tutanus 0.12.0

package/dist/analysts/github-actions/corrections/correction-workflow.d.ts

@@ -0,0 +1,11 @@
+import type { Analista } from '../../../types/index.js';
+export interface WorkflowCorrection {
+    tipo: string;
+    original: string;
+    sugerido: string;
+    linha: number;
+    confianca: number;
+}
+export declare function detectarCorrecoesWorkflow(src: string, _relPath: string): WorkflowCorrection[];
+export declare const correctionWorkflow: Analista;
+//# sourceMappingURL=correction-workflow.d.ts.map

package/dist/analysts/github-actions/corrections/correction-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"correction-workflow.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/correction-workflow.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAG9C,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AACD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAmC7F;AACD,eAAO,MAAM,kBAAkB,EAAE,QAsBhC,CAAC"}

package/dist/analysts/github-actions/corrections/correction-workflow.js

@@ -0,0 +1,63 @@
+import { splitLines } from '../../../shared/helpers/index.js';
+import { criarOcorrencia } from '../../../types/index.js';
+export function detectarCorrecoesWorkflow(src, _relPath) {
+    const correcoes = [];
+    const linhas = splitLines(src);
+    linhas.forEach((linha, index) => {
+        const numeroLinha = index + 1;
+        if (/uses:.*@v\d+/.test(linha) && !/uses:\s*actions\//.test(linha) && !linha.includes('#')) {
+            correcoes.push({
+                tipo: 'workflow-sha-pinning',
+                original: linha,
+                sugerido: `${linha}  # FIXME: Adicione SHA pinning (@sha256:...)`,
+                linha: numeroLinha,
+                confianca: 80
+            });
+        }
+        if (/\b(KEY|TOKEN|SECRET)\b.*[:=]\s*['"][^'"]+['"]/i.test(linha) && !/\$\{\{/.test(linha)) {
+            const replaced = linha.replace(/['"][^'"]+['"]/, '${{ secrets.SECRET_NAME }}');
+            correcoes.push({
+                tipo: 'workflow-use-secrets',
+                original: linha,
+                sugerido: replaced,
+                linha: numeroLinha,
+                confianca: 90
+            });
+        }
+    });
+    if (!/permissions:/.test(src)) {
+        correcoes.push({
+            tipo: 'workflow-add-permissions',
+            original: linhas[0],
+            sugerido: `permissions:\n  contents: read\n\n${linhas[0]}`,
+            linha: 1,
+            confianca: 85
+        });
+    }
+    return correcoes;
+}
+export const correctionWorkflow = {
+    nome: 'correction-workflow',
+    categoria: 'workflows',
+    descricao: 'Correções automáticas para GitHub Actions',
+    test: (relPath) => /\.github\/workflows\/.*\.ya?ml$/i.test(relPath),
+    aplicar: (src, relPath) => {
+        if (!src)
+            return [];
+        const correcoes = detectarCorrecoesWorkflow(src, relPath);
+        return correcoes.map(elem => criarOcorrencia({
+            tipo: `correction-${elem.tipo}`,
+            nivel: elem.confianca > 85 ? 'aviso' : 'info',
+            mensagem: `Correção sugerida: ${elem.tipo}`,
+            relPath,
+            linha: elem.linha,
+            sugestao: ` ${elem.original}\n ${elem.sugerido}\nConfiança: ${elem.confianca}%`,
+            correcao: {
+                original: elem.original,
+                novo: elem.sugerido,
+                linha: elem.linha
+            }
+        }));
+    }
+};
+//# sourceMappingURL=correction-workflow.js.map

package/dist/analysts/github-actions/corrections/correction-workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"correction-workflow.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/correction-workflow.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AASpC,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,QAAgB;IACrE,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC;QAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3F,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,GAAG,KAAK,+CAA+C;gBACjE,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;QACL,CAAC;QACD,IAAI,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1F,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;YAC/E,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACnB,QAAQ,EAAE,qCAAqC,MAAM,CAAC,CAAC,CAAC,EAAE;YAC1D,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,IAAI,EAAE,qBAAqB;IAC3B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,2CAA2C;IACtD,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC;YAC3C,IAAI,EAAE,cAAc,IAAI,CAAC,IAAI,EAAE;YAC/B,KAAK,EAAE,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC7C,QAAQ,EAAE,sBAAsB,IAAI,CAAC,IAAI,EAAE;YAC3C,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,QAAQ,gBAAgB,IAAI,CAAC,SAAS,GAAG;YAC/E,QAAQ,EAAE;gBACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB;SACF,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [CHAVE-INGLESA] Correções automáticas para GitHub Actions\n *\n * Fornece correções sugeridas para problemas comuns em workflows:\n * - SHA pinning\n * - Secrets context\n * - Permissions\n */\n\nimport { splitLines } from '@shared/helpers';\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nexport interface WorkflowCorrection {\n  tipo: string;\n  original: string;\n  sugerido: string;\n  linha: number;\n  confianca: number;\n}\nexport function detectarCorrecoesWorkflow(src: string, _relPath: string): WorkflowCorrection[] {\n  const correcoes: WorkflowCorrection[] = [];\n  const linhas = splitLines(src);\n  linhas.forEach((linha, index) => {\n    const numeroLinha = index + 1;\n    if (/uses:.*@v\\d+/.test(linha) && !/uses:\\s*actions\\//.test(linha) && !linha.includes('#')) {\n      correcoes.push({\n        tipo: 'workflow-sha-pinning',\n        original: linha,\n        sugerido: `${linha}  # FIXME: Adicione SHA pinning (@sha256:...)`,\n        linha: numeroLinha,\n        confianca: 80\n      });\n    }\n    if (/\\b(KEY|TOKEN|SECRET)\\b.*[:=]\\s*['\"][^'\"]+['\"]/i.test(linha) && !/\\$\\{\\{/.test(linha)) {\n      const replaced = linha.replace(/['\"][^'\"]+['\"]/, '${{ secrets.SECRET_NAME }}');\n      correcoes.push({\n        tipo: 'workflow-use-secrets',\n        original: linha,\n        sugerido: replaced,\n        linha: numeroLinha,\n        confianca: 90\n      });\n    }\n  });\n  if (!/permissions:/.test(src)) {\n    correcoes.push({\n      tipo: 'workflow-add-permissions',\n      original: linhas[0],\n      sugerido: `permissions:\\n  contents: read\\n\\n${linhas[0]}`,\n      linha: 1,\n      confianca: 85\n    });\n  }\n  return correcoes;\n}\nexport const correctionWorkflow: Analista = {\n  nome: 'correction-workflow',\n  categoria: 'workflows',\n  descricao: 'Correções automáticas para GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const correcoes = detectarCorrecoesWorkflow(src, relPath);\n    return correcoes.map(elem => criarOcorrencia({\n      tipo: `correction-${elem.tipo}`,\n      nivel: elem.confianca > 85 ? 'aviso' : 'info',\n      mensagem: `Correção sugerida: ${elem.tipo}`,\n      relPath,\n      linha: elem.linha,\n      sugestao: ` ${elem.original}\\n ${elem.sugerido}\\nConfiança: ${elem.confianca}%`,\n      correcao: {\n        original: elem.original,\n        novo: elem.sugerido,\n        linha: elem.linha\n      }\n    }));\n  }\n};"]}

package/dist/analysts/github-actions/corrections/index.d.ts

@@ -0,0 +1,3 @@
+export * from './autofix-engine.js';
+export * from './correction-workflow.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/analysts/github-actions/corrections/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/index.ts"],"names":[],"mappings":"AACA,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC"}

package/dist/analysts/github-actions/corrections/index.js

@@ -0,0 +1,3 @@
+export * from './autofix-engine.js';
+export * from './correction-workflow.js';
+//# sourceMappingURL=index.js.map

package/dist/analysts/github-actions/corrections/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/index.ts"],"names":[],"mappings":"AACA,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nexport * from './autofix-engine.js';\nexport * from './correction-workflow.js';\n"]}

package/dist/analysts/github-actions/detectors/detector-dependencies-vulnerable.d.ts

@@ -0,0 +1,3 @@
+import type { Analista } from '../../../types/index.js';
+export declare const detectorDependenciasVulneraveis: Analista;
+//# sourceMappingURL=detector-dependencies-vulnerable.d.ts.map

package/dist/analysts/github-actions/detectors/detector-dependencies-vulnerable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-dependencies-vulnerable.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-dependencies-vulnerable.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAmL9C,eAAO,MAAM,+BAA+B,EAAE,QAqE7C,CAAC"}

package/dist/analysts/github-actions/detectors/detector-dependencies-vulnerable.js

@@ -0,0 +1,217 @@
+import { splitLines } from '../../../shared/helpers/index.js';
+import { criarOcorrencia } from '../../../types/index.js';
+import { isOrgVerificada } from './org-verified.js';
+const CVES_CONHECIDOS = [{
+        action: 'actions/checkout',
+        versions: '<v3',
+        cve: 'CVE-2022-32197',
+        descricao: 'Checkout v1/v2 não valida refs de pull request de forks',
+        severidade: 'alta',
+        fix: 'Atualizar para actions/checkout@v4'
+    }, {
+        action: 'actions/upload-artifact',
+        versions: '<v4',
+        cve: 'CVE-2023-34941',
+        descricao: 'Upload de artifacts sem checksum pode permitir adulteração',
+        severidade: 'media',
+        fix: 'Atualizar para actions/upload-artifact@v4'
+    }, {
+        action: 'actions/download-artifact',
+        versions: '<v4',
+        cve: 'CVE-2023-34941',
+        descricao: 'Download de artifacts sem verificação de integridade',
+        severidade: 'media',
+        fix: 'Atualizar para actions/download-artifact@v4'
+    }, {
+        action: 'actions/cache',
+        versions: '<v4',
+        descricao: 'Cache v1/v2/v3 com risco de restauração de conteúdo inesperado',
+        cve: 'CVE-2023-22490',
+        severidade: 'baixa',
+        fix: 'Atualizar para actions/cache@v4'
+    }, {
+        action: 'actions/setup-node',
+        versions: '<v4',
+        cve: 'CVE-2023-32471',
+        descricao: 'setup-node v1-v3 pode injetar conteúdo no GITHUB_STATE',
+        severidade: 'media',
+        fix: 'Atualizar para actions/setup-node@v4'
+    }, {
+        action: 'docker/login-action',
+        versions: '<v3',
+        cve: 'CVE-2023-29017',
+        descricao: 'login-action v2 loga argumentos do Docker incluindo tokens',
+        severidade: 'alta',
+        fix: 'Atualizar para docker/login-action@v3'
+    }, {
+        action: 'docker/build-push-action',
+        versions: '<v5',
+        cve: 'CVE-2023-34941',
+        descricao: 'Build sem proveniência verificável',
+        severidade: 'media',
+        fix: 'Atualizar para docker/build-push-action@v5'
+    }, {
+        action: 'actions/setup-python',
+        versions: '<v5',
+        cve: 'CVE-2023-39446',
+        descricao: 'setup-python v4 não sanitiza variáveis de ambiente',
+        severidade: 'baixa',
+        fix: 'Atualizar para actions/setup-python@v5'
+    }];
+const FORK_SUSPEITO_PATTERNS = [/^[a-zA-Z0-9-]+\/[a-zA-Z0-9-]+@[a-f0-9]{40}$/,
+    /^[a-zA-Z0-9-]+-[a-zA-Z0-9-]+-[a-zA-Z0-9-]+@/
+];
+const VERSOES_VULNERAVEIS_NPM = {
+    'serialize-javascript': {
+        vulneravel: '<6.0.0',
+        fix: 'Atualizar para serialize-javascript@>=6.0.0'
+    },
+    'node-fetch': {
+        vulneravel: '<2.6.7',
+        fix: 'Atualizar para node-fetch@>=2.6.7'
+    },
+    'tar': {
+        vulneravel: '<6.1.11',
+        fix: 'Atualizar para tar@>=6.1.11'
+    },
+    'minimist': {
+        vulneravel: '<1.2.6',
+        fix: 'Atualizar para minimist@>=1.2.6'
+    },
+    'lodash': {
+        vulneravel: '<4.17.21',
+        fix: 'Atualizar para lodash@>=4.17.21'
+    },
+    'yaml': {
+        vulneravel: '<2.0.0',
+        fix: 'Atualizar para yaml@>=2.0.0'
+    }
+};
+function verificarActionVulneravel(uses, linha, relPath) {
+    const match = uses.match(/^([a-zA-Z0-9-]+\/[a-zA-Z0-9-]+)@(.+)$/);
+    if (!match)
+        return null;
+    const [, actionRef, version] = match;
+    for (const cve of CVES_CONHECIDOS) {
+        if (actionRef === cve.action) {
+            const versaoNum = parseInt(version.replace(/^v/, ''), 10);
+            const maxVersao = parseInt(cve.versions.replace(/^<v/, ''), 10);
+            if (!isNaN(versaoNum) && !isNaN(maxVersao) && versaoNum < maxVersao) {
+                return criarOcorrencia({
+                    tipo: 'dependencia-vulneravel',
+                    nivel: cve.severidade === 'alta' ? 'erro' : cve.severidade === 'media' ? 'aviso' : 'info',
+                    mensagem: `${actionRef}@${version}: ${cve.descricao} (${cve.cve})`,
+                    relPath,
+                    linha,
+                    sugestao: cve.fix
+                });
+            }
+        }
+    }
+    if (!isOrgVerificada(actionRef)) {
+        for (const pattern of FORK_SUSPEITO_PATTERNS) {
+            if (pattern.test(uses)) {
+                return criarOcorrencia({
+                    tipo: 'fork-suspeito',
+                    nivel: 'aviso',
+                    mensagem: `Action suspeita detectada: ${uses}`,
+                    relPath,
+                    linha,
+                    sugestao: 'Prefira actions oficiais ou de organizações verificadas. Revise o código do fork antes de usar.'
+                });
+            }
+        }
+    }
+    return null;
+}
+function verificarDependenciasNpm(runCommand, linha, relPath) {
+    for (const [dep, info] of Object.entries(VERSOES_VULNERAVEIS_NPM)) {
+        if (new RegExp(`${dep}@?[\\s'\"<>=]`).test(runCommand)) {
+            if (runCommand.includes(`npm install ${dep}`) || runCommand.includes(`npm i ${dep}`)) {
+                return criarOcorrencia({
+                    tipo: 'dependencia-npm-vulneravel',
+                    nivel: 'info',
+                    mensagem: `Possível dependência npm vulnerável: ${dep}`,
+                    relPath,
+                    linha,
+                    sugestao: info.fix
+                });
+            }
+            const versionMatch = runCommand.match(new RegExp(`${dep}@([\\d^~<>]+)`));
+            if (versionMatch) {
+                return criarOcorrencia({
+                    tipo: 'dependencia-npm-vulneravel',
+                    nivel: 'aviso',
+                    mensagem: `${dep}@${versionMatch[1]} pode conter vulnerabilidades conhecidas`,
+                    relPath,
+                    linha,
+                    sugestao: info.fix
+                });
+            }
+        }
+    }
+    return null;
+}
+export const detectorDependenciasVulneraveis = {
+    nome: 'detector-dependencias-vulneraveis',
+    categoria: 'workflows',
+    descricao: 'Detecta dependências vulneráveis em GitHub Actions',
+    test: (relPath) => /\.github\/workflows\/.*\.ya?ml$/i.test(relPath),
+    aplicar: (src, relPath) => {
+        if (!src)
+            return [];
+        const ocorrencias = [];
+        const linhas = splitLines(src);
+        for (let indice = 0; indice < linhas.length; indice++) {
+            const linha = linhas[indice];
+            const numeroLinha = indice + 1;
+            const usesMatch = linha.match(/uses:\s*([a-zA-Z0-9-]+\/[a-zA-Z0-9-]+@[\w.]+)/);
+            if (usesMatch) {
+                const ocorrencia = verificarActionVulneravel(usesMatch[1], numeroLinha, relPath);
+                if (ocorrencia) {
+                    ocorrencias.push(ocorrencia);
+                }
+            }
+            if (linha.match(/run:\s*['"]?npm/)) {
+                const npmOcorrencia = verificarDependenciasNpm(linha, numeroLinha, relPath);
+                if (npmOcorrencia) {
+                    ocorrencias.push(npmOcorrencia);
+                }
+            }
+        }
+        const hasInstallStep = /npm\s+(install|i\b)|yarn\s+install|pnpm\s+install/i.test(src);
+        const hasAuditStep = /\b(npm\s+audit|yarn\s+audit|pnpm\s+audit|snyk|trivy)\b/i.test(src);
+        if (hasInstallStep && !hasAuditStep) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'workflow-sem-audit',
+                nivel: 'info',
+                mensagem: 'Workflow instala dependências sem auditoria de segurança',
+                relPath,
+                linha: 1,
+                sugestao: 'Adicione um passo de npm audit, snyk ou similar para detectar vulnerabilidades'
+            }));
+        }
+        const isReleaseOrDeployWorkflow = /release|deploy|publish|tag|changelog/i.test(src);
+        const checkoutsWithoutPersistFalse = [];
+        for (let indice = 0; indice < linhas.length; indice++) {
+            if (/uses:\s*actions\/checkout/.test(linhas[indice])) {
+                const proximasLinhas = linhas.slice(indice, Math.min(indice + 10, linhas.length)).join('\n');
+                if (!/persist-credentials:\s*false/.test(proximasLinhas)) {
+                    checkoutsWithoutPersistFalse.push(indice + 1);
+                }
+            }
+        }
+        if (checkoutsWithoutPersistFalse.length > 0 && !isReleaseOrDeployWorkflow) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'checkout-sem-persist-credentials-false',
+                nivel: 'info',
+                mensagem: `${checkoutsWithoutPersistFalse.length} checkout(s) sem persist-credentials: false`,
+                relPath,
+                linha: checkoutsWithoutPersistFalse[0],
+                sugestao: 'Adicione persist-credentials: false para evitar exposição de tokens, a menos que o workflow precise escrever no repositório'
+            }));
+        }
+        return ocorrencias;
+    }
+};
+//# sourceMappingURL=detector-dependencies-vulnerable.js.map

package/dist/analysts/github-actions/detectors/detector-dependencies-vulnerable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-dependencies-vulnerable.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-dependencies-vulnerable.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAWpD,MAAM,eAAe,GAAe,CAAC;QACnC,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,yDAAyD;QACpE,UAAU,EAAE,MAAM;QAClB,GAAG,EAAE,oCAAoC;KAC1C,EAAE;QACD,MAAM,EAAE,yBAAyB;QACjC,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,4DAA4D;QACvE,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,2CAA2C;KACjD,EAAE;QACD,MAAM,EAAE,2BAA2B;QACnC,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,sDAAsD;QACjE,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,6CAA6C;KACnD,EAAE;QACD,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gEAAgE;QAC3E,GAAG,EAAE,gBAAgB;QACrB,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,iCAAiC;KACvC,EAAE;QACD,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,wDAAwD;QACnE,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,sCAAsC;KAC5C,EAAE;QACD,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,4DAA4D;QACvE,UAAU,EAAE,MAAM;QAClB,GAAG,EAAE,uCAAuC;KAC7C,EAAE;QACD,MAAM,EAAE,0BAA0B;QAClC,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,oCAAoC;QAC/C,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,4CAA4C;KAClD,EAAE;QACD,MAAM,EAAE,sBAAsB;QAC9B,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,oDAAoD;QAC/D,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,wCAAwC;KAC9C,CAAC,CAAC;AAGH,MAAM,sBAAsB,GAAG,CAAC,6CAA6C;IAE7E,6CAA6C;CAC5C,CAAC;AACF,MAAM,uBAAuB,GAGxB;IACH,sBAAsB,EAAE;QACtB,UAAU,EAAE,QAAQ;QACpB,GAAG,EAAE,6CAA6C;KACnD;IACD,YAAY,EAAE;QACZ,UAAU,EAAE,QAAQ;QACpB,GAAG,EAAE,mCAAmC;KACzC;IACD,KAAK,EAAE;QACL,UAAU,EAAE,SAAS;QACrB,GAAG,EAAE,6BAA6B;KACnC;IACD,UAAU,EAAE;QACV,UAAU,EAAE,QAAQ;QACpB,GAAG,EAAE,iCAAiC;KACvC;IACD,QAAQ,EAAE;QACR,UAAU,EAAE,UAAU;QACtB,GAAG,EAAE,iCAAiC;KACvC;IACD,MAAM,EAAE;QACN,UAAU,EAAE,QAAQ;QACpB,GAAG,EAAE,6BAA6B;KACnC;CACF,CAAC;AACF,SAAS,yBAAyB,CAAC,IAAY,EAAE,KAAa,EAAE,OAAe;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IAGrC,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,SAAS,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,SAAS,EAAE,CAAC;gBACpE,OAAO,eAAe,CAAC;oBACrB,IAAI,EAAE,wBAAwB;oBAC9B,KAAK,EAAE,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;oBACzF,QAAQ,EAAE,GAAG,SAAS,IAAI,OAAO,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,GAAG,GAAG;oBAClE,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,GAAG,CAAC,GAAG;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAID,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,OAAO,eAAe,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,8BAA8B,IAAI,EAAE;oBAC9C,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,iGAAiG;iBAC5G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,wBAAwB,CAAC,UAAkB,EAAE,KAAa,EAAE,OAAe;IAClF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAElE,IAAI,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,IAAI,UAAU,CAAC,QAAQ,CAAC,eAAe,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC;gBAErF,OAAO,eAAe,CAAC;oBACrB,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,wCAAwC,GAAG,EAAE;oBACvD,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,IAAI,CAAC,GAAG;iBACnB,CAAC,CAAC;YACL,CAAC;YAGD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC;YACzE,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,eAAe,CAAC;oBACrB,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,GAAG,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,0CAA0C;oBAC7E,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,IAAI,CAAC,GAAG;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,CAAC,MAAM,+BAA+B,GAAa;IACvD,IAAI,EAAE,mCAAmC;IACzC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,oDAAoD;IAC/D,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,CAAC;YAG/B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/E,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;gBACjF,IAAI,UAAU,EAAE,CAAC;oBACf,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAGD,IAAI,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACnC,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;gBAC5E,IAAI,aAAa,EAAE,CAAC;oBAClB,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAGD,MAAM,cAAc,GAAG,oDAAoD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,yDAAyD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzF,IAAI,cAAc,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,oBAAoB;gBAC1B,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,0DAA0D;gBACpE,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,gFAAgF;aAC3F,CAAC,CAAC,CAAC;QACN,CAAC;QAID,MAAM,yBAAyB,GAAG,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpF,MAAM,4BAA4B,GAAa,EAAE,CAAC;QAClD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;YACtD,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrD,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7F,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;oBACzD,4BAA4B,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,4BAA4B,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC1E,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,wCAAwC;gBAC9C,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,GAAG,4BAA4B,CAAC,MAAM,6CAA6C;gBAC7F,OAAO;gBACP,KAAK,EAAE,4BAA4B,CAAC,CAAC,CAAC;gBACtC,QAAQ,EAAE,6HAA6H;aACxI,CAAC,CAAC,CAAC;QACN,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector de Dependências Vulneráveis para GitHub Actions\n *\n * Detecta dependências potencialmente vulneráveis em workflows:\n * - Actions com CVEs conhecidos (base de dados de vulnerabilidades)\n * - Actions que não usam SHA pinning (facilmente exploráveis)\n * - Versões desatualizadas de actions com patches de segurança\n * - Dependências npm/yarn com versões conhecidamente vulneráveis\n * - Uso de actions de forks sem verificação\n */\n\nimport { splitLines } from '@shared/helpers';\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nimport { isOrgVerificada } from './org-verified.js';\n\n// Base de dados de CVEs conhecidos para actions populares\ntype CVEEntry = {\n  action: string;\n  versions: string;\n  cve: string;\n  descricao: string;\n  severidade: 'alta' | 'media' | 'baixa';\n  fix: string;\n};\nconst CVES_CONHECIDOS: CVEEntry[] = [{\n  action: 'actions/checkout',\n  versions: '<v3',\n  cve: 'CVE-2022-32197',\n  descricao: 'Checkout v1/v2 não valida refs de pull request de forks',\n  severidade: 'alta',\n  fix: 'Atualizar para actions/checkout@v4'\n}, {\n  action: 'actions/upload-artifact',\n  versions: '<v4',\n  cve: 'CVE-2023-34941',\n  descricao: 'Upload de artifacts sem checksum pode permitir adulteração',\n  severidade: 'media',\n  fix: 'Atualizar para actions/upload-artifact@v4'\n}, {\n  action: 'actions/download-artifact',\n  versions: '<v4',\n  cve: 'CVE-2023-34941',\n  descricao: 'Download de artifacts sem verificação de integridade',\n  severidade: 'media',\n  fix: 'Atualizar para actions/download-artifact@v4'\n}, {\n  action: 'actions/cache',\n  versions: '<v4',\n  descricao: 'Cache v1/v2/v3 com risco de restauração de conteúdo inesperado',\n  cve: 'CVE-2023-22490',\n  severidade: 'baixa',\n  fix: 'Atualizar para actions/cache@v4'\n}, {\n  action: 'actions/setup-node',\n  versions: '<v4',\n  cve: 'CVE-2023-32471',\n  descricao: 'setup-node v1-v3 pode injetar conteúdo no GITHUB_STATE',\n  severidade: 'media',\n  fix: 'Atualizar para actions/setup-node@v4'\n}, {\n  action: 'docker/login-action',\n  versions: '<v3',\n  cve: 'CVE-2023-29017',\n  descricao: 'login-action v2 loga argumentos do Docker incluindo tokens',\n  severidade: 'alta',\n  fix: 'Atualizar para docker/login-action@v3'\n}, {\n  action: 'docker/build-push-action',\n  versions: '<v5',\n  cve: 'CVE-2023-34941',\n  descricao: 'Build sem proveniência verificável',\n  severidade: 'media',\n  fix: 'Atualizar para docker/build-push-action@v5'\n}, {\n  action: 'actions/setup-python',\n  versions: '<v5',\n  cve: 'CVE-2023-39446',\n  descricao: 'setup-python v4 não sanitiza variáveis de ambiente',\n  severidade: 'baixa',\n  fix: 'Atualizar para actions/setup-python@v5'\n}];\n\n// Actions frequentemente usadas em forks maliciosos\nconst FORK_SUSPEITO_PATTERNS = [/^[a-zA-Z0-9-]+\\/[a-zA-Z0-9-]+@[a-f0-9]{40}$/,\n// Fork com SHA longo não oficial\n/^[a-zA-Z0-9-]+-[a-zA-Z0-9-]+-[a-zA-Z0-9-]+@/ // Padrão de nome de fork suspeito\n];\nconst VERSOES_VULNERAVEIS_NPM: Record<string, {\n  vulneravel: string;\n  fix: string;\n}> = {\n  'serialize-javascript': {\n    vulneravel: '<6.0.0',\n    fix: 'Atualizar para serialize-javascript@>=6.0.0'\n  },\n  'node-fetch': {\n    vulneravel: '<2.6.7',\n    fix: 'Atualizar para node-fetch@>=2.6.7'\n  },\n  'tar': {\n    vulneravel: '<6.1.11',\n    fix: 'Atualizar para tar@>=6.1.11'\n  },\n  'minimist': {\n    vulneravel: '<1.2.6',\n    fix: 'Atualizar para minimist@>=1.2.6'\n  },\n  'lodash': {\n    vulneravel: '<4.17.21',\n    fix: 'Atualizar para lodash@>=4.17.21'\n  },\n  'yaml': {\n    vulneravel: '<2.0.0',\n    fix: 'Atualizar para yaml@>=2.0.0'\n  }\n};\nfunction verificarActionVulneravel(uses: string, linha: number, relPath: string): Ocorrencia | null {\n  const match = uses.match(/^([a-zA-Z0-9-]+\\/[a-zA-Z0-9-]+)@(.+)$/);\n  if (!match) return null;\n  const [, actionRef, version] = match;\n\n  // Verificar CVEs conhecidos\n  for (const cve of CVES_CONHECIDOS) {\n    if (actionRef === cve.action) {\n      const versaoNum = parseInt(version.replace(/^v/, ''), 10);\n      const maxVersao = parseInt(cve.versions.replace(/^<v/, ''), 10);\n      if (!isNaN(versaoNum) && !isNaN(maxVersao) && versaoNum < maxVersao) {\n        return criarOcorrencia({\n          tipo: 'dependencia-vulneravel',\n          nivel: cve.severidade === 'alta' ? 'erro' : cve.severidade === 'media' ? 'aviso' : 'info',\n          mensagem: `${actionRef}@${version}: ${cve.descricao} (${cve.cve})`,\n          relPath,\n          linha,\n          sugestao: cve.fix\n        });\n      }\n    }\n  }\n\n  // Verificar fork suspeito - APENAS se NÃO for de organização verificada\n  // SHA pinning em actions de orgs verificadas é boa prática de segurança\n  if (!isOrgVerificada(actionRef)) {\n    for (const pattern of FORK_SUSPEITO_PATTERNS) {\n      if (pattern.test(uses)) {\n        return criarOcorrencia({\n          tipo: 'fork-suspeito',\n          nivel: 'aviso',\n          mensagem: `Action suspeita detectada: ${uses}`,\n          relPath,\n          linha,\n          sugestao: 'Prefira actions oficiais ou de organizações verificadas. Revise o código do fork antes de usar.'\n        });\n      }\n    }\n  }\n  return null;\n}\nfunction verificarDependenciasNpm(runCommand: string, linha: number, relPath: string): Ocorrencia | null {\n  for (const [dep, info] of Object.entries(VERSOES_VULNERAVEIS_NPM)) {\n    // Detectar require/import de versões vulneráveis\n    if (new RegExp(`${dep}@?[\\\\s'\\\"<>=]`).test(runCommand)) {\n      if (runCommand.includes(`npm install ${dep}`) || runCommand.includes(`npm i ${dep}`)) {\n        // Se instala sem versão específica, não sabemos a versão, mas vale avisar\n        return criarOcorrencia({\n          tipo: 'dependencia-npm-vulneravel',\n          nivel: 'info',\n          mensagem: `Possível dependência npm vulnerável: ${dep}`,\n          relPath,\n          linha,\n          sugestao: info.fix\n        });\n      }\n\n      // Extrair versão do package.json se mencionado\n      const versionMatch = runCommand.match(new RegExp(`${dep}@([\\\\d^~<>]+)`));\n      if (versionMatch) {\n        return criarOcorrencia({\n          tipo: 'dependencia-npm-vulneravel',\n          nivel: 'aviso',\n          mensagem: `${dep}@${versionMatch[1]} pode conter vulnerabilidades conhecidas`,\n          relPath,\n          linha,\n          sugestao: info.fix\n        });\n      }\n    }\n  }\n  return null;\n}\nexport const detectorDependenciasVulneraveis: Analista = {\n  nome: 'detector-dependencias-vulneraveis',\n  categoria: 'workflows',\n  descricao: 'Detecta dependências vulneráveis em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = splitLines(src);\n    for (let indice = 0; indice < linhas.length; indice++) {\n      const linha = linhas[indice];\n      const numeroLinha = indice + 1;\n\n      // --- 1. Actions com CVEs conhecidos ---\n      const usesMatch = linha.match(/uses:\\s*([a-zA-Z0-9-]+\\/[a-zA-Z0-9-]+@[\\w.]+)/);\n      if (usesMatch) {\n        const ocorrencia = verificarActionVulneravel(usesMatch[1], numeroLinha, relPath);\n        if (ocorrencia) {\n          ocorrencias.push(ocorrencia);\n        }\n      }\n\n      // --- 2. Dependências npm vulneráveis em run commands ---\n      if (linha.match(/run:\\s*['\"]?npm/)) {\n        const npmOcorrencia = verificarDependenciasNpm(linha, numeroLinha, relPath);\n        if (npmOcorrencia) {\n          ocorrencias.push(npmOcorrencia);\n        }\n      }\n    }\n\n    // --- 3. Verificar falta de audit step em workflows com instalação de deps ---\n    const hasInstallStep = /npm\\s+(install|i\\b)|yarn\\s+install|pnpm\\s+install/i.test(src);\n    const hasAuditStep = /\\b(npm\\s+audit|yarn\\s+audit|pnpm\\s+audit|snyk|trivy)\\b/i.test(src);\n    if (hasInstallStep && !hasAuditStep) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-sem-audit',\n        nivel: 'info',\n        mensagem: 'Workflow instala dependências sem auditoria de segurança',\n        relPath,\n        linha: 1,\n        sugestao: 'Adicione um passo de npm audit, snyk ou similar para detectar vulnerabilidades'\n      }));\n    }\n\n    // --- 4. Verificar se actions de checkout têm persist-credentials: true (padrão perigoso) ---\n    // Reportar apenas uma vez por workflow, e ignorar workflows que claramente precisam de escrita\n    const isReleaseOrDeployWorkflow = /release|deploy|publish|tag|changelog/i.test(src);\n    const checkoutsWithoutPersistFalse: number[] = [];\n    for (let indice = 0; indice < linhas.length; indice++) {\n      if (/uses:\\s*actions\\/checkout/.test(linhas[indice])) {\n        const proximasLinhas = linhas.slice(indice, Math.min(indice + 10, linhas.length)).join('\\n');\n        if (!/persist-credentials:\\s*false/.test(proximasLinhas)) {\n          checkoutsWithoutPersistFalse.push(indice + 1);\n        }\n      }\n    }\n    if (checkoutsWithoutPersistFalse.length > 0 && !isReleaseOrDeployWorkflow) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'checkout-sem-persist-credentials-false',\n        nivel: 'info',\n        mensagem: `${checkoutsWithoutPersistFalse.length} checkout(s) sem persist-credentials: false`,\n        relPath,\n        linha: checkoutsWithoutPersistFalse[0],\n        sugestao: 'Adicione persist-credentials: false para evitar exposição de tokens, a menos que o workflow precise escrever no repositório'\n      }));\n    }\n    return ocorrencias;\n  }\n};"]}

package/dist/analysts/github-actions/detectors/detector-workflow-accessibility.d.ts

@@ -0,0 +1,4 @@
+import type { Analista, ProblemaWorkflow } from '../../../types/index.js';
+export declare const detectorWorkflowAcessibilidade: Analista;
+export declare function detectarProblemasAcessibilidade(workflow: unknown): ProblemaWorkflow[];
+//# sourceMappingURL=detector-workflow-accessibility.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-accessibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-workflow-accessibility.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-accessibility.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAc,gBAAgB,EAAE,MAAM,GAAG,CAAC;AAGhE,eAAO,MAAM,8BAA8B,EAAE,QA+B5C,CAAC;AAEF,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,EAAE,CA8BrF"}

package/dist/analysts/github-actions/detectors/detector-workflow-accessibility.js

@@ -0,0 +1,53 @@
+import { criarOcorrencia } from '../../../types/index.js';
+export const detectorWorkflowAcessibilidade = {
+    nome: 'detector-workflow-acessibilidade',
+    categoria: 'workflows',
+    descricao: 'Detecta problemas de acessibilidade em GitHub Actions',
+    test: (relPath) => /\.github\/workflows\/.*\.ya?ml$/i.test(relPath),
+    aplicar: (src, relPath) => {
+        if (!src)
+            return [];
+        const ocorrencias = [];
+        const linhas = src.split('\n');
+        let hasTimeout = false;
+        linhas.forEach((linha) => {
+            if (/timeout-minutes/.test(linha)) {
+                hasTimeout = true;
+            }
+        });
+        if (!hasTimeout) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'workflow-sem-timeout',
+                nivel: 'aviso',
+                mensagem: 'Workflow sem timeout configurado',
+                relPath,
+                linha: 1,
+                sugestao: 'Adicionar timeout-minutes para evitar execuções infinitas'
+            }));
+        }
+        return ocorrencias;
+    }
+};
+export function detectarProblemasAcessibilidade(workflow) {
+    const problemas = [];
+    const wf = workflow;
+    if (!wf?.jobs)
+        return problemas;
+    let hasTimeout = wf['timeout-minutes'] !== undefined;
+    for (const [, job] of Object.entries(wf.jobs)) {
+        if (!job)
+            continue;
+        if (job['timeout-minutes'])
+            hasTimeout = true;
+    }
+    if (!hasTimeout) {
+        problemas.push({
+            tipo: 'workflow-sem-timeout',
+            descricao: 'Workflow sem timeout configurado',
+            severidade: 'media',
+            sugestao: 'Adicionar timeout-minutes ao workflow ou jobs'
+        });
+    }
+    return problemas;
+}
+//# sourceMappingURL=detector-workflow-accessibility.js.map

package/dist/analysts/github-actions/detectors/detector-workflow-accessibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-workflow-accessibility.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-accessibility.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,MAAM,CAAC,MAAM,8BAA8B,GAAa;IACtD,IAAI,EAAE,kCAAkC;IACxC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,uDAAuD;IAClE,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,UAAU,GAAG,KAAK,CAAC;QAEvB,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACvB,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,sBAAsB;gBAC5B,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,kCAAkC;gBAC5C,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,2DAA2D;aACtE,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,+BAA+B,CAAC,QAAiB;IAC/D,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,QAMS,CAAC;IAErB,IAAI,CAAC,EAAE,EAAE,IAAI;QAAE,OAAO,SAAS,CAAC;IAEhC,IAAI,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,SAAS,CAAC;IAErD,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,GAAG,CAAC,iBAAiB,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,sBAAsB;YAC5B,SAAS,EAAE,kCAAkC;YAC7C,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,+CAA+C;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * Detector de Acessibilidade para GitHub Actions\n *\n * Detecta problemas de acessibilidade/usabilidade em workflows:\n * - Steps sem nome descritivo\n * - Jobs sem timeout configurado\n */\n\nimport type { Analista, Ocorrencia, ProblemaWorkflow } from '@';\nimport { criarOcorrencia } from '@';\n\nexport const detectorWorkflowAcessibilidade: Analista = {\n  nome: 'detector-workflow-acessibilidade',\n  categoria: 'workflows',\n  descricao: 'Detecta problemas de acessibilidade em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = src.split('\\n');\n\n    let hasTimeout = false;\n\n    linhas.forEach((linha) => {\n      if (/timeout-minutes/.test(linha)) {\n        hasTimeout = true;\n      }\n    });\n\n    if (!hasTimeout) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-sem-timeout',\n        nivel: 'aviso',\n        mensagem: 'Workflow sem timeout configurado',\n        relPath,\n        linha: 1,\n        sugestao: 'Adicionar timeout-minutes para evitar execuções infinitas'\n      }));\n    }\n\n    return ocorrencias;\n  }\n};\n\nexport function detectarProblemasAcessibilidade(workflow: unknown): ProblemaWorkflow[] {\n  const problemas: ProblemaWorkflow[] = [];\n  const wf = workflow as {\n    jobs?: Record<string, {\n      steps?: Array<{ name?: string; run?: string }>;\n      'timeout-minutes'?: number;\n    }>;\n    'timeout-minutes'?: number;\n  } | null | undefined;\n\n  if (!wf?.jobs) return problemas;\n\n  let hasTimeout = wf['timeout-minutes'] !== undefined;\n\n  for (const [, job] of Object.entries(wf.jobs)) {\n    if (!job) continue;\n\n    if (job['timeout-minutes']) hasTimeout = true;\n  }\n\n  if (!hasTimeout) {\n    problemas.push({\n      tipo: 'workflow-sem-timeout',\n      descricao: 'Workflow sem timeout configurado',\n      severidade: 'media',\n      sugestao: 'Adicionar timeout-minutes ao workflow ou jobs'\n    });\n  }\n\n  return problemas;\n}\n"]}

package/dist/analysts/github-actions/detectors/detector-workflow-compliance.d.ts

@@ -0,0 +1,4 @@
+import type { Analista, ProblemaWorkflow } from '../../../types/index.js';
+export declare const detectorWorkflowCompliance: Analista;
+export declare function detectarProblemasCompliance(workflow: unknown, _conteudo: string): ProblemaWorkflow[];
+//# sourceMappingURL=detector-workflow-compliance.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-compliance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-workflow-compliance.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-compliance.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,QAAQ,EAAc,gBAAgB,EAAE,MAAM,GAAG,CAAC;AAkBhE,eAAO,MAAM,0BAA0B,EAAE,QAuFxC,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAyCpG"}

package/dist/analysts/github-actions/detectors/detector-workflow-compliance.js

@@ -0,0 +1,138 @@
+import { criarOcorrencia } from '../../../types/index.js';
+import { isOrgVerificada } from './org-verified.js';
+const ACTIONS_DEPRECIADAS = new Map([
+    ['actions/cache@v1', 'actions/cache@v3 ou superior'],
+    ['actions/cache@v2', 'actions/cache@v3 ou superior'],
+    ['actions/checkout@v1', 'actions/checkout@v3 ou superior'],
+    ['actions/checkout@v2', 'actions/checkout@v3 ou superior'],
+    ['actions/setup-node@v1', 'actions/setup-node@v3 ou superior'],
+    ['actions/setup-node@v2', 'actions/setup-node@v3 ou superior'],
+    ['actions/upload-artifact@v1', 'actions/upload-artifact@v3 ou superior'],
+    ['actions/upload-artifact@v2', 'actions/upload-artifact@v3 ou superior'],
+    ['actions/download-artifact@v1', 'actions/download-artifact@v3 ou superior'],
+    ['actions/download-artifact@v2', 'actions/download-artifact@v3 ou superior'],
+]);
+export const detectorWorkflowCompliance = {
+    nome: 'detector-workflow-compliance',
+    categoria: 'workflows',
+    descricao: 'Detecta problemas de compliance em GitHub Actions',
+    test: (relPath) => /\.github\/workflows\/.*\.ya?ml$/i.test(relPath),
+    aplicar: (src, relPath) => {
+        if (!src)
+            return [];
+        const ocorrencias = [];
+        const linhas = src.split('\n');
+        linhas.forEach((linha, index) => {
+            const numeroLinha = index + 1;
+            const usesMatch = linha.match(/uses:\s*([^\s@]+)@([^\s]+)/);
+            if (usesMatch) {
+                const [, actionRef, version] = usesMatch;
+                if (!isOrgVerificada(actionRef)) {
+                    const isOrgAction = /^[a-zA-Z0-9-]+\/[a-zA-Z0-9-]+$/.test(actionRef);
+                    if (isOrgAction) {
+                        ocorrencias.push(criarOcorrencia({
+                            tipo: 'workflow-action-nao-verificada',
+                            nivel: 'aviso',
+                            mensagem: `Action de fonte não verificada: ${actionRef}`,
+                            relPath,
+                            linha: numeroLinha,
+                            sugestao: 'Prefira actions oficiais do GitHub ou de organizações verificadas'
+                        }));
+                    }
+                }
+                const actionKey = `${actionRef}@${version}`;
+                if (ACTIONS_DEPRECIADAS.has(actionKey)) {
+                    const recomendacao = ACTIONS_DEPRECIADAS.get(actionKey);
+                    if (recomendacao) {
+                        ocorrencias.push(criarOcorrencia({
+                            tipo: 'workflow-action-depreciada',
+                            nivel: 'aviso',
+                            mensagem: `Action depreciada: ${actionKey}`,
+                            relPath,
+                            linha: numeroLinha,
+                            sugestao: `Atualizar para ${recomendacao}`
+                        }));
+                    }
+                }
+            }
+            if (/retention-days/.test(linha)) {
+                const daysMatch = linha.match(/retention-days:\s*(\d+)/);
+                if (daysMatch) {
+                    const days = parseInt(daysMatch[1], 10);
+                    if (days > 90) {
+                        ocorrencias.push(criarOcorrencia({
+                            tipo: 'workflow-retention-excessiva',
+                            nivel: 'info',
+                            mensagem: `Retenção de artifacts excessiva: ${days} dias`,
+                            relPath,
+                            linha: numeroLinha,
+                            sugestao: 'Considere reduzir retention-days para 30 dias ou menos para economizar storage'
+                        }));
+                    }
+                    else if (days === 0) {
+                        ocorrencias.push(criarOcorrencia({
+                            tipo: 'workflow-retention-infinita',
+                            nivel: 'aviso',
+                            mensagem: 'Retenção de artifacts infinita (0 dias)',
+                            relPath,
+                            linha: numeroLinha,
+                            sugestao: 'Defina um período de retenção finito para evitar acúmulo de storage'
+                        }));
+                    }
+                }
+            }
+        });
+        if (!/retention-days/.test(src) && /upload-artifact/.test(src)) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'workflow-sem-retention-policy',
+                nivel: 'info',
+                mensagem: 'Upload de artifacts sem política de retenção definida',
+                relPath,
+                linha: 1,
+                sugestao: 'Adicionar retention-days para controlar armazenamento de artifacts'
+            }));
+        }
+        return ocorrencias;
+    }
+};
+export function detectarProblemasCompliance(workflow, _conteudo) {
+    const problemas = [];
+    const wf = workflow;
+    if (!wf?.jobs)
+        return problemas;
+    for (const [, job] of Object.entries(wf.jobs)) {
+        if (!job?.steps)
+            continue;
+        for (const step of job.steps) {
+            if (!step.uses)
+                continue;
+            const usesMatch = step.uses.match(/([^\s@]+)@([^\s]+)/);
+            if (!usesMatch)
+                continue;
+            const [, actionRef] = usesMatch;
+            if (!isOrgVerificada(actionRef)) {
+                const isOrgAction = /^[a-zA-Z0-9-]+\/[a-zA-Z0-9-]+$/.test(actionRef);
+                if (isOrgAction) {
+                    problemas.push({
+                        tipo: 'action-nao-verificada',
+                        descricao: `Action de fonte não verificada: ${actionRef}`,
+                        severidade: 'media'
+                    });
+                }
+            }
+            if (step.with?.['retention-days'] !== undefined) {
+                const days = Number(step.with['retention-days']);
+                if (days > 90) {
+                    problemas.push({
+                        tipo: 'retention-excessiva',
+                        descricao: `Retenção de artifacts excessiva: ${days} dias`,
+                        severidade: 'baixa',
+                        sugestao: 'Reduzir para 30 dias ou menos'
+                    });
+                }
+            }
+        }
+    }
+    return problemas;
+}
+//# sourceMappingURL=detector-workflow-compliance.js.map

package/dist/analysts/github-actions/detectors/detector-workflow-compliance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-workflow-compliance.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-compliance.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;IACpD,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;IACpD,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;IAC1D,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;IAC1D,CAAC,uBAAuB,EAAE,mCAAmC,CAAC;IAC9D,CAAC,uBAAuB,EAAE,mCAAmC,CAAC;IAC9D,CAAC,4BAA4B,EAAE,wCAAwC,CAAC;IACxE,CAAC,4BAA4B,EAAE,wCAAwC,CAAC;IACxE,CAAC,8BAA8B,EAAE,0CAA0C,CAAC;IAC5E,CAAC,8BAA8B,EAAE,0CAA0C,CAAC;CAC7E,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAa;IAClD,IAAI,EAAE,8BAA8B;IACpC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,mDAAmD;IAC9D,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC;YAE9B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC5D,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;gBAEzC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;oBAChC,MAAM,WAAW,GAAG,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACrE,IAAI,WAAW,EAAE,CAAC;wBAChB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,gCAAgC;4BACtC,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,mCAAmC,SAAS,EAAE;4BACxD,OAAO;4BACP,KAAK,EAAE,WAAW;4BAClB,QAAQ,EAAE,mEAAmE;yBAC9E,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;gBAED,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;gBAC5C,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBACvC,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACxD,IAAI,YAAY,EAAE,CAAC;wBACjB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,4BAA4B;4BAClC,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,sBAAsB,SAAS,EAAE;4BAC3C,OAAO;4BACP,KAAK,EAAE,WAAW;4BAClB,QAAQ,EAAE,kBAAkB,YAAY,EAAE;yBAC3C,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;gBACzD,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;wBACd,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,8BAA8B;4BACpC,KAAK,EAAE,MAAM;4BACb,QAAQ,EAAE,oCAAoC,IAAI,OAAO;4BACzD,OAAO;4BACP,KAAK,EAAE,WAAW;4BAClB,QAAQ,EAAE,gFAAgF;yBAC3F,CAAC,CAAC,CAAC;oBACN,CAAC;yBAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;wBACtB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,6BAA6B;4BACnC,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,yCAAyC;4BACnD,OAAO;4BACP,KAAK,EAAE,WAAW;4BAClB,QAAQ,EAAE,qEAAqE;yBAChF,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,+BAA+B;gBACrC,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,uDAAuD;gBACjE,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,oEAAoE;aAC/E,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,QAAiB,EAAE,SAAiB;IAC9E,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,QAA8H,CAAC;IAC1I,IAAI,CAAC,EAAE,EAAE,IAAI;QAAE,OAAO,SAAS,CAAC;IAEhC,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,EAAE,KAAK;YAAE,SAAS;QAC1B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,MAAM,CAAC,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC;YAEhC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrE,IAAI,WAAW,EAAE,CAAC;oBAChB,SAAS,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,uBAAuB;wBAC7B,SAAS,EAAE,mCAAmC,SAAS,EAAE;wBACzD,UAAU,EAAE,OAAO;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACjD,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;oBACd,SAAS,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,qBAAqB;wBAC3B,SAAS,EAAE,oCAAoC,IAAI,OAAO;wBAC1D,UAAU,EAAE,OAAO;wBACnB,QAAQ,EAAE,+BAA+B;qBAC1C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector de Compliance para GitHub Actions\n *\n * Detecta problemas de compliance em workflows:\n * - Licenças incompatíveis em actions\n * - Actions de fontes não verificadas\n * - Políticas de retenção de artifacts\n * - Actions depreciadas\n * - Uso de actions de forks não oficiais\n */\n\nimport type { Analista, Ocorrencia, ProblemaWorkflow } from '@';\nimport { criarOcorrencia } from '@';\n\nimport { isOrgVerificada } from './org-verified.js';\n\nconst ACTIONS_DEPRECIADAS = new Map([\n  ['actions/cache@v1', 'actions/cache@v3 ou superior'],\n  ['actions/cache@v2', 'actions/cache@v3 ou superior'],\n  ['actions/checkout@v1', 'actions/checkout@v3 ou superior'],\n  ['actions/checkout@v2', 'actions/checkout@v3 ou superior'],\n  ['actions/setup-node@v1', 'actions/setup-node@v3 ou superior'],\n  ['actions/setup-node@v2', 'actions/setup-node@v3 ou superior'],\n  ['actions/upload-artifact@v1', 'actions/upload-artifact@v3 ou superior'],\n  ['actions/upload-artifact@v2', 'actions/upload-artifact@v3 ou superior'],\n  ['actions/download-artifact@v1', 'actions/download-artifact@v3 ou superior'],\n  ['actions/download-artifact@v2', 'actions/download-artifact@v3 ou superior'],\n]);\n\nexport const detectorWorkflowCompliance: Analista = {\n  nome: 'detector-workflow-compliance',\n  categoria: 'workflows',\n  descricao: 'Detecta problemas de compliance em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = src.split('\\n');\n\n    linhas.forEach((linha, index) => {\n      const numeroLinha = index + 1;\n\n      const usesMatch = linha.match(/uses:\\s*([^\\s@]+)@([^\\s]+)/);\n      if (usesMatch) {\n        const [, actionRef, version] = usesMatch;\n\n        if (!isOrgVerificada(actionRef)) {\n          const isOrgAction = /^[a-zA-Z0-9-]+\\/[a-zA-Z0-9-]+$/.test(actionRef);\n          if (isOrgAction) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'workflow-action-nao-verificada',\n              nivel: 'aviso',\n              mensagem: `Action de fonte não verificada: ${actionRef}`,\n              relPath,\n              linha: numeroLinha,\n              sugestao: 'Prefira actions oficiais do GitHub ou de organizações verificadas'\n            }));\n          }\n        }\n\n        const actionKey = `${actionRef}@${version}`;\n        if (ACTIONS_DEPRECIADAS.has(actionKey)) {\n          const recomendacao = ACTIONS_DEPRECIADAS.get(actionKey);\n          if (recomendacao) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'workflow-action-depreciada',\n              nivel: 'aviso',\n              mensagem: `Action depreciada: ${actionKey}`,\n              relPath,\n              linha: numeroLinha,\n              sugestao: `Atualizar para ${recomendacao}`\n            }));\n          }\n        }\n      }\n\n      if (/retention-days/.test(linha)) {\n        const daysMatch = linha.match(/retention-days:\\s*(\\d+)/);\n        if (daysMatch) {\n          const days = parseInt(daysMatch[1], 10);\n          if (days > 90) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'workflow-retention-excessiva',\n              nivel: 'info',\n              mensagem: `Retenção de artifacts excessiva: ${days} dias`,\n              relPath,\n              linha: numeroLinha,\n              sugestao: 'Considere reduzir retention-days para 30 dias ou menos para economizar storage'\n            }));\n          } else if (days === 0) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'workflow-retention-infinita',\n              nivel: 'aviso',\n              mensagem: 'Retenção de artifacts infinita (0 dias)',\n              relPath,\n              linha: numeroLinha,\n              sugestao: 'Defina um período de retenção finito para evitar acúmulo de storage'\n            }));\n          }\n        }\n      }\n    });\n\n    if (!/retention-days/.test(src) && /upload-artifact/.test(src)) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-sem-retention-policy',\n        nivel: 'info',\n        mensagem: 'Upload de artifacts sem política de retenção definida',\n        relPath,\n        linha: 1,\n        sugestao: 'Adicionar retention-days para controlar armazenamento de artifacts'\n      }));\n    }\n\n    return ocorrencias;\n  }\n};\n\nexport function detectarProblemasCompliance(workflow: unknown, _conteudo: string): ProblemaWorkflow[] {\n  const problemas: ProblemaWorkflow[] = [];\n  const wf = workflow as { jobs?: Record<string, { steps?: Array<{ uses?: string; with?: Record<string, unknown> }> }> } | null | undefined;\n  if (!wf?.jobs) return problemas;\n\n  for (const [, job] of Object.entries(wf.jobs)) {\n    if (!job?.steps) continue;\n    for (const step of job.steps) {\n      if (!step.uses) continue;\n\n      const usesMatch = step.uses.match(/([^\\s@]+)@([^\\s]+)/);\n      if (!usesMatch) continue;\n\n      const [, actionRef] = usesMatch;\n\n      if (!isOrgVerificada(actionRef)) {\n        const isOrgAction = /^[a-zA-Z0-9-]+\\/[a-zA-Z0-9-]+$/.test(actionRef);\n        if (isOrgAction) {\n          problemas.push({\n            tipo: 'action-nao-verificada',\n            descricao: `Action de fonte não verificada: ${actionRef}`,\n            severidade: 'media'\n          });\n        }\n      }\n\n      if (step.with?.['retention-days'] !== undefined) {\n        const days = Number(step.with['retention-days']);\n        if (days > 90) {\n          problemas.push({\n            tipo: 'retention-excessiva',\n            descricao: `Retenção de artifacts excessiva: ${days} dias`,\n            severidade: 'baixa',\n            sugestao: 'Reduzir para 30 dias ou menos'\n          });\n        }\n      }\n    }\n  }\n\n  return problemas;\n}\n"]}

package/dist/analysts/github-actions/detectors/detector-workflow-performance.d.ts

@@ -0,0 +1,3 @@
+import type { Analista } from '../../../types/index.js';
+export declare const detectorWorkflowPerformance: Analista;
+//# sourceMappingURL=detector-workflow-performance.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-performance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-workflow-performance.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-performance.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAG9C,eAAO,MAAM,2BAA2B,EAAE,QAwIzC,CAAC"}