Documentation
¶
Overview ¶
Package lint provides an extensible, in-process linter for Actions/AW ASTs. Rules inspect read-only ASTs and report structured, value-free diagnostics.
Index ¶
- type ASTTargets
- type Diagnostic
- type Input
- type RelatedLocation
- type Rule
- func ActionPinRule() Rule
- func AllowedLabelsRule() Rule
- func ArtipackedRule() Rule
- func CachePoisoningRule() Rule
- func CheckoutModeRule() Rule
- func ConditionalImportRule() Rule
- func CustomJobDetectionRule() Rule
- func ExcessivePermissionsRule() Rule
- func FirewallSSLBumpRule() Rule
- func ForkAssociationRule() Rule
- func GatewayDispatchLiteralsRule() Rule
- func GraderFileIORule() Rule
- func GraderShellFileWriteRule() Rule
- func ImageArgumentRule() Rule
- func InstallScriptsRule() Rule
- func JobTimeoutRule() Rule
- func NeedsConsistencyRule() Rule
- func NetworkScopeRule() Rule
- func ObfuscationRule() Rule
- func PermissionScopeRule() Rule
- func PrivateToPublicRule() Rule
- func PromptExpressionRule() Rule
- func PullRequestTargetCheckoutRule() Rule
- func PullRequestTargetRolesRule() Rule
- func PushTargetRule() Rule
- func SafeOutputShellExpansionRule() Rule
- func SandboxConfigRule() Rule
- func SecretLeakRule() Rule
- func TemplateInjectionRule() Rule
- func ToolScopeRule() Rule
- func VersionCheckRule() Rule
- func WorkflowRunScopeRule() Rule
- type Runner
- type Severity
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ASTTargets ¶
type ASTTargets uint8
const ( ActionsAST ASTTargets = 1 << iota AWAST )
func (ASTTargets) String ¶
func (targets ASTTargets) String() string
type Diagnostic ¶
type Diagnostic struct {
RuleID string `json:"rule_id"`
ThreatRuleID string `json:"threat_rule_id,omitempty"`
Severity Severity `json:"severity"`
Path string `json:"path"`
Line int `json:"script_line,omitempty"`
Message string `json:"message"`
Related []RelatedLocation `json:"related,omitempty"`
}
func CheckGatewayDispatchLiterals ¶
func CheckGatewayDispatchLiterals(raw any) []Diagnostic
CheckGatewayDispatchLiterals also enforces the rule during compilation, before raw gateway declarations are normalized or lowered.
type Input ¶
type Input struct {
Workflow *actions.Workflow
// SourcePath identifies the declaring AW source, including imported fragments
// and companion Markdown when Workflow is a compiled Actions AST.
SourcePath string
// Document optionally supplies authored AW fields, including the prompt.
// Either AST may be supplied independently. Workflow is never a projection
// of AW frontmatter; when both are supplied it is the compiled graph.
Document *aw.Document
JavaScript *taint.JavaScriptOptions
}
type RelatedLocation ¶
type Rule ¶
type Rule struct {
ID string
// ThreatRuleID optionally identifies the corresponding compiler threat
// specification rule; a mapping does not imply full rule conformance.
ThreatRuleID string
Description string
Severity Severity
// Zero preserves the Actions-only contract of existing extension rules.
Targets ASTTargets
Check func(context.Context, Input) ([]Diagnostic, error)
}
Rule is independent of the taint engine: future structural and semantic checkers can share the registry, selection, diagnostics, and CLI integration. Check must not mutate Input or include sensitive values in diagnostics.
func ActionPinRule ¶
func ActionPinRule() Rule
ActionPinRule checks reference integrity, not action provenance or existence. AW documents establish the authored strict policy; native Actions has no strict setting, so mutable references default to warnings. Malformed references are errors for either AST regardless of strict policy.
func AllowedLabelsRule ¶
func AllowedLabelsRule() Rule
func ArtipackedRule ¶
func ArtipackedRule() Rule
ArtipackedRule checks credential persistence, not artifact contents or whether a later git operation legitimately needs the checkout credential.
func CachePoisoningRule ¶
func CachePoisoningRule() Rule
CachePoisoningRule checks release/tag workflow cache restoration. It does not infer publication from job names or prove the provenance of cached files.
func CheckoutModeRule ¶
func CheckoutModeRule() Rule
func ConditionalImportRule ¶
func ConditionalImportRule() Rule
ConditionalImportRule inspects only authored imports. It neither loads imported files nor treats runtime prompt conditionals as compile-time imports.
func CustomJobDetectionRule ¶
func CustomJobDetectionRule() Rule
func ExcessivePermissionsRule ¶
func ExcessivePermissionsRule() Rule
ExcessivePermissionsRule applies only to Actions: AW root permissions scope the agent job, not every job in the compiled workflow.
func FirewallSSLBumpRule ¶
func FirewallSSLBumpRule() Rule
func ForkAssociationRule ¶
func ForkAssociationRule() Rule
func GatewayDispatchLiteralsRule ¶
func GatewayDispatchLiteralsRule() Rule
func GraderFileIORule ¶
func GraderFileIORule() Rule
func GraderShellFileWriteRule ¶
func GraderShellFileWriteRule() Rule
func ImageArgumentRule ¶
func ImageArgumentRule() Rule
func InstallScriptsRule ¶
func InstallScriptsRule() Rule
func JobTimeoutRule ¶
func JobTimeoutRule() Rule
JobTimeoutRule checks explicit timeouts only. An absent native Actions timeout retains Actions' default and is not a generated-timeout violation.
func NeedsConsistencyRule ¶
func NeedsConsistencyRule() Rule
func NetworkScopeRule ¶
func NetworkScopeRule() Rule
NetworkScopeRule checks explicit wildcard allowances, not the effective firewall, inferred defaults, runtime additions, or MCP sandbox prerequisites.
func ObfuscationRule ¶
func ObfuscationRule() Rule
func PermissionScopeRule ¶
func PermissionScopeRule() Rule
PermissionScopeRule checks explicit declarations, not whether individual repository writes are authorized for an agent or a safe-output publisher.
func PrivateToPublicRule ¶
func PrivateToPublicRule() Rule
func PromptExpressionRule ¶
func PromptExpressionRule() Rule
PromptExpressionRule checks independently observable forbidden forms, not the compiler's complete context allowlist or imported prompt content.
func PullRequestTargetCheckoutRule ¶
func PullRequestTargetCheckoutRule() Rule
func PullRequestTargetRolesRule ¶
func PullRequestTargetRolesRule() Rule
func PushTargetRule ¶
func PushTargetRule() Rule
func SafeOutputShellExpansionRule ¶
func SafeOutputShellExpansionRule() Rule
func SandboxConfigRule ¶
func SandboxConfigRule() Rule
func SecretLeakRule ¶
func SecretLeakRule() Rule
func TemplateInjectionRule ¶
func TemplateInjectionRule() Rule
TemplateInjectionRule checks the direct executable-interpolation trigger of CTR-006, not whole-rule conformance or arbitrary shell-code data flow.
func ToolScopeRule ¶
func ToolScopeRule() Rule
func VersionCheckRule ¶
func VersionCheckRule() Rule
VersionCheckRule inspects authored policy, not the presence of a generated update step or CLI/repository strict-mode overrides.
func WorkflowRunScopeRule ¶
func WorkflowRunScopeRule() Rule
WorkflowRunScopeRule checks the observable trigger-selection portion of CTR-021, not workflow provenance or runtime authorization. Paths address the Actions AST; Diagnostic.Line remains reserved for script-relative locations.
AW sources default to strict unless strict is explicitly false, matching the compiler's source policy. Plain Actions input has no AW strict setting and receives warnings for branch scope. CLI/repository strict overrides are not represented by Input and must be enforced by the caller.
Branch-list checks strengthen the compiler's current branches-key presence check. They require positive scope rather than an exclusion-only policy; they do not prove the full glob language or which upstream branches are trusted.
Source Files
¶
- action_inputs.go
- artipacked.go
- authored_execution.go
- cache_poisoning.go
- checkout_policy.go
- custom_job_detection.go
- firewall_ssl_bump.go
- fork_policy.go
- gateway_dispatch.go
- grader_file_io.go
- grader_file_io_ast.go
- grader_file_io_scope.go
- grader_shell_file_write.go
- image_policy.go
- integrity.go
- lint.go
- needs_consistency.go
- needs_expression.go
- obfuscation.go
- output_policy.go
- performance.go
- permission_scope.go
- prompt_expression.go
- pull_request_target_checkout.go
- pull_request_target_roles.go
- runtime_policy.go
- safe_output_shell_expansion.go
- sandbox_policy.go
- secrets.go
- source_policy.go
- template_injection.go
- tool_policy.go
- workflow_run_scope.go