tutanus 0.12.0

package/dist/analysts/github-actions/detectors/detector-workflow-performance.js

@@ -0,0 +1,124 @@
+import { criarOcorrencia } from '../../../types/index.js';
+export const detectorWorkflowPerformance = {
+    nome: 'detector-workflow-performance',
+    categoria: 'workflows',
+    descricao: 'Detecta problemas de performance em GitHub Actions',
+    test: (relPath) => /\.github\/workflows\/.*\.ya?ml$/i.test(relPath),
+    aplicar: (src, relPath) => {
+        if (!src)
+            return [];
+        const ocorrencias = [];
+        const linhas = src.split('\n');
+        let inJobsSection = false;
+        let currentJob = '';
+        const jobsWithCheckout = new Map();
+        const jobsWithNpmInstall = new Set();
+        const jobsWithNpmCi = new Set();
+        linhas.forEach((linha, index) => {
+            const numeroLinha = index + 1;
+            if (/^jobs:\s*$/.test(linha)) {
+                inJobsSection = true;
+                return;
+            }
+            if (inJobsSection && /^\w[\w-]*:\s*$/.test(linha) && !linha.startsWith(' ') && !linha.startsWith('\t')) {
+                currentJob = linha.trim().replace(':', '');
+            }
+            if (/\bzips?\s+.*upload-artifact/i.test(src) || /tar\s+.*upload-artifact/i.test(src)) {
+                if (!ocorrencias.some(ocorrencia => ocorrencia.tipo === 'workflow-manual-artifact-compression')) {
+                    ocorrencias.push(criarOcorrencia({
+                        tipo: 'workflow-manual-artifact-compression',
+                        nivel: 'info',
+                        mensagem: 'Compressão manual de artefato detectada antes de upload',
+                        relPath,
+                        linha: numeroLinha,
+                        sugestao: 'Use actions/upload-artifact@v4 que possui compressão nativa eficiente'
+                    }));
+                }
+            }
+            if (/uses:\s*actions\/checkout/.test(linha)) {
+                if (currentJob) {
+                    jobsWithCheckout.set(currentJob, (jobsWithCheckout.get(currentJob) || 0) + 1);
+                }
+            }
+            if (/\bnpm\s+install\b/.test(linha) && currentJob) {
+                jobsWithNpmInstall.add(currentJob);
+            }
+            if (/\bnpm\s+ci\b/.test(linha) && currentJob) {
+                jobsWithNpmCi.add(currentJob);
+            }
+            if (/matrix:/.test(linha)) {
+                const matrixContent = src.slice(src.indexOf(linha));
+                const itemsMatch = matrixContent.match(/\[(.*?)\]/g);
+                const dimensionCount = (linha.match(/:/g) || []).length;
+                if (itemsMatch && itemsMatch.length > 5 || dimensionCount > 3) {
+                    ocorrencias.push(criarOcorrencia({
+                        tipo: 'workflow-complex-matrix',
+                        nivel: 'aviso',
+                        mensagem: 'Matrix strategy muito complexa ou grande',
+                        relPath,
+                        linha: numeroLinha,
+                        sugestao: 'Considere simplificar a matrix ou usar jobs separados para clareza'
+                    }));
+                }
+            }
+            if (/\b(npm install|curl|wget|apt-get install)\b/.test(linha) && !/retry|continue-on-error/i.test(src)) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'workflow-missing-retry',
+                    nivel: 'info',
+                    mensagem: 'Operação de rede sem política de retry detectada',
+                    relPath,
+                    linha: numeroLinha,
+                    sugestao: 'Adicione mecanismos de retry para evitar falhas intermitentes de rede'
+                }));
+            }
+            if (/\b(mkdir|touch|cp|dd)\b/.test(linha) && !/\b(rm|clean|delete|prune)\b/i.test(src)) {
+                if (!ocorrencias.some(ocorrencia => ocorrencia.tipo === 'workflow-missing-cleanup')) {
+                    ocorrencias.push(criarOcorrencia({
+                        tipo: 'workflow-missing-cleanup',
+                        nivel: 'info',
+                        mensagem: 'Possível falta de limpeza de arquivos temporários',
+                        relPath,
+                        linha: numeroLinha,
+                        sugestao: 'Adicione um passo de limpeza (cleanup) para evitar consumo excessivo de disco'
+                    }));
+                }
+            }
+        });
+        let hasRedundantCheckoutInSameJob = false;
+        for (const [, count] of jobsWithCheckout) {
+            if (count > 1) {
+                hasRedundantCheckoutInSameJob = true;
+                break;
+            }
+        }
+        if (hasRedundantCheckoutInSameJob) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'workflow-redundant-checkout',
+                nivel: 'aviso',
+                mensagem: 'Múltiplos checkouts detectados no mesmo job',
+                relPath,
+                linha: 1,
+                sugestao: 'Consolidar steps para evitar múltiplos checkouts no mesmo job'
+            }));
+        }
+        let hasRedundantNpmInstall = false;
+        for (const job of jobsWithNpmInstall) {
+            if (jobsWithNpmCi.has(job)) {
+                hasRedundantNpmInstall = true;
+                break;
+            }
+        }
+        if (hasRedundantNpmInstall) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'workflow-redundant-npm-install',
+                nivel: 'aviso',
+                mensagem: 'Uso de npm install e npm ci no mesmo job',
+                relPath,
+                linha: 1,
+                sugestao: 'Use apenas npm ci para ambientes de CI'
+            }));
+        }
+        return ocorrencias;
+    }
+};
+//# sourceMappingURL=detector-workflow-performance.js.map

package/dist/analysts/github-actions/detectors/detector-workflow-performance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-workflow-performance.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-performance.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,MAAM,CAAC,MAAM,2BAA2B,GAAa;IACnD,IAAI,EAAE,+BAA+B;IACrC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,oDAAoD;IAC/D,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACnD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAExC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC;YAG9B,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,aAAa,GAAG,IAAI,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,IAAI,aAAa,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvG,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7C,CAAC;YAGD,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,sCAAsC,CAAC,EAAE,CAAC;oBAChG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,sCAAsC;wBAC5C,KAAK,EAAE,MAAM;wBACb,QAAQ,EAAE,yDAAyD;wBACnE,OAAO;wBACP,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,uEAAuE;qBAClF,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAGD,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,IAAI,UAAU,EAAE,CAAC;oBACf,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;YACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBAClD,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC7C,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC;YAGD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACrD,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACxD,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;oBAC9D,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,yBAAyB;wBAC/B,KAAK,EAAE,OAAO;wBACd,QAAQ,EAAE,0CAA0C;wBACpD,OAAO;wBACP,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,oEAAoE;qBAC/E,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAGD,IAAI,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,wBAAwB;oBAC9B,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,kDAAkD;oBAC5D,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,uEAAuE;iBAClF,CAAC,CAAC,CAAC;YACN,CAAC;YAGD,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,0BAA0B,CAAC,EAAE,CAAC;oBACpF,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,0BAA0B;wBAChC,KAAK,EAAE,MAAM;wBACb,QAAQ,EAAE,mDAAmD;wBAC7D,OAAO;wBACP,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,+EAA+E;qBAC1F,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,6BAA6B,GAAG,KAAK,CAAC;QAC1C,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACzC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,6BAA6B,GAAG,IAAI,CAAC;gBACrC,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,6BAA6B,EAAE,CAAC;YAClC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,6BAA6B;gBACnC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,6CAA6C;gBACvD,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,+DAA+D;aAC1E,CAAC,CAAC,CAAC;QACN,CAAC;QAED,IAAI,sBAAsB,GAAG,KAAK,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,sBAAsB,GAAG,IAAI,CAAC;gBAC9B,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,sBAAsB,EAAE,CAAC;YAC3B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,gCAAgC;gBACtC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,0CAA0C;gBACpD,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,wCAAwC;aACnD,CAAC,CAAC,CAAC;QACN,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector de Performance para GitHub Actions\n *\n * Detecta problemas de performance em workflows:\n * - Falta de compressão de artefatos\n * - Passos redundantes\n * - Estratégia de matrix ineficiente\n */\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nexport const detectorWorkflowPerformance: Analista = {\n  nome: 'detector-workflow-performance',\n  categoria: 'workflows',\n  descricao: 'Detecta problemas de performance em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = src.split('\\n');\n\n    let inJobsSection = false;\n    let currentJob = '';\n    const jobsWithCheckout = new Map<string, number>();\n    const jobsWithNpmInstall = new Set<string>();\n    const jobsWithNpmCi = new Set<string>();\n\n    linhas.forEach((linha, index) => {\n      const numeroLinha = index + 1;\n\n      // Track job context - jobs are at root level under 'jobs:'\n      if (/^jobs:\\s*$/.test(linha)) {\n        inJobsSection = true;\n        return;\n      }\n      if (inJobsSection && /^\\w[\\w-]*:\\s*$/.test(linha) && !linha.startsWith(' ') && !linha.startsWith('\\t')) {\n        currentJob = linha.trim().replace(':', '');\n      }\n\n      // 1. Artifact Compression\n      if (/\\bzips?\\s+.*upload-artifact/i.test(src) || /tar\\s+.*upload-artifact/i.test(src)) {\n        if (!ocorrencias.some(ocorrencia => ocorrencia.tipo === 'workflow-manual-artifact-compression')) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'workflow-manual-artifact-compression',\n            nivel: 'info',\n            mensagem: 'Compressão manual de artefato detectada antes de upload',\n            relPath,\n            linha: numeroLinha,\n            sugestao: 'Use actions/upload-artifact@v4 que possui compressão nativa eficiente'\n          }));\n        }\n      }\n\n      // 2. Redundant Steps - track checkouts per job\n      if (/uses:\\s*actions\\/checkout/.test(linha)) {\n        if (currentJob) {\n          jobsWithCheckout.set(currentJob, (jobsWithCheckout.get(currentJob) || 0) + 1);\n        }\n      }\n      if (/\\bnpm\\s+install\\b/.test(linha) && currentJob) {\n        jobsWithNpmInstall.add(currentJob);\n      }\n      if (/\\bnpm\\s+ci\\b/.test(linha) && currentJob) {\n        jobsWithNpmCi.add(currentJob);\n      }\n\n      // 3. Matrix efficiency\n      if (/matrix:/.test(linha)) {\n        const matrixContent = src.slice(src.indexOf(linha));\n        const itemsMatch = matrixContent.match(/\\[(.*?)\\]/g);\n        const dimensionCount = (linha.match(/:/g) || []).length;\n        if (itemsMatch && itemsMatch.length > 5 || dimensionCount > 3) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'workflow-complex-matrix',\n            nivel: 'aviso',\n            mensagem: 'Matrix strategy muito complexa ou grande',\n            relPath,\n            linha: numeroLinha,\n            sugestao: 'Considere simplificar a matrix ou usar jobs separados para clareza'\n          }));\n        }\n      }\n\n      // 5. Retry Policy\n      if (/\\b(npm install|curl|wget|apt-get install)\\b/.test(linha) && !/retry|continue-on-error/i.test(src)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-missing-retry',\n          nivel: 'info',\n          mensagem: 'Operação de rede sem política de retry detectada',\n          relPath,\n          linha: numeroLinha,\n          sugestao: 'Adicione mecanismos de retry para evitar falhas intermitentes de rede'\n        }));\n      }\n\n      // 6. Clean-up\n      if (/\\b(mkdir|touch|cp|dd)\\b/.test(linha) && !/\\b(rm|clean|delete|prune)\\b/i.test(src)) {\n        if (!ocorrencias.some(ocorrencia => ocorrencia.tipo === 'workflow-missing-cleanup')) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'workflow-missing-cleanup',\n            nivel: 'info',\n            mensagem: 'Possível falta de limpeza de arquivos temporários',\n            relPath,\n            linha: numeroLinha,\n            sugestao: 'Adicione um passo de limpeza (cleanup) para evitar consumo excessivo de disco'\n          }));\n        }\n      }\n    });\n    // Only flag redundant checkout if multiple checkouts in SAME job (not across different jobs)\n    let hasRedundantCheckoutInSameJob = false;\n    for (const [, count] of jobsWithCheckout) {\n      if (count > 1) {\n        hasRedundantCheckoutInSameJob = true;\n        break;\n      }\n    }\n    if (hasRedundantCheckoutInSameJob) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-redundant-checkout',\n        nivel: 'aviso',\n        mensagem: 'Múltiplos checkouts detectados no mesmo job',\n        relPath,\n        linha: 1,\n        sugestao: 'Consolidar steps para evitar múltiplos checkouts no mesmo job'\n      }));\n    }\n    // Only flag redundant npm install if both npm install AND npm ci exist in the SAME job\n    let hasRedundantNpmInstall = false;\n    for (const job of jobsWithNpmInstall) {\n      if (jobsWithNpmCi.has(job)) {\n        hasRedundantNpmInstall = true;\n        break;\n      }\n    }\n    if (hasRedundantNpmInstall) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-redundant-npm-install',\n        nivel: 'aviso',\n        mensagem: 'Uso de npm install e npm ci no mesmo job',\n        relPath,\n        linha: 1,\n        sugestao: 'Use apenas npm ci para ambientes de CI'\n      }));\n    }\n    return ocorrencias;\n  }\n};"]}

package/dist/analysts/github-actions/detectors/detector-workflow-security.d.ts

@@ -0,0 +1,3 @@
+import type { Analista } from '../../../types/index.js';
+export declare const detectorWorkflowSecurity: Analista;
+//# sourceMappingURL=detector-workflow-security.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-workflow-security.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-security.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAK9C,eAAO,MAAM,wBAAwB,EAAE,QA4JtC,CAAC"}

package/dist/analysts/github-actions/detectors/detector-workflow-security.js

@@ -0,0 +1,146 @@
+import { splitLines } from '../../../shared/helpers/index.js';
+import { criarOcorrencia } from '../../../types/index.js';
+import { isOrgVerificada } from './org-verified.js';
+export const detectorWorkflowSecurity = {
+    nome: 'detector-workflow-security',
+    categoria: 'workflows',
+    descricao: 'Detecta vulnerabilidades em GitHub Actions',
+    test: (relPath) => /\.github\/workflows\/.*\.ya?ml$/i.test(relPath),
+    aplicar: (src, relPath) => {
+        if (!src)
+            return [];
+        const ocorrencias = [];
+        const linhas = splitLines(src);
+        const actionsSemShaPinning = [];
+        linhas.forEach((linha, index) => {
+            const numeroLinha = index + 1;
+            if (/\$\{\{\s*github\.event\./.test(linha) && /run:/.test(linha)) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'workflow-script-injection',
+                    nivel: 'erro',
+                    mensagem: 'Possível script injection via contexto GitHub',
+                    relPath,
+                    linha: numeroLinha,
+                    sugestao: 'Sanitize o input ou use variáveis de ambiente'
+                }));
+            }
+            const usesMatch = linha.match(/uses:\s*([^\s@]+)@([^\s]+)/);
+            if (usesMatch) {
+                const [, actionRef, version] = usesMatch;
+                if (/^v\d+/.test(version) && !isOrgVerificada(actionRef)) {
+                    actionsSemShaPinning.push({ linha: numeroLinha, action: `${actionRef}@${version}` });
+                }
+            }
+            if (/\b(KEY|TOKEN|SECRET|PASSWORD)\b.*[:=]\s*['"][^'"]+['"]/i.test(linha) && !/\$\{\{/.test(linha)) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'workflow-hardcoded-secret',
+                    nivel: 'erro',
+                    mensagem: 'Secret hardcoded no workflow',
+                    relPath,
+                    linha: numeroLinha,
+                    sugestao: 'Use ${{ secrets.SECRET_NAME }}'
+                }));
+            }
+            if (/\bsudo\s+/.test(linha)) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'workflow-sudo-usage',
+                    nivel: 'aviso',
+                    mensagem: 'Uso de sudo detectado',
+                    relPath,
+                    linha: numeroLinha,
+                    sugestao: 'Use container com user específico ao invés de sudo'
+                }));
+            }
+            if (/\/home\/runner\//.test(linha) || /\/tmp\//.test(linha)) {
+                const isGitHubVar = /\$\{?\{?\s*(runner\.temp|GITHUB_WORKSPACE|RUNNER_TEMP)/.test(linha);
+                const isComment = linha.trim().startsWith('#');
+                const isCleanupCommand = /rm\s+-.+\/tmp\//.test(linha);
+                if (!isGitHubVar && !isComment && !isCleanupCommand) {
+                    ocorrencias.push(criarOcorrencia({
+                        tipo: 'workflow-hardcoded-path',
+                        nivel: 'info',
+                        mensagem: 'Caminho absoluto ou temporário hardcoded',
+                        relPath,
+                        linha: numeroLinha,
+                        sugestao: 'Use variáveis de ambiente como $GITHUB_WORKSPACE ou ${{ runner.temp }}'
+                    }));
+                }
+            }
+            if (/echo\s+.*::set-output\s+name=.*secret/i.test(linha) || (/echo\s+.*\$(SECRET|TOKEN|KEY)/i.test(linha) && !/::add-mask::/i.test(src))) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'workflow-sensitive-output',
+                    nivel: 'erro',
+                    mensagem: 'Possível exposição de segredo no output do console',
+                    relPath,
+                    linha: numeroLinha,
+                    sugestao: 'Use ::add-mask:: antes de imprimir ou evite imprimir segredos'
+                }));
+            }
+            if (/pull_request_target:/.test(linha)) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'workflow-pr-target',
+                    nivel: 'erro',
+                    mensagem: 'pull_request_target pode executar código de fork',
+                    relPath,
+                    linha: numeroLinha,
+                    sugestao: 'Use pull_request ao invés de pull_request_target'
+                }));
+            }
+            if (/workflow_run:/.test(linha)) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'workflow-run-trigger',
+                    nivel: 'aviso',
+                    mensagem: 'workflow_run pode ser inseguro se usar checkout de fork',
+                    relPath,
+                    linha: numeroLinha,
+                    sugestao: 'Use pull_request ou garanta que não há checkout de refs externas'
+                }));
+            }
+            if (/checkout@v\d+/.test(linha) && /fetch-depth:\s*0/.test(linha)) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'workflow-fetch-depth-zero',
+                    nivel: 'info',
+                    mensagem: 'checkout com fetch-depth: 0 baixa todo histórico',
+                    relPath,
+                    linha: numeroLinha,
+                    sugestao: 'Use fetch-depth: 1 se não precisar do histórico'
+                }));
+            }
+        });
+        if (actionsSemShaPinning.length > 0) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'workflow-missing-sha-pinning',
+                nivel: 'aviso',
+                mensagem: `${actionsSemShaPinning.length} action(s) de terceiros sem pinning por SHA: ${actionsSemShaPinning.map(a => a.action).join(', ')}`,
+                relPath,
+                linha: 1,
+                sugestao: 'Use @<commit-sha-completo> para garantir integridade da action'
+            }));
+        }
+        if (!/permissions:/.test(src)) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'workflow-missing-permissions',
+                nivel: 'info',
+                mensagem: 'Permissions não definidas - usa GITHUB_TOKEN default',
+                relPath,
+                linha: 1,
+                sugestao: 'Adicione permissions: com escopo mínimo necessário'
+            }));
+        }
+        const hasAuditStep = /\b(npm audit|yarn audit|snyk|trivy|checkov|terrascan|gitleaks|semgrep)\b/i.test(src);
+        const isBuildOrDeploy = /\b(npm install|yarn|pnpm|build|deploy|publish|docker build|docker push)\b/i.test(src);
+        const isSecurityWorkflow = /codeql|security-advanced|security-enhanced-code-scanning/i.test(src);
+        if (isBuildOrDeploy && !hasAuditStep && !isSecurityWorkflow) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'workflow-missing-security-scan',
+                nivel: 'aviso',
+                mensagem: 'Workflow de build/deploy sem auditoria de segurança',
+                relPath,
+                linha: 1,
+                sugestao: 'Adicione um passo de npm audit, snyk ou similar'
+            }));
+        }
+        return ocorrencias;
+    }
+};
+//# sourceMappingURL=detector-workflow-security.js.map

package/dist/analysts/github-actions/detectors/detector-workflow-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-workflow-security.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-security.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,CAAC,MAAM,wBAAwB,GAAa;IAChD,IAAI,EAAE,4BAA4B;IAClC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,4CAA4C;IACvD,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,oBAAoB,GAA6C,EAAE,CAAC;QAE1E,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC;YAE9B,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,+CAA+C;oBACzD,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,+CAA+C;iBAC1D,CAAC,CAAC,CAAC;YACN,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC5D,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;gBACzC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;oBACzD,oBAAoB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;gBACvF,CAAC;YACH,CAAC;YAED,IAAI,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,8BAA8B;oBACxC,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,gCAAgC;iBAC3C,CAAC,CAAC,CAAC;YACN,CAAC;YAED,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,qBAAqB;oBAC3B,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,uBAAuB;oBACjC,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,oDAAoD;iBAC/D,CAAC,CAAC,CAAC;YACN,CAAC;YAED,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5D,MAAM,WAAW,GAAG,wDAAwD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzF,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC/C,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvD,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACpD,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,yBAAyB;wBAC/B,KAAK,EAAE,MAAM;wBACb,QAAQ,EAAE,0CAA0C;wBACpD,OAAO;wBACP,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,wEAAwE;qBACnF,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAED,IAAI,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,oDAAoD;oBAC9D,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,+DAA+D;iBAC1E,CAAC,CAAC,CAAC;YACN,CAAC;YAED,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,oBAAoB;oBAC1B,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,kDAAkD;oBAC5D,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,kDAAkD;iBAC7D,CAAC,CAAC,CAAC;YACN,CAAC;YAED,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,sBAAsB;oBAC5B,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,yDAAyD;oBACnE,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,kEAAkE;iBAC7E,CAAC,CAAC,CAAC;YACN,CAAC;YAED,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,kDAAkD;oBAC5D,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,iDAAiD;iBAC5D,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,8BAA8B;gBACpC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,GAAG,oBAAoB,CAAC,MAAM,gDAAgD,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC5I,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,gEAAgE;aAC3E,CAAC,CAAC,CAAC;QACN,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,8BAA8B;gBACpC,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,sDAAsD;gBAChE,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,oDAAoD;aAC/D,CAAC,CAAC,CAAC;QACN,CAAC;QAED,MAAM,YAAY,GAAG,2EAA2E,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3G,MAAM,eAAe,GAAG,4EAA4E,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/G,MAAM,kBAAkB,GAAG,2DAA2D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjG,IAAI,eAAe,IAAI,CAAC,YAAY,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5D,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,gCAAgC;gBACtC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,qDAAqD;gBAC/D,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,iDAAiD;aAC5D,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector de segurança GitHub Actions\n *\n * Detecta vulnerabilidades em workflows:\n * - Script injection\n * - Missing SHA pinning\n * - Hardcoded secrets\n * - sudo usage\n * - pull_request_target\n * - Missing permissions\n */\n\nimport { splitLines } from '@shared/helpers';\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nimport { isOrgVerificada } from './org-verified.js';\n\nexport const detectorWorkflowSecurity: Analista = {\n  nome: 'detector-workflow-security',\n  categoria: 'workflows',\n  descricao: 'Detecta vulnerabilidades em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = splitLines(src);\n\n    const actionsSemShaPinning: Array<{ linha: number; action: string }> = [];\n\n    linhas.forEach((linha, index) => {\n      const numeroLinha = index + 1;\n\n      if (/\\$\\{\\{\\s*github\\.event\\./.test(linha) && /run:/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-script-injection',\n          nivel: 'erro',\n          mensagem: 'Possível script injection via contexto GitHub',\n          relPath,\n          linha: numeroLinha,\n          sugestao: 'Sanitize o input ou use variáveis de ambiente'\n        }));\n      }\n\n      const usesMatch = linha.match(/uses:\\s*([^\\s@]+)@([^\\s]+)/);\n      if (usesMatch) {\n        const [, actionRef, version] = usesMatch;\n        if (/^v\\d+/.test(version) && !isOrgVerificada(actionRef)) {\n          actionsSemShaPinning.push({ linha: numeroLinha, action: `${actionRef}@${version}` });\n        }\n      }\n\n      if (/\\b(KEY|TOKEN|SECRET|PASSWORD)\\b.*[:=]\\s*['\"][^'\"]+['\"]/i.test(linha) && !/\\$\\{\\{/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-hardcoded-secret',\n          nivel: 'erro',\n          mensagem: 'Secret hardcoded no workflow',\n          relPath,\n          linha: numeroLinha,\n          sugestao: 'Use ${{ secrets.SECRET_NAME }}'\n        }));\n      }\n\n      if (/\\bsudo\\s+/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-sudo-usage',\n          nivel: 'aviso',\n          mensagem: 'Uso de sudo detectado',\n          relPath,\n          linha: numeroLinha,\n          sugestao: 'Use container com user específico ao invés de sudo'\n        }));\n      }\n\n      if (/\\/home\\/runner\\//.test(linha) || /\\/tmp\\//.test(linha)) {\n        const isGitHubVar = /\\$\\{?\\{?\\s*(runner\\.temp|GITHUB_WORKSPACE|RUNNER_TEMP)/.test(linha);\n        const isComment = linha.trim().startsWith('#');\n        const isCleanupCommand = /rm\\s+-.+\\/tmp\\//.test(linha);\n        if (!isGitHubVar && !isComment && !isCleanupCommand) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'workflow-hardcoded-path',\n            nivel: 'info',\n            mensagem: 'Caminho absoluto ou temporário hardcoded',\n            relPath,\n            linha: numeroLinha,\n            sugestao: 'Use variáveis de ambiente como $GITHUB_WORKSPACE ou ${{ runner.temp }}'\n          }));\n        }\n      }\n\n      if (/echo\\s+.*::set-output\\s+name=.*secret/i.test(linha) || (/echo\\s+.*\\$(SECRET|TOKEN|KEY)/i.test(linha) && !/::add-mask::/i.test(src))) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-sensitive-output',\n          nivel: 'erro',\n          mensagem: 'Possível exposição de segredo no output do console',\n          relPath,\n          linha: numeroLinha,\n          sugestao: 'Use ::add-mask:: antes de imprimir ou evite imprimir segredos'\n        }));\n      }\n\n      if (/pull_request_target:/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-pr-target',\n          nivel: 'erro',\n          mensagem: 'pull_request_target pode executar código de fork',\n          relPath,\n          linha: numeroLinha,\n          sugestao: 'Use pull_request ao invés de pull_request_target'\n        }));\n      }\n\n      if (/workflow_run:/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-run-trigger',\n          nivel: 'aviso',\n          mensagem: 'workflow_run pode ser inseguro se usar checkout de fork',\n          relPath,\n          linha: numeroLinha,\n          sugestao: 'Use pull_request ou garanta que não há checkout de refs externas'\n        }));\n      }\n\n      if (/checkout@v\\d+/.test(linha) && /fetch-depth:\\s*0/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-fetch-depth-zero',\n          nivel: 'info',\n          mensagem: 'checkout com fetch-depth: 0 baixa todo histórico',\n          relPath,\n          linha: numeroLinha,\n          sugestao: 'Use fetch-depth: 1 se não precisar do histórico'\n        }));\n      }\n    });\n\n    if (actionsSemShaPinning.length > 0) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-missing-sha-pinning',\n        nivel: 'aviso',\n        mensagem: `${actionsSemShaPinning.length} action(s) de terceiros sem pinning por SHA: ${actionsSemShaPinning.map(a => a.action).join(', ')}`,\n        relPath,\n        linha: 1,\n        sugestao: 'Use @<commit-sha-completo> para garantir integridade da action'\n      }));\n    }\n\n    if (!/permissions:/.test(src)) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-missing-permissions',\n        nivel: 'info',\n        mensagem: 'Permissions não definidas - usa GITHUB_TOKEN default',\n        relPath,\n        linha: 1,\n        sugestao: 'Adicione permissions: com escopo mínimo necessário'\n      }));\n    }\n\n    const hasAuditStep = /\\b(npm audit|yarn audit|snyk|trivy|checkov|terrascan|gitleaks|semgrep)\\b/i.test(src);\n    const isBuildOrDeploy = /\\b(npm install|yarn|pnpm|build|deploy|publish|docker build|docker push)\\b/i.test(src);\n    const isSecurityWorkflow = /codeql|security-advanced|security-enhanced-code-scanning/i.test(src);\n\n    if (isBuildOrDeploy && !hasAuditStep && !isSecurityWorkflow) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-missing-security-scan',\n        nivel: 'aviso',\n        mensagem: 'Workflow de build/deploy sem auditoria de segurança',\n        relPath,\n        linha: 1,\n        sugestao: 'Adicione um passo de npm audit, snyk ou similar'\n      }));\n    }\n\n    return ocorrencias;\n  }\n};\n"]}

package/dist/analysts/github-actions/detectors/detector-workflow-structure.d.ts

@@ -0,0 +1,16 @@
+import type { Analista } from '../../../types/index.js';
+interface WorkflowJob {
+    name?: string;
+    needs?: string | string[];
+    container?: unknown;
+    steps?: Array<{
+        uses?: string;
+        run?: string;
+        with?: unknown;
+    }>;
+    'runs-on'?: string;
+}
+export declare function detectarJobsPassivos(job: WorkflowJob): boolean;
+export declare const detectorWorkflowEstrutura: Analista;
+export {};
+//# sourceMappingURL=detector-workflow-structure.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-structure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-workflow-structure.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-structure.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAyB9C,UAAU,WAAW;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AACD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAQ9D;AACD,eAAO,MAAM,yBAAyB,EAAE,QA8KvC,CAAC"}

package/dist/analysts/github-actions/detectors/detector-workflow-structure.js

@@ -0,0 +1,192 @@
+import { splitLines } from '../../../shared/helpers/index.js';
+import { parseDocument } from 'yaml';
+import { criarOcorrencia } from '../../../types/index.js';
+const SELF_HOSTED_MARKERS = ['self-hosted', 'my-runner', 'custom-runner'];
+const DEPRECATED_FEATURES = [{
+        pattern: /::set-output\s+name=/i,
+        tipo: 'deprecated-set-output',
+        mensagem: 'Uso de ::set-output:: depreciado',
+        sugestao: 'Use $GITHUB_OUTPUT para definir outputs de step'
+    }, {
+        pattern: /::add-mask::/i,
+        tipo: 'deprecated-add-mask',
+        mensagem: '::add-mask:: pode expor secrets em logs',
+        sugestao: 'Use actions/create-github-app-token ou secrets mascarados nativamente'
+    }, {
+        pattern: /::save-state\s+name=/i,
+        tipo: 'deprecated-save-state',
+        mensagem: '::save-state:: depreciado para comunicação entre jobs',
+        sugestao: 'Use artifacts ou cache para compartilhar dados entre jobs'
+    }];
+export function detectarJobsPassivos(job) {
+    if (!job?.steps || job.steps.length <= 1)
+        return false;
+    const meaningfulSteps = job.steps.filter(string => {
+        const uses = string.uses || '';
+        const run = string.run || '';
+        return !uses.startsWith('actions/checkout') && !uses.startsWith('actions/download-artifact') && !/echo\s+::(set-output|save-state|add-mask)/i.test(run);
+    });
+    return meaningfulSteps.length === 0;
+}
+export const detectorWorkflowEstrutura = {
+    nome: 'detector-workflow-estrutura',
+    categoria: 'workflows',
+    descricao: 'Detecta problemas estruturais em GitHub Actions',
+    test: (relPath) => /\.github\/workflows\/.*\.ya?ml$/i.test(relPath),
+    aplicar: (src, relPath) => {
+        if (!src)
+            return [];
+        const ocorrencias = [];
+        const linhas = splitLines(src);
+        try {
+            const doc = parseDocument(src);
+            const workflow = doc.toJS();
+            if (!workflow || typeof workflow !== 'object')
+                return ocorrencias;
+            const jobs = workflow.jobs || {};
+            const jobNames = Object.keys(jobs);
+            for (const [jobId, job] of Object.entries(jobs)) {
+                if (!job)
+                    continue;
+                if (job.needs) {
+                    const needsList = Array.isArray(job.needs) ? job.needs : [job.needs];
+                    for (const need of needsList) {
+                        if (typeof need === 'string' && !jobNames.includes(need)) {
+                            ocorrencias.push(criarOcorrencia({
+                                tipo: 'job-orfao',
+                                nivel: 'erro',
+                                mensagem: `Job '${jobId}' depende de '${need}' que não existe`,
+                                relPath,
+                                linha: 1,
+                                sugestao: `Verifique se o job '${need}' está definido no workflow ou remova a dependência`
+                            }));
+                        }
+                    }
+                }
+                const runsOn = job['runs-on'];
+                if (typeof runsOn === 'string') {
+                    if (SELF_HOSTED_MARKERS.some(metrica => runsOn.toLowerCase().includes(metrica)) && !job.name) {
+                        ocorrencias.push(criarOcorrencia({
+                            tipo: 'job-over-provisioning',
+                            nivel: 'info',
+                            mensagem: `Job '${jobId}' usa runner self-hosted sem label específico`,
+                            relPath,
+                            linha: 1,
+                            sugestao: 'Use labels específicos para self-hosted runners (ex: self-hosted-linux-gpu)'
+                        }));
+                    }
+                    if (runsOn === 'ubuntu-latest' && job.steps && job.steps.length <= 3 && job.steps.every(string => string.uses?.startsWith('actions/checkout') || string.uses?.startsWith('actions/setup-'))) {
+                        ocorrencias.push(criarOcorrencia({
+                            tipo: 'job-over-provisioning',
+                            nivel: 'info',
+                            mensagem: `Job '${jobId}' usa ubuntu-latest apenas para checkout/setup`,
+                            relPath,
+                            linha: 1,
+                            sugestao: 'Considere usar runs-on: ubuntu-22.04 ou ubuntu-20.04 se compatível'
+                        }));
+                    }
+                }
+                if (typeof job.container === 'object' && job.container !== null) {
+                    const image = job.container.image;
+                    if (image && (image.includes('large') || image.includes('xlarge'))) {
+                        ocorrencias.push(criarOcorrencia({
+                            tipo: 'job-over-provisioning',
+                            nivel: 'aviso',
+                            mensagem: `Job '${jobId}' usa container de grande porte (${image})`,
+                            relPath,
+                            linha: 1,
+                            sugestao: 'Verifique se realmente precisa de um container grande; considere usar o runner direto'
+                        }));
+                    }
+                }
+                const hasHeavyOps = job.steps?.some(string => {
+                    const run = string.run || '';
+                    const uses = string.uses || '';
+                    return /\b(docker\s+build|make|cmake|bazel)\b/.test(run) || /docker\/build-push-action/.test(uses);
+                });
+                if (hasHeavyOps && typeof runsOn === 'string' && /^(ubuntu-20\.04|ubuntu-18\.04)$/.test(runsOn)) {
+                    ocorrencias.push(criarOcorrencia({
+                        tipo: 'job-under-provisioning',
+                        nivel: 'aviso',
+                        mensagem: `Job '${jobId}' realiza operações pesadas em runner antigo (${runsOn})`,
+                        relPath,
+                        linha: 1,
+                        sugestao: 'Considere usar ubuntu-22.04, ubuntu-24.04 ou runner com mais recursos'
+                    }));
+                }
+            }
+            const seenNames = new Set();
+            for (const [, job] of Object.entries(jobs)) {
+                if (!job?.name)
+                    continue;
+                const displayName = job.name.toLowerCase().trim();
+                if (seenNames.has(displayName)) {
+                    ocorrencias.push(criarOcorrencia({
+                        tipo: 'workflow-duplicado',
+                        nivel: 'aviso',
+                        mensagem: `Nome de job duplicado detectado: "${job.name}"`,
+                        relPath,
+                        linha: 1,
+                        sugestao: 'Renomeie jobs para evitar confusão nos logs e na interface do GitHub Actions'
+                    }));
+                }
+                seenNames.add(displayName);
+            }
+            for (const dep of DEPRECATED_FEATURES) {
+                if (dep.pattern.test(src)) {
+                    ocorrencias.push(criarOcorrencia({
+                        tipo: dep.tipo,
+                        nivel: 'aviso',
+                        mensagem: dep.mensagem,
+                        relPath,
+                        linha: 1,
+                        sugestao: dep.sugestao
+                    }));
+                }
+            }
+            for (let indice = 0; indice < linhas.length; indice++) {
+                if (/continue-on-error:\s*true/i.test(linhas[indice])) {
+                    const hasIfCondition = /if:/.test(linhas[indice]) || indice > 0 && /if:/.test(linhas[indice - 1]);
+                    if (!hasIfCondition) {
+                        ocorrencias.push(criarOcorrencia({
+                            tipo: 'step-fragil',
+                            nivel: 'info',
+                            mensagem: 'Step com continue-on-error sem condição de fallback',
+                            relPath,
+                            linha: indice + 1,
+                            sugestao: 'Adicione uma condição "if:" para tornar o fallback mais explícito e controlado'
+                        }));
+                    }
+                }
+            }
+            for (const [jobId, job] of Object.entries(jobs)) {
+                if (detectarJobsPassivos(job)) {
+                    ocorrencias.push(criarOcorrencia({
+                        tipo: 'job-passivo',
+                        nivel: 'info',
+                        mensagem: `Job '${jobId}' não realiza operações significativas`,
+                        relPath,
+                        linha: 1,
+                        sugestao: 'Considere remover o job ou consolidá-lo com outro'
+                    }));
+                }
+            }
+        }
+        catch {
+            for (const dep of DEPRECATED_FEATURES) {
+                if (dep.pattern.test(src)) {
+                    ocorrencias.push(criarOcorrencia({
+                        tipo: dep.tipo,
+                        nivel: 'aviso',
+                        mensagem: dep.mensagem,
+                        relPath,
+                        linha: 1,
+                        sugestao: dep.sugestao
+                    }));
+                }
+            }
+        }
+        return ocorrencias;
+    }
+};
+//# sourceMappingURL=detector-workflow-structure.js.map

package/dist/analysts/github-actions/detectors/detector-workflow-structure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-workflow-structure.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-structure.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAGrC,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;AAC1E,MAAM,mBAAmB,GAKpB,CAAC;QACJ,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,kCAAkC;QAC5C,QAAQ,EAAE,iDAAiD;KAC5D,EAAE;QACD,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,yCAAyC;QACnD,QAAQ,EAAE,uEAAuE;KAClF,EAAE;QACD,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,uDAAuD;QACjE,QAAQ,EAAE,2DAA2D;KACtE,CAAC,CAAC;AAYH,MAAM,UAAU,oBAAoB,CAAC,GAAgB;IACnD,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,IAAI,CAAC,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1J,CAAC,CAAC,CAAC;IACH,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC;AACtC,CAAC;AACD,MAAM,CAAC,MAAM,yBAAyB,GAAa;IACjD,IAAI,EAAE,6BAA6B;IACnC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,iDAAiD;IAC5D,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,OAAO,WAAW,CAAC;YAClE,MAAM,IAAI,GAAiC,QAEzC,CAAC,IAAI,IAAI,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,GAAG;oBAAE,SAAS;gBAGnB,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;oBACd,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBACrE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;wBAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;4BACzD,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gCAC/B,IAAI,EAAE,WAAW;gCACjB,KAAK,EAAE,MAAM;gCACb,QAAQ,EAAE,QAAQ,KAAK,iBAAiB,IAAI,kBAAkB;gCAC9D,OAAO;gCACP,KAAK,EAAE,CAAC;gCACR,QAAQ,EAAE,uBAAuB,IAAI,qDAAqD;6BAC3F,CAAC,CAAC,CAAC;wBACN,CAAC;oBACH,CAAC;gBACH,CAAC;gBAGD,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;wBAC7F,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,uBAAuB;4BAC7B,KAAK,EAAE,MAAM;4BACb,QAAQ,EAAE,QAAQ,KAAK,+CAA+C;4BACtE,OAAO;4BACP,KAAK,EAAE,CAAC;4BACR,QAAQ,EAAE,6EAA6E;yBACxF,CAAC,CAAC,CAAC;oBACN,CAAC;oBACD,IAAI,MAAM,KAAK,eAAe,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;wBAC5L,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,uBAAuB;4BAC7B,KAAK,EAAE,MAAM;4BACb,QAAQ,EAAE,QAAQ,KAAK,gDAAgD;4BACvE,OAAO;4BACP,KAAK,EAAE,CAAC;4BACR,QAAQ,EAAE,oEAAoE;yBAC/E,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;gBAGD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;oBAChE,MAAM,KAAK,GAAI,GAAG,CAAC,SAAqC,CAAC,KAA2B,CAAC;oBACrF,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;wBACnE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,uBAAuB;4BAC7B,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,QAAQ,KAAK,oCAAoC,KAAK,GAAG;4BACnE,OAAO;4BACP,KAAK,EAAE,CAAC;4BACR,QAAQ,EAAE,uFAAuF;yBAClG,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;gBAGD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;oBAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBAC/B,OAAO,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrG,CAAC,CAAC,CAAC;gBACH,IAAI,WAAW,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,wBAAwB;wBAC9B,KAAK,EAAE,OAAO;wBACd,QAAQ,EAAE,QAAQ,KAAK,iDAAiD,MAAM,GAAG;wBACjF,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,uEAAuE;qBAClF,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAGD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;YACpC,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,GAAG,EAAE,IAAI;oBAAE,SAAS;gBACzB,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;gBAClD,IAAI,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,oBAAoB;wBAC1B,KAAK,EAAE,OAAO;wBACd,QAAQ,EAAE,qCAAqC,GAAG,CAAC,IAAI,GAAG;wBAC1D,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,8EAA8E;qBACzF,CAAC,CAAC,CAAC;gBACN,CAAC;gBACD,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC7B,CAAC;YAGD,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,KAAK,EAAE,OAAO;wBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;qBACvB,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAGD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;gBACtD,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBACtD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;oBAClG,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,aAAa;4BACnB,KAAK,EAAE,MAAM;4BACb,QAAQ,EAAE,qDAAqD;4BAC/D,OAAO;4BACP,KAAK,EAAE,MAAM,GAAG,CAAC;4BACjB,QAAQ,EAAE,gFAAgF;yBAC3F,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;YACH,CAAC;YAGD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,aAAa;wBACnB,KAAK,EAAE,MAAM;wBACb,QAAQ,EAAE,QAAQ,KAAK,wCAAwC;wBAC/D,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,mDAAmD;qBAC9D,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YAEP,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,KAAK,EAAE,OAAO;wBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;qBACvB,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector de Estrutura para GitHub Actions\n *\n * Detecta problemas estruturais em workflows:\n * - Jobs órfãos (needs referencia job inexistente)\n * - Over-provisioning (runs-on excessivo)\n * - Under-provisioning (runs-on insuficiente)\n * - Workflows duplicados (nomes de jobs duplicados)\n * - Features depreciadas do GitHub Actions\n * - Jobs passivos (sem operações significativas)\n * - Steps frágeis (continue-on-error sem condição)\n */\n\nimport { splitLines } from '@shared/helpers';\nimport { parseDocument } from 'yaml';\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nconst SELF_HOSTED_MARKERS = ['self-hosted', 'my-runner', 'custom-runner'];\nconst DEPRECATED_FEATURES: Array<{\n  pattern: RegExp;\n  tipo: string;\n  mensagem: string;\n  sugestao: string;\n}> = [{\n  pattern: /::set-output\\s+name=/i,\n  tipo: 'deprecated-set-output',\n  mensagem: 'Uso de ::set-output:: depreciado',\n  sugestao: 'Use $GITHUB_OUTPUT para definir outputs de step'\n}, {\n  pattern: /::add-mask::/i,\n  tipo: 'deprecated-add-mask',\n  mensagem: '::add-mask:: pode expor secrets em logs',\n  sugestao: 'Use actions/create-github-app-token ou secrets mascarados nativamente'\n}, {\n  pattern: /::save-state\\s+name=/i,\n  tipo: 'deprecated-save-state',\n  mensagem: '::save-state:: depreciado para comunicação entre jobs',\n  sugestao: 'Use artifacts ou cache para compartilhar dados entre jobs'\n}];\ninterface WorkflowJob {\n  name?: string;\n  needs?: string | string[];\n  container?: unknown;\n  steps?: Array<{\n    uses?: string;\n    run?: string;\n    with?: unknown;\n  }>;\n  'runs-on'?: string;\n}\nexport function detectarJobsPassivos(job: WorkflowJob): boolean {\n  if (!job?.steps || job.steps.length <= 1) return false;\n  const meaningfulSteps = job.steps.filter(string => {\n    const uses = string.uses || '';\n    const run = string.run || '';\n    return !uses.startsWith('actions/checkout') && !uses.startsWith('actions/download-artifact') && !/echo\\s+::(set-output|save-state|add-mask)/i.test(run);\n  });\n  return meaningfulSteps.length === 0;\n}\nexport const detectorWorkflowEstrutura: Analista = {\n  nome: 'detector-workflow-estrutura',\n  categoria: 'workflows',\n  descricao: 'Detecta problemas estruturais em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = splitLines(src);\n    try {\n      const doc = parseDocument(src);\n      const workflow = doc.toJS();\n      if (!workflow || typeof workflow !== 'object') return ocorrencias;\n      const jobs: Record<string, WorkflowJob> = (workflow as {\n        jobs?: Record<string, WorkflowJob>;\n      }).jobs || {};\n      const jobNames = Object.keys(jobs);\n      for (const [jobId, job] of Object.entries(jobs)) {\n        if (!job) continue;\n\n        // --- 1. Jobs órfãos (needs referencia job inexistente) ---\n        if (job.needs) {\n          const needsList = Array.isArray(job.needs) ? job.needs : [job.needs];\n          for (const need of needsList) {\n            if (typeof need === 'string' && !jobNames.includes(need)) {\n              ocorrencias.push(criarOcorrencia({\n                tipo: 'job-orfao',\n                nivel: 'erro',\n                mensagem: `Job '${jobId}' depende de '${need}' que não existe`,\n                relPath,\n                linha: 1,\n                sugestao: `Verifique se o job '${need}' está definido no workflow ou remova a dependência`\n              }));\n            }\n          }\n        }\n\n        // --- 2. Over-provisioning (runs-on excessivo) ---\n        const runsOn = job['runs-on'];\n        if (typeof runsOn === 'string') {\n          if (SELF_HOSTED_MARKERS.some(metrica => runsOn.toLowerCase().includes(metrica)) && !job.name) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'job-over-provisioning',\n              nivel: 'info',\n              mensagem: `Job '${jobId}' usa runner self-hosted sem label específico`,\n              relPath,\n              linha: 1,\n              sugestao: 'Use labels específicos para self-hosted runners (ex: self-hosted-linux-gpu)'\n            }));\n          }\n          if (runsOn === 'ubuntu-latest' && job.steps && job.steps.length <= 3 && job.steps.every(string => string.uses?.startsWith('actions/checkout') || string.uses?.startsWith('actions/setup-'))) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'job-over-provisioning',\n              nivel: 'info',\n              mensagem: `Job '${jobId}' usa ubuntu-latest apenas para checkout/setup`,\n              relPath,\n              linha: 1,\n              sugestao: 'Considere usar runs-on: ubuntu-22.04 ou ubuntu-20.04 se compatível'\n            }));\n          }\n        }\n\n        // Over-provisioning de container grande\n        if (typeof job.container === 'object' && job.container !== null) {\n          const image = (job.container as Record<string, unknown>).image as string | undefined;\n          if (image && (image.includes('large') || image.includes('xlarge'))) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'job-over-provisioning',\n              nivel: 'aviso',\n              mensagem: `Job '${jobId}' usa container de grande porte (${image})`,\n              relPath,\n              linha: 1,\n              sugestao: 'Verifique se realmente precisa de um container grande; considere usar o runner direto'\n            }));\n          }\n        }\n\n        // --- 3. Under-provisioning ---\n        const hasHeavyOps = job.steps?.some(string => {\n          const run = string.run || '';\n          const uses = string.uses || '';\n          return /\\b(docker\\s+build|make|cmake|bazel)\\b/.test(run) || /docker\\/build-push-action/.test(uses);\n        });\n        if (hasHeavyOps && typeof runsOn === 'string' && /^(ubuntu-20\\.04|ubuntu-18\\.04)$/.test(runsOn)) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'job-under-provisioning',\n            nivel: 'aviso',\n            mensagem: `Job '${jobId}' realiza operações pesadas em runner antigo (${runsOn})`,\n            relPath,\n            linha: 1,\n            sugestao: 'Considere usar ubuntu-22.04, ubuntu-24.04 ou runner com mais recursos'\n          }));\n        }\n      }\n\n      // --- 4. Workflows duplicados (nomes de jobs duplicados) ---\n      const seenNames = new Set<string>();\n      for (const [, job] of Object.entries(jobs)) {\n        if (!job?.name) continue;\n        const displayName = job.name.toLowerCase().trim();\n        if (seenNames.has(displayName)) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'workflow-duplicado',\n            nivel: 'aviso',\n            mensagem: `Nome de job duplicado detectado: \"${job.name}\"`,\n            relPath,\n            linha: 1,\n            sugestao: 'Renomeie jobs para evitar confusão nos logs e na interface do GitHub Actions'\n          }));\n        }\n        seenNames.add(displayName);\n      }\n\n      // --- 5. Features depreciadas do GitHub Actions ---\n      for (const dep of DEPRECATED_FEATURES) {\n        if (dep.pattern.test(src)) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: dep.tipo,\n            nivel: 'aviso',\n            mensagem: dep.mensagem,\n            relPath,\n            linha: 1,\n            sugestao: dep.sugestao\n          }));\n        }\n      }\n\n      // --- 6. Steps com continue-on-error sem if condition ---\n      for (let indice = 0; indice < linhas.length; indice++) {\n        if (/continue-on-error:\\s*true/i.test(linhas[indice])) {\n          const hasIfCondition = /if:/.test(linhas[indice]) || indice > 0 && /if:/.test(linhas[indice - 1]);\n          if (!hasIfCondition) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'step-fragil',\n              nivel: 'info',\n              mensagem: 'Step com continue-on-error sem condição de fallback',\n              relPath,\n              linha: indice + 1,\n              sugestao: 'Adicione uma condição \"if:\" para tornar o fallback mais explícito e controlado'\n            }));\n          }\n        }\n      }\n\n      // --- 7. Jobs passivos (sem operações significativas) ---\n      for (const [jobId, job] of Object.entries(jobs)) {\n        if (detectarJobsPassivos(job)) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'job-passivo',\n            nivel: 'info',\n            mensagem: `Job '${jobId}' não realiza operações significativas`,\n            relPath,\n            linha: 1,\n            sugestao: 'Considere remover o job ou consolidá-lo com outro'\n          }));\n        }\n      }\n    } catch {\n      // Fallback para análise por regex se o YAML parsing falhar\n      for (const dep of DEPRECATED_FEATURES) {\n        if (dep.pattern.test(src)) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: dep.tipo,\n            nivel: 'aviso',\n            mensagem: dep.mensagem,\n            relPath,\n            linha: 1,\n            sugestao: dep.sugestao\n          }));\n        }\n      }\n    }\n    return ocorrencias;\n  }\n};"]}

package/dist/analysts/github-actions/detectors/detector-workflow-trigger-unsafe.d.ts

@@ -0,0 +1,3 @@
+import type { Analista } from '../../../types/index.js';
+export declare const detectorWorkflowTriggerInseguro: Analista;
+//# sourceMappingURL=detector-workflow-trigger-unsafe.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-trigger-unsafe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-workflow-trigger-unsafe.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-trigger-unsafe.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAO9C,eAAO,MAAM,+BAA+B,EAAE,QAiM7C,CAAC"}