fast',\n          descricao: `Job ${id} sem fail-fast`,\n          severidade: 'baixa'\n        });\n      }\n      if (job?.container && typeof job.container === 'string') {\n        probs.push({\n          tipo: 'container-sem-user',\n          descricao: 'Container rodando como root',\n          severidade: 'media'\n        });\n      }\n\n      // --- v0.4.5: Job sem nome descritivo ---\n      if (/^(job\\d+|step\\d+|build\\d*|test\\d*|j\\d+)$/i.test(id) && !job?.name) {\n        probs.push({\n          tipo: 'job-sem-nome',\n          descricao: `Job '${id}' usa ID genérico sem campo 'name'`,\n          severidade: 'baixa',\n          sugestao: 'Usar nomes semânticos como build-backend, test-integration'\n        });\n      }\n      if (job?.steps) {\n        for (const string of job.steps) analisarStep(string, probs);\n\n        // --- v0.4.5: Steps sem nome ---\n        analisarStepsSemNome(job.steps, probs);\n\n        // --- v0.7.0: Jobs muito longos ---\n        if (job.steps.length > 15) {\n          probs.push({\n            tipo: 'job-longo',\n            descricao: `Job '${id}' possui ${job.steps.length} steps, o que dificulta a manutenção`,\n            severidade: 'baixa',\n            sugestao: 'Considere quebrar em jobs menores ou usar composite actions'\n          });\n        }\n      }\n    }\n\n    // --- v0.4.5: Build sem parallelismo ---\n    analisarParalelismo(jobEntries, probs);\n\n    // --- v0.4.5: Download desnecessário de artifacts ---\n    analisarDownloadArtifacts(jobEntries, probs);\n\n    // --- v0.4.5: Múltiplas instalações de dependências ---\n    analisarMultiplasInstalacoesDeps(jobEntries, probs);\n  }\n\n  // Se forem passos diretos na raiz (snippet)\n  if (wf.steps && Array.isArray(wf.steps)) {\n    for (const string of wf.steps) analisarStep(string, probs);\n    analisarStepsSemNome(wf.steps, probs);\n  }\n\n  // Direct steps (if snippet is a list)\n  if (wf.uses || wf.run) analisarStep(wf as WorkflowStep, probs);\n}\nfunction analisarStep(string: WorkflowStep, probs: ProblemaWorkflow[]) {\n  if (!string) return;\n  // Pinning - only for non-verified orgs\n  if (string.uses && /@v\\d+/.test(string.uses)) {\n    const actionRef = string.uses.split('@')[0];\n    if (!isOrgVerificada(actionRef)) {\n      probs.push({\n        tipo: 'falta-sha-pinning',\n        descricao: 'Pinning por SHA faltando',\n        severidade: 'media'\n      });\n    }\n  }\n  // Upload\n  if (string.uses?.includes('upload-artifact') && string.with?.path?.includes('.env')) {\n    probs.push({\n      tipo: 'upload-sensivel',\n      descricao: 'Upload de .env',\n      severidade: 'critica'\n    });\n  }\n  // Env\n  if (string.env) {\n    for (const [chave, valor] of Object.entries(string.env)) {\n      if (/(KEY|TOKEN|SECRET|PASSWORD)/i.test(chave) && valor && typeof valor !== 'object' && !String(valor).includes('${{')) {\n        probs.push({\n          tipo: 'env-sensivel',\n          descricao: `Env ${chave} hardcoded`,\n          severidade: 'critica'\n        });\n      }\n    }\n  }\n  // Injection\n  if (string.run && /\\$\\{\\{\\s*github\\.event\\./.test(string.run)) {\n    probs.push({\n      tipo: 'script-injection',\n      descricao: 'Script injection',\n      severidade: 'alta'\n    });\n  }\n\n  // --- v0.4.5: Docker build sem layer caching ---\n  if (string.uses && /docker\\/build-push-action/.test(string.uses)) {\n    const hasCacheFrom = string.with?.['cache-from'] !== undefined;\n    const hasCacheTo = string.with?.['cache-to'] !== undefined;\n    if (!hasCacheFrom && !hasCacheTo) {\n      probs.push({\n        tipo: 'docker-sem-layer-cache',\n        descricao: 'Docker build sem cache de layers configurado',\n        severidade: 'media',\n        sugestao: 'Adicionar cache-from e cache-to para otimizar builds Docker'\n      });\n    }\n  }\n\n  // --- v0.4.5: Checkout com fetch-depth: 0 desnecessário ---\n  if (string.uses && /actions\\/checkout/.test(string.uses) && string.with) {\n    const fd = string.with['fetch-depth'];\n    if (fd === 0 || fd === '0') {\n      // Não emitir se já foi identificado que o workflow precisa de histórico completo\n      if (!_workflowNeedsFullHistory) {\n        probs.push({\n          tipo: 'fetch-depth-desnecessario',\n          descricao: 'checkout com fetch-depth: 0 baixa todo o histórico do repositório',\n          severidade: 'baixa',\n          sugestao: 'Usar fetch-depth: 1 (default) a menos que precise do histórico completo para tags/changelog'\n        });\n      }\n    }\n  }\n}\n\nconst ACTIONS_AUTO_EXPLICATIVAS = [\n  'actions/checkout',\n  'actions/setup-node',\n  'actions/setup-python',\n  'actions/setup-java',\n  'actions/setup-go',\n  'actions/setup-dotnet',\n  'actions/setup-ruby',\n  'actions/upload-artifact',\n  'actions/download-artifact',\n  'actions/cache',\n  'actions/stale',\n  'actions/labeler',\n  'actions/dependency-review',\n  'actions/attest-build-provenance',\n  'docker/login-action',\n  'docker/build-push-action',\n  'docker/metadata-action',\n  'docker/setup-buildx-action',\n  'docker/setup-qemu-action',\n  'azure/login',\n  'azure/webapps-deploy',\n  'aws-actions/configure-aws-credentials',\n  'google-github-actions/auth',\n  'github/codeql-action/init',\n  'github/codeql-action/analyze',\n  'github/codeql-action/autobuild',\n  'softprops/action-gh-release',\n  'cypress-io/github-action',\n];\n\n/**\n * v0.4.5: Detecta steps sem campo 'name'\n * Não reporta para actions bem conhecidas e auto-explicativas\n */\nfunction analisarStepsSemNome(steps: WorkflowStep[], probs: ProblemaWorkflow[]) {\n  for (const string of steps) {\n    if (!string || string.name) continue;\n    if (string.uses || string.run) {\n      // Pular actions auto-explicativas (não precisam de name)\n      if (string.uses && ACTIONS_AUTO_EXPLICATIVAS.some(action => string.uses?.startsWith(action))) {\n        continue;\n      }\n      const ident = string.uses ? `uses: ${string.uses}` : 'run command';\n      probs.push({\n        tipo: 'step-sem-nome',\n        descricao: `Step sem campo 'name' (${ident})`,\n        severidade: 'baixa',\n        sugestao: 'Adicionar campo name: para melhor legibilidade nos logs do Actions'\n      });\n    }\n  }\n}\n\n/**\n * v0.4.5: Detecta jobs que poderiam rodar em paralelo mas têm 'needs' desnecessário\n * Heurística: se todos os jobs têm 'needs' formando uma cadeia linear, sugere paralelismo\n * Exceção: workflows de release/deploy são intrinsecamente sequenciais\n */\nfunction analisarParalelismo(jobEntries: [string, WorkflowJob][], probs: ProblemaWorkflow[]) {\n  if (jobEntries.length < 3) return;\n\n  // Check if this is a release/deploy workflow (sequential by nature)\n  const workflowName = jobEntries[0]?.[1]?.name?.toLowerCase() || '';\n  const jobNames = jobEntries.map(([, j]) => j?.name?.toLowerCase() || '').join(' ');\n  const isReleaseWorkflow = /release|deploy|publish|ship/i.test(workflowName) || /release|deploy|publish|ship/i.test(jobNames);\n  if (isReleaseWorkflow) return;\n\n  let totalWithNeeds = 0;\n  for (const [, job] of jobEntries) {\n    if (job?.needs) totalWithNeeds++;\n  }\n\n  // Se todos os jobs (exceto o primeiro) dependem do anterior em cadeia linear\n  if (totalWithNeeds === jobEntries.length - 1) {\n    probs.push({\n      tipo: 'build-sem-parallelismo',\n      descricao: 'Todos os jobs estão em cadeia linear - considere paralelizar jobs independentes',\n      severidade: 'media',\n      sugestao: 'Remover dependências (needs) desnecessárias para permitir execução paralela'\n    });\n  }\n}\n\n/**\n * v0.4.5: Detecta múltiplos download-artifact em jobs diferentes\n */\nfunction analisarDownloadArtifacts(jobEntries: [string, WorkflowJob][], probs: ProblemaWorkflow[]) {\n  let downloadCount = 0;\n  for (const [, job] of jobEntries) {\n    if (!job?.steps) continue;\n    for (const string of job.steps) {\n      if (string.uses && /download-artifact/.test(string.uses)) downloadCount++;\n    }\n  }\n  if (downloadCount >= 3) {\n    probs.push({\n      tipo: 'download-artifacts-desnecessario',\n      descricao: `${downloadCount} download-artifact encontrados - considere consolidar artifacts`,\n      severidade: 'baixa',\n      sugestao: 'Consolidar artifacts ou usar cache compartilhado'\n    });\n  }\n}\n\n/**\n * v0.4.5: Detecta npm ci/npm install em múltiplos jobs sem cache compartilhado\n */\nfunction analisarMultiplasInstalacoesDeps(jobEntries: [string, WorkflowJob][], probs: ProblemaWorkflow[]) {\n  let installCount = 0;\n  let hasCacheStep = false;\n  let hasSetupNodeWithCache = false;\n  for (const [, job] of jobEntries) {\n    if (!job?.steps) continue;\n    let jobHasInstall = false;\n    for (const string of job.steps) {\n      if (string.run && /\\b(npm\\s+(ci|install)|yarn\\s+install|pnpm\\s+install)\\b/.test(string.run)) {\n        jobHasInstall = true;\n      }\n      if (string.uses && /actions\\/cache/.test(string.uses)) {\n        hasCacheStep = true;\n      }\n      if (string.uses && /actions\\/setup-node/.test(string.uses) && string.with?.cache) {\n        hasSetupNodeWithCache = true;\n      }\n    }\n    if (jobHasInstall) installCount++;\n  }\n  if (installCount >= 2 && !hasCacheStep && !hasSetupNodeWithCache) {\n    probs.push({\n      tipo: 'multiplas-instalacoes-deps',\n      descricao: `Instalação de dependências em ${installCount} jobs sem cache compartilhado`,\n      severidade: 'media',\n      sugestao: 'Usar actions/cache ou artifact de node_modules para evitar instalações duplicadas'\n    });\n  }\n}"]}

package/dist/analysts/github-actions/analysts/index.d.ts

@@ -0,0 +1,3 @@
+export * from './analyst-github-actions.js';
+export * from './analyst-github-actions-security-hardening.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/analysts/github-actions/analysts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/analysts/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gDAAgD,CAAC"}

package/dist/analysts/github-actions/analysts/index.js

@@ -0,0 +1,3 @@
+export * from './analyst-github-actions.js';
+export * from './analyst-github-actions-security-hardening.js';
+//# sourceMappingURL=index.js.map

package/dist/analysts/github-actions/analysts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/analysts/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gDAAgD,CAAC","sourcesContent":["export * from './analyst-github-actions.js';\nexport * from './analyst-github-actions-security-hardening.js';\n"]}

package/dist/analysts/github-actions/corrections/autofix-engine.d.ts

@@ -0,0 +1,8 @@
+import type { DeteccaoCustom } from '../../../types/index.js';
+import type { Document } from 'yaml';
+export declare class AutofixEngine {
+    aplicarFixes(content: string, fixers: Array<(doc: Document) => void>): string;
+    extrairFixers(detecoes: DeteccaoCustom[]): Array<(doc: Document) => void>;
+}
+export declare const autofixEngine: AutofixEngine;
+//# sourceMappingURL=autofix-engine.d.ts.map

package/dist/analysts/github-actions/corrections/autofix-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autofix-engine.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/autofix-engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAOrC,qBAAa,aAAa;IAOjB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAC,GAAG,MAAM;IAwB7E,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAC;CAGjF;AACD,eAAO,MAAM,aAAa,eAAsB,CAAC"}

package/dist/analysts/github-actions/corrections/autofix-engine.js

@@ -0,0 +1,25 @@
+import { parseDocument } from 'yaml';
+export class AutofixEngine {
+    aplicarFixes(content, fixers) {
+        if (!content || fixers.length === 0)
+            return content;
+        const doc = parseDocument(content);
+        if (doc.errors.length > 0) {
+            return content;
+        }
+        for (const fix of fixers) {
+            try {
+                fix(doc);
+            }
+            catch (err) {
+                console.error(`Erro ao aplicar correção: ${err}`);
+            }
+        }
+        return doc.toString();
+    }
+    extrairFixers(detecoes) {
+        return detecoes.filter(diretorio => typeof diretorio.corrigir === 'function').map(diretorio => diretorio.corrigir);
+    }
+}
+export const autofixEngine = new AutofixEngine();
+//# sourceMappingURL=autofix-engine.js.map

package/dist/analysts/github-actions/corrections/autofix-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autofix-engine.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/autofix-engine.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAMrC,MAAM,OAAO,aAAa;IAOjB,YAAY,CAAC,OAAe,EAAE,MAAsC;QACzE,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QACpD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAGnC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;QAGD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,CAAC;YACX,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAMM,aAAa,CAAC,QAA0B;QAC7C,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,QAAmC,CAAC,CAAC;IAChJ,CAAC;CACF;AACD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport type { DeteccaoCustom } from '@types';\nimport type { Document } from 'yaml';\nimport { parseDocument } from 'yaml';\n\n/**\n * Motor de Auto-fix para GitHub Actions\n * Utiliza a biblioteca 'yaml' para mutar o documento preservando a formatação.\n */\nexport class AutofixEngine {\n  /**\n   * Aplica uma lista de mutadores a um conteúdo YAML\n   * @param content O conteúdo original do arquivo YAML\n   * @param fixers Lista de funções de correção que operam na AST (Document)\n   * @returns O conteúdo corrigido\n   */\n  public aplicarFixes(content: string, fixers: Array<(doc: Document) => void>): string {\n    if (!content || fixers.length === 0) return content;\n    const doc = parseDocument(content);\n\n    // Se o documento tiver erros de parse, não aplicamos correções para evitar corromper\n    if (doc.errors.length > 0) {\n      return content;\n    }\n\n    // Executa cada mutador na AST\n    for (const fix of fixers) {\n      try {\n        fix(doc);\n      } catch (err) {\n        console.error(`Erro ao aplicar correção: ${err}`);\n      }\n    }\n    return doc.toString();\n  }\n\n  /**\n   * Converte o método corrigir de DeteccaoCustom para um formato compatível com o motor\n   * @param detecoes Lista de detecções que possuem método corrigir\n   */\n  public extrairFixers(detecoes: DeteccaoCustom[]): Array<(doc: Document) => void> {\n    return detecoes.filter(diretorio => typeof diretorio.corrigir === 'function').map(diretorio => diretorio.corrigir as (doc: Document) => void);\n  }\n}\nexport const autofixEngine = new AutofixEngine();"]}