Versions in this module Expand all Collapse all v0 v0.1.3 Jul 28, 2026 v0.1.2 Jul 28, 2026 v0.1.1 Jul 22, 2026 Changes in this version + const RefKindAction + const RefKindReusableWorkflow type ActionRef + Kind string + Path string + func CollectReusableWorkflowRefs(file string, jobs []JobNodeWithID) []ActionRef + func CollectReusableWorkflowRefsFromBytes(name string, content []byte) []ActionRef type JobNode + Uses yaml.Node v0.1.0 Jul 12, 2026 Changes in this version + const FrameworkOWASP + const FrameworkSLSABuildL1 + const FrameworkSLSABuildL2 + const FrameworkSLSABuildL3 + const FrameworkSLSASourceL1 + const FrameworkSLSASourceL2 + const FrameworkSLSASourceL3 + const FrameworkSLSASourceL4 + const SettingsFile + func AssignFingerprints(findings []Finding) + func CollectInlineIgnores(content []byte) map[int]inlineDirective + func ConfigFileNames() []string + func FixBytes(content []byte, findings []Finding) ([]byte, int, error) + func FixFile(filePath string, findings []Finding) (int, error) + func FixFindings(targetPath string, findings []Finding) (int, error) + func IsGitLabCIPath(p string) bool + func RuleByID() map[RuleID]RuleSpec + type ActionRef struct + Column int + File string + Line int + Owner string + Raw string + Ref string + Repo string + VersionComment string + func CollectActionRefs(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []ActionRef + func CollectActionRefsFromBytes(name string, content []byte) []ActionRef + func CollectActionRefsFromDir(dirPath string) []ActionRef + type ActionsPermissions struct + AllowedActions string + Enabled bool + type Advisory struct + FirstPatched string + GHSAID string + Summary string + VulnerableRange string + type AttackStage struct + Description string + Order int + RuleID RuleID + Title string + type BranchProtection struct + AllowDeletions *EnabledFlag + AllowForcePushes *EnabledFlag + EnforceAdmins *EnabledFlag + RequiredPullRequestReviews *RequiredPullRequestReviews + RequiredSignatures *EnabledFlag + RequiredStatusChecks *RequiredStatusChecks + type ComboComponent struct + Finding Finding + RuleID RuleID + type ComboScope string + const ScopeFile + const ScopeRepo + type ComboSeverity string + const ComboCritical + const ComboHigh + type Confidence string + const ConfidenceHigh + const ConfidenceLow + const ConfidenceMedium + type Config struct + FailOnSeverity Severity + Path string + Ruleset string + type EnabledFlag struct + Enabled bool + type FeatureStatus struct + Status string + type Finding struct + Category string + Column int + Confidence Confidence + Description string + File string + Fingerprint string + Line int + Recommendation string + RuleID RuleID + Severity Severity + Title string + func ApplyRepoConfig(findings []Finding, cfg *RepoConfig) []Finding + func AuditActionPins(ctx context.Context, refs []ActionRef, auditor PinAuditor) []Finding + func CheckCachePoisoningRelease(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckCheckoutPersistCredentials(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckContinueOnErrorJob(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckDebugLoggingEnabled(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckDownloadWithoutChecksum(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckForbiddenUses(refs []ActionRef, policy *ForbiddenUses) []Finding + func CheckGitHubEnvInjection(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckHardcodedSecrets(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckLongLivedPAT(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckMissingConcurrency(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckMissingTimeout(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckObfuscatedExpression(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckOverprovisionedSecrets(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckPBAC(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckPPE(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckPPELaundered(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckPipeToShell(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckRepoDispatchUnfiltered(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckSLSACachePoisoning(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckSLSAOIDCTokenScope(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckSLSAPermsOverlyBroad(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckSLSAProvenance(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckSLSAProvenanceIsolated(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckSLSAVerifyStep(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckSecretInRunOutput(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckSecretsInheritPRTarget(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckSelfHostedRunners(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckSpoofableActorCondition(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckUnpinnedActions(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckUnpinnedImages(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckUnsoundCondition(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckUnsoundContains(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckUntrustedPullRequestTarget(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckUseTrustedPublishing(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func CheckWorkflowRunArtifactPoisoning(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding + func FilterByConfidence(findings []Finding, min Confidence) []Finding + func FilterByEnabledRules(findings []Finding, disabled map[RuleID]bool) []Finding + func FilterByPersona(findings []Finding, persona Persona) []Finding + func FilterFindings(findings []Finding, ruleset string) []Finding + func ScanBytes(name string, content []byte) ([]Finding, error) + func ScanDir(dirPath string) ([]Finding, error) + func ScanFile(filePath string) ([]Finding, error) + func ScanGitLabProjectSettings(ctx GitLabProjectContext) []Finding + func ScanRepositorySettings(ctx RepositoryContext) []Finding + func StampConfidence(findings []Finding) []Finding + type ForbiddenUses struct + Allow []string + Deny []string + type GitHubPinAuditor struct + Client *http.Client + Token string + func NewGitHubPinAuditor(token string) *GitHubPinAuditor + func (g *GitHubPinAuditor) Advisories(ctx context.Context, owner, repo string) ([]Advisory, error) + func (g *GitHubPinAuditor) RefKinds(ctx context.Context, owner, repo, ref string) (bool, bool, error) + func (g *GitHubPinAuditor) RepoArchived(ctx context.Context, owner, repo string) (bool, bool, error) + func (g *GitHubPinAuditor) ResolveRef(ctx context.Context, owner, repo, ref string) (string, bool, error) + func (g *GitHubPinAuditor) TagSHAs(ctx context.Context, owner, repo string) ([]string, error) + type GitLabProjectContext struct + ApprovalsBeforeMerge *int + BranchProtectionFetched bool + DefaultBranch string + DefaultBranchAllowsForcePush bool + DefaultBranchProtected bool + OnlyAllowMergeIfPipelineSucceeds *bool + ProjectPath string + PublicBuilds *bool + WebURL string + type IgnoreEntry struct + File string + Lines []int + type JobNode struct + Concurrency yaml.Node + Env yaml.Node + If yaml.Node + Name yaml.Node + Permissions yaml.Node + RunsOn yaml.Node + Steps yaml.Node + TimeoutMinutes yaml.Node + type JobNodeWithID struct + Column int + ID string + Line int + Node JobNode + type Persona string + const PersonaAuditor + const PersonaPedantic + const PersonaRegular + type PinAuditor interface + Advisories func(ctx context.Context, owner, repo string) ([]Advisory, error) + RefKinds func(ctx context.Context, owner, repo, ref string) (isBranch, isTag bool, err error) + RepoArchived func(ctx context.Context, owner, repo string) (archived bool, ok bool, err error) + ResolveRef func(ctx context.Context, owner, repo, ref string) (sha string, found bool, err error) + TagSHAs func(ctx context.Context, owner, repo string) ([]string, error) + type Platform string + const PlatformAny + const PlatformGitHub + const PlatformGitLab + type RepoConfig struct + ForbiddenUses *ForbiddenUses + MinConfidence string + Persona string + Rules map[string]RuleOverride + Ruleset string + func LoadRepoConfig(dir string) (*RepoConfig, string, error) + func ParseRepoConfig(data []byte) (*RepoConfig, error) + func (c *RepoConfig) DisabledRuleIDs() map[RuleID]bool + type RepoInfo struct + DefaultBranch string + Private bool + SecurityAndAnalysis *SecurityAndAnalysis + Visibility string + type RepositoryContext struct + ActionsPolicy *ActionsPermissions + BranchProtection *BranchProtection + BranchProtectionUnavailable bool + DefaultBranch string + DependabotAlerts bool + HTMLURL string + HasCodeowners bool + Owner string + Repo string + Repository *RepoInfo + WorkflowPerms *WorkflowPermissions + type RequiredPullRequestReviews struct + DismissStaleReviews bool + RequireCodeOwnerReviews bool + RequiredApprovingReviewCount int + type RequiredStatusChecks struct + Strict bool + type RuleID string + const RuleActionsAllAllowed + const RuleArchivedAction + const RuleBPAdminBypass + const RuleBPDeletion + const RuleBPFewReviewers + const RuleBPForcePush + const RuleBPMissing + const RuleBPNoCodeownersReview + const RuleBPNoReview + const RuleBPNoSignedCommits + const RuleBPNoStatusChecks + const RuleBPStaleReviews + const RuleCachePoisonRelease + const RuleCheckoutPersistCreds + const RuleContinueOnErrorJob + const RuleDebugLoggingEnabled + const RuleDependabotAlertsOff + const RuleDependabotFixesOff + const RuleDownloadNoChecksum + const RuleForbiddenUses + const RuleGitHubEnvInjection + const RuleGitLabAllowFailure + const RuleGitLabBPForcePush + const RuleGitLabBPMissing + const RuleGitLabDebugTrace + const RuleGitLabHardcodedSecrets + const RuleGitLabMRTarget + const RuleGitLabMergeNoPipeline + const RuleGitLabMissingResGroup + const RuleGitLabMissingTimeout + const RuleGitLabNoApprovals + const RuleGitLabPATSecret + const RuleGitLabPublicPipelines + const RuleGitLabSelfHostedTags + const RuleGitLabShellInjection + const RuleGitLabTriggerUnfiltered + const RuleGitLabUnpinnedInclude + const RuleHardcodedSecrets + const RuleImpostorCommit + const RuleKnownVulnerableAction + const RuleLongLivedPAT + const RuleMissingConcurrency + const RuleMissingPermissions + const RuleMissingTimeout + const RuleObfuscatedExpr + const RuleOverprovSecrets + const RulePPECheckout + const RulePPEShellInjection + const RulePipeToShell + const RuleRefConfusion + const RuleRefVersionMismatch + const RuleRepoDispatchUnfilt + const RuleSLSACachePoisoning + const RuleSLSAOIDCTokenScope + const RuleSLSAPermsOverlyBroad + const RuleSLSAProvenance + const RuleSLSAProvenanceIsolated + const RuleSLSAVerifyStep + const RuleSecretInRunOutput + const RuleSecretPushProtectionOff + const RuleSecretScanningOff + const RuleSecretsInheritPRTarget + const RuleSelfHostedRunners + const RuleSpoofableActorCondition + const RuleStaleActionRef + const RuleTyposquatAction + const RuleUnpinnedAction + const RuleUnpinnedImage + const RuleUnsoundCondition + const RuleUnsoundContains + const RuleUseTrustedPublish + const RuleWPermPRApprove + const RuleWPermWrite + const RuleWorkflowRunArtifactPoisoning + type RuleOverride struct + Enabled *bool + Ignore []IgnoreEntry + Severity string + type RuleSpec struct + Category string + DefaultConfidence Confidence + DefaultSeverity Severity + Description string + DocURL string + Frameworks []string + ID RuleID + Persona Persona + Platform Platform + Surface RuleSurface + Title string + func Rules() []RuleSpec + type RuleSurface string + const SurfaceRepoSettings + const SurfaceWorkflow + type SecurityAndAnalysis struct + DependabotSecurityUpdates *FeatureStatus + SecretScanning *FeatureStatus + SecretScanningPushProtection *FeatureStatus + type Severity string + const SeverityHigh + const SeverityInfo + const SeverityLow + const SeverityMedium + type StepNode struct + Env yaml.Node + If yaml.Node + Name yaml.Node + Run yaml.Node + Uses yaml.Node + With yaml.Node + type ToxicCombo struct + BreakChain string + BreakChainRule RuleID + Components []ComboComponent + File string + ID string + Impact string + Scope ComboScope + Severity ComboSeverity + Stages []AttackStage + Title string + func DetectToxicCombinations(findings []Finding) []ToxicCombo + type WorkflowNode struct + Concurrency yaml.Node + Env yaml.Node + Jobs yaml.Node + Name yaml.Node + On yaml.Node + Permissions yaml.Node + type WorkflowPermissions struct + CanApprovePullRequestReviews bool + DefaultWorkflowPermissions string
Go to main page