scanner

package

Go to main page

Versions in this module

v0

v0.1.15

Sep 8, 2026

v0.1.14

Aug 30, 2026

Changes in this version

type Finding

+ func CheckYAMLHardening(file string, content []byte) []Finding

type RuleID

+ const RuleYAMLHardening

v0.1.13

Aug 30, 2026

Changes in this version

type Finding

+ func CheckArtifactExposure(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

type RuleID

+ const RuleArtifactExposure

v0.1.12

Aug 30, 2026

Changes in this version

type Finding

+ func CheckSelfHostedEgress(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

type RuleID

+ const RuleSelfHostedEgress

v0.1.11

Aug 30, 2026

Changes in this version

type Finding

+ func CheckShellHardening(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

type RuleID

+ const RuleShellHardening

type StepNode

+ Shell yaml.Node

v0.1.10

Aug 30, 2026

Changes in this version

type Finding

+ func CheckPRTargetDualTrigger(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

type RuleID

+ const RulePRTargetDualTrigger

v0.1.9

Aug 30, 2026

Changes in this version

type Finding

+ func CheckEnvExfiltration(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

type RuleID

+ const RuleEnvExfil

v0.1.8

Aug 30, 2026

Changes in this version

type Finding

+ func CheckCloudCredentials(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

type RuleID

+ const RuleCloudStaticCredentials

v0.1.7

Aug 16, 2026

Changes in this version

+ func OIDCAdopted(auths []OIDCAuth) bool

+ func OIDCRetirableSecrets(auths []OIDCAuth) []string

+ type CloudProvider string

+ const CloudAWS

+ const CloudAzure

+ const CloudGCP

+ const CloudGeneric

+ const CloudVault

+ type OIDCAuth struct

+ Action string

+ Federated bool

+ File string

+ Job string

+ Line int

+ Provider CloudProvider

+ Secrets []string

+ TokenGranted bool

+ func OIDCUsage(file string, content []byte) []OIDCAuth

v0.1.6

Aug 16, 2026

Changes in this version

+ func ReadsEverySecret(refs []SecretRef) bool

+ func SecretNamesRead(refs []SecretRef) []string

+ type SecretRef struct

+ File string

+ Job string

+ Kind SecretRefKind

+ Line int

+ Name string

+ Target string

+ func SecretReferences(file string, content []byte) []SecretRef

+ type SecretRefKind string

+ const SecretRefAll

+ const SecretRefInherit

+ const SecretRefNamed

v0.1.5

Aug 15, 2026

v0.1.4

Aug 15, 2026

Changes in this version

+ func ComboCanFire(spec ComboSpec, disabled map[RuleID]bool) bool

+ type ComboSpec struct

+ BreakChain string

+ BreakChainRule RuleID

+ ID string

+ Impact string

+ Optional []RuleID

+ Platform Platform

+ Requirements [][]RuleID

+ Scope ComboScope

+ Severity ComboSeverity

+ Title string

+ func ComboByID(id string) (ComboSpec, bool)

+ func ComboCatalog() []ComboSpec

type RuleID

+ func ComboRules(spec ComboSpec) []RuleID

v0.1.3

Jul 28, 2026

v0.1.2

Jul 28, 2026

v0.1.1

Jul 22, 2026

Changes in this version

+ const RefKindAction

+ const RefKindReusableWorkflow

type ActionRef

+ Kind string

+ Path string

+ func CollectReusableWorkflowRefs(file string, jobs []JobNodeWithID) []ActionRef

+ func CollectReusableWorkflowRefsFromBytes(name string, content []byte) []ActionRef

type JobNode

+ Uses yaml.Node

v0.1.0

Jul 12, 2026

Changes in this version

+ const FrameworkOWASP

+ const FrameworkSLSABuildL1

+ const FrameworkSLSABuildL2

+ const FrameworkSLSABuildL3

+ const FrameworkSLSASourceL1

+ const FrameworkSLSASourceL2

+ const FrameworkSLSASourceL3

+ const FrameworkSLSASourceL4

+ const SettingsFile

+ func AssignFingerprints(findings []Finding)

+ func CollectInlineIgnores(content []byte) map[int]inlineDirective

+ func ConfigFileNames() []string

+ func FixBytes(content []byte, findings []Finding) ([]byte, int, error)

+ func FixFile(filePath string, findings []Finding) (int, error)

+ func FixFindings(targetPath string, findings []Finding) (int, error)

+ func IsGitLabCIPath(p string) bool

+ func RuleByID() map[RuleID]RuleSpec

+ type ActionRef struct

+ Column int

+ File string

+ Line int

+ Owner string

+ Raw string

+ Ref string

+ Repo string

+ VersionComment string

+ func CollectActionRefs(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []ActionRef

+ func CollectActionRefsFromBytes(name string, content []byte) []ActionRef

+ func CollectActionRefsFromDir(dirPath string) []ActionRef

+ type ActionsPermissions struct

+ AllowedActions string

+ Enabled bool

+ type Advisory struct

+ FirstPatched string

+ GHSAID string

+ Summary string

+ VulnerableRange string

+ type AttackStage struct

+ Description string

+ Order int

+ RuleID RuleID

+ Title string

+ type BranchProtection struct

+ AllowDeletions *EnabledFlag

+ AllowForcePushes *EnabledFlag

+ EnforceAdmins *EnabledFlag

+ RequiredPullRequestReviews *RequiredPullRequestReviews

+ RequiredSignatures *EnabledFlag

+ RequiredStatusChecks *RequiredStatusChecks

+ type ComboComponent struct

+ Finding Finding

+ RuleID RuleID

+ type ComboScope string

+ const ScopeFile

+ const ScopeRepo

+ type ComboSeverity string

+ const ComboCritical

+ const ComboHigh

+ type Confidence string

+ const ConfidenceHigh

+ const ConfidenceLow

+ const ConfidenceMedium

+ type Config struct

+ FailOnSeverity Severity

+ Path string

+ Ruleset string

+ type EnabledFlag struct

+ Enabled bool

+ type FeatureStatus struct

+ Status string

+ type Finding struct

+ Category string

+ Column int

+ Confidence Confidence

+ Description string

+ File string

+ Fingerprint string

+ Line int

+ Recommendation string

+ RuleID RuleID

+ Severity Severity

+ Title string

+ func ApplyRepoConfig(findings []Finding, cfg *RepoConfig) []Finding

+ func AuditActionPins(ctx context.Context, refs []ActionRef, auditor PinAuditor) []Finding

+ func CheckCachePoisoningRelease(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckCheckoutPersistCredentials(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckContinueOnErrorJob(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckDebugLoggingEnabled(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckDownloadWithoutChecksum(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckForbiddenUses(refs []ActionRef, policy *ForbiddenUses) []Finding

+ func CheckGitHubEnvInjection(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckHardcodedSecrets(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckLongLivedPAT(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckMissingConcurrency(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckMissingTimeout(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckObfuscatedExpression(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckOverprovisionedSecrets(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckPBAC(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckPPE(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckPPELaundered(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckPipeToShell(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckRepoDispatchUnfiltered(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckSLSACachePoisoning(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckSLSAOIDCTokenScope(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckSLSAPermsOverlyBroad(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckSLSAProvenance(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckSLSAProvenanceIsolated(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckSLSAVerifyStep(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckSecretInRunOutput(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckSecretsInheritPRTarget(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckSelfHostedRunners(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckSpoofableActorCondition(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckUnpinnedActions(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckUnpinnedImages(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckUnsoundCondition(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckUnsoundContains(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckUntrustedPullRequestTarget(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckUseTrustedPublishing(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func CheckWorkflowRunArtifactPoisoning(file string, workflow *WorkflowNode, jobs []JobNodeWithID) []Finding

+ func FilterByConfidence(findings []Finding, min Confidence) []Finding

+ func FilterByEnabledRules(findings []Finding, disabled map[RuleID]bool) []Finding

+ func FilterByPersona(findings []Finding, persona Persona) []Finding

+ func FilterFindings(findings []Finding, ruleset string) []Finding

+ func ScanBytes(name string, content []byte) ([]Finding, error)

+ func ScanDir(dirPath string) ([]Finding, error)

+ func ScanFile(filePath string) ([]Finding, error)

+ func ScanGitLabProjectSettings(ctx GitLabProjectContext) []Finding

+ func ScanRepositorySettings(ctx RepositoryContext) []Finding

+ func StampConfidence(findings []Finding) []Finding

+ type ForbiddenUses struct

+ Allow []string

+ Deny []string

+ type GitHubPinAuditor struct

+ Client *http.Client

+ Token string

+ func NewGitHubPinAuditor(token string) *GitHubPinAuditor

+ func (g *GitHubPinAuditor) Advisories(ctx context.Context, owner, repo string) ([]Advisory, error)

+ func (g *GitHubPinAuditor) RefKinds(ctx context.Context, owner, repo, ref string) (bool, bool, error)

+ func (g *GitHubPinAuditor) RepoArchived(ctx context.Context, owner, repo string) (bool, bool, error)

+ func (g *GitHubPinAuditor) ResolveRef(ctx context.Context, owner, repo, ref string) (string, bool, error)

+ func (g *GitHubPinAuditor) TagSHAs(ctx context.Context, owner, repo string) ([]string, error)

+ type GitLabProjectContext struct

+ ApprovalsBeforeMerge *int

+ BranchProtectionFetched bool

+ DefaultBranch string

+ DefaultBranchAllowsForcePush bool

+ DefaultBranchProtected bool

+ OnlyAllowMergeIfPipelineSucceeds *bool

+ ProjectPath string

+ PublicBuilds *bool

+ WebURL string

+ type IgnoreEntry struct

+ File string

+ Lines []int

+ type JobNode struct

+ Concurrency yaml.Node

+ Env yaml.Node

+ If yaml.Node

+ Name yaml.Node

+ Permissions yaml.Node

+ RunsOn yaml.Node

+ Steps yaml.Node

+ TimeoutMinutes yaml.Node

+ type JobNodeWithID struct

+ Column int

+ ID string

+ Line int

+ Node JobNode

+ type Persona string

+ const PersonaAuditor

+ const PersonaPedantic

+ const PersonaRegular

+ type PinAuditor interface

+ Advisories func(ctx context.Context, owner, repo string) ([]Advisory, error)

+ RefKinds func(ctx context.Context, owner, repo, ref string) (isBranch, isTag bool, err error)

+ RepoArchived func(ctx context.Context, owner, repo string) (archived bool, ok bool, err error)

+ ResolveRef func(ctx context.Context, owner, repo, ref string) (sha string, found bool, err error)

+ TagSHAs func(ctx context.Context, owner, repo string) ([]string, error)

+ type Platform string

+ const PlatformAny

+ const PlatformGitHub

+ const PlatformGitLab

+ type RepoConfig struct

+ ForbiddenUses *ForbiddenUses

+ MinConfidence string

+ Persona string

+ Rules map[string]RuleOverride

+ Ruleset string

+ func LoadRepoConfig(dir string) (*RepoConfig, string, error)

+ func ParseRepoConfig(data []byte) (*RepoConfig, error)

+ func (c *RepoConfig) DisabledRuleIDs() map[RuleID]bool

+ type RepoInfo struct

+ DefaultBranch string

+ Private bool

+ SecurityAndAnalysis *SecurityAndAnalysis

+ Visibility string

+ type RepositoryContext struct

+ ActionsPolicy *ActionsPermissions

+ BranchProtection *BranchProtection

+ BranchProtectionUnavailable bool

+ DefaultBranch string

+ DependabotAlerts bool

+ HTMLURL string

+ HasCodeowners bool

+ Owner string

+ Repo string

+ Repository *RepoInfo

+ WorkflowPerms *WorkflowPermissions

+ type RequiredPullRequestReviews struct

+ DismissStaleReviews bool

+ RequireCodeOwnerReviews bool

+ RequiredApprovingReviewCount int

+ type RequiredStatusChecks struct

+ Strict bool

+ type RuleID string

+ const RuleActionsAllAllowed

+ const RuleArchivedAction

+ const RuleBPAdminBypass

+ const RuleBPDeletion

+ const RuleBPFewReviewers

+ const RuleBPForcePush

+ const RuleBPMissing

+ const RuleBPNoCodeownersReview

+ const RuleBPNoReview

+ const RuleBPNoSignedCommits

+ const RuleBPNoStatusChecks

+ const RuleBPStaleReviews

+ const RuleCachePoisonRelease

+ const RuleCheckoutPersistCreds

+ const RuleContinueOnErrorJob

+ const RuleDebugLoggingEnabled

+ const RuleDependabotAlertsOff

+ const RuleDependabotFixesOff

+ const RuleDownloadNoChecksum

+ const RuleForbiddenUses

+ const RuleGitHubEnvInjection

+ const RuleGitLabAllowFailure

+ const RuleGitLabBPForcePush

+ const RuleGitLabBPMissing

+ const RuleGitLabDebugTrace

+ const RuleGitLabHardcodedSecrets

+ const RuleGitLabMRTarget

+ const RuleGitLabMergeNoPipeline

+ const RuleGitLabMissingResGroup

+ const RuleGitLabMissingTimeout

+ const RuleGitLabNoApprovals

+ const RuleGitLabPATSecret

+ const RuleGitLabPublicPipelines

+ const RuleGitLabSelfHostedTags

+ const RuleGitLabShellInjection

+ const RuleGitLabTriggerUnfiltered

+ const RuleGitLabUnpinnedInclude

+ const RuleHardcodedSecrets

+ const RuleImpostorCommit

+ const RuleKnownVulnerableAction

+ const RuleLongLivedPAT

+ const RuleMissingConcurrency

+ const RuleMissingPermissions

+ const RuleMissingTimeout

+ const RuleObfuscatedExpr

+ const RuleOverprovSecrets

+ const RulePPECheckout

+ const RulePPEShellInjection

+ const RulePipeToShell

+ const RuleRefConfusion

+ const RuleRefVersionMismatch

+ const RuleRepoDispatchUnfilt

+ const RuleSLSACachePoisoning

+ const RuleSLSAOIDCTokenScope

+ const RuleSLSAPermsOverlyBroad

+ const RuleSLSAProvenance

+ const RuleSLSAProvenanceIsolated

+ const RuleSLSAVerifyStep

+ const RuleSecretInRunOutput

+ const RuleSecretPushProtectionOff

+ const RuleSecretScanningOff

+ const RuleSecretsInheritPRTarget

+ const RuleSelfHostedRunners

+ const RuleSpoofableActorCondition

+ const RuleStaleActionRef

+ const RuleTyposquatAction

+ const RuleUnpinnedAction

+ const RuleUnpinnedImage

+ const RuleUnsoundCondition

+ const RuleUnsoundContains

+ const RuleUseTrustedPublish

+ const RuleWPermPRApprove

+ const RuleWPermWrite

+ const RuleWorkflowRunArtifactPoisoning

+ type RuleOverride struct

+ Enabled *bool

+ Ignore []IgnoreEntry

+ Severity string

+ type RuleSpec struct

+ Category string

+ DefaultConfidence Confidence

+ DefaultSeverity Severity

+ Description string

+ DocURL string

+ Frameworks []string

+ ID RuleID

+ Persona Persona

+ Platform Platform

+ Surface RuleSurface

+ Title string

+ func Rules() []RuleSpec

+ type RuleSurface string

+ const SurfaceRepoSettings

+ const SurfaceWorkflow

+ type SecurityAndAnalysis struct

+ DependabotSecurityUpdates *FeatureStatus

+ SecretScanning *FeatureStatus

+ SecretScanningPushProtection *FeatureStatus

+ type Severity string

+ const SeverityHigh

+ const SeverityInfo

+ const SeverityLow

+ const SeverityMedium

+ type StepNode struct

+ Env yaml.Node

+ If yaml.Node

+ Name yaml.Node

+ Run yaml.Node

+ Uses yaml.Node

+ With yaml.Node

+ type ToxicCombo struct

+ BreakChain string

+ BreakChainRule RuleID

+ Components []ComboComponent

+ File string

+ ID string

+ Impact string

+ Scope ComboScope

+ Severity ComboSeverity

+ Stages []AttackStage

+ Title string

+ func DetectToxicCombinations(findings []Finding) []ToxicCombo

+ type WorkflowNode struct

+ Concurrency yaml.Node

+ Env yaml.Node

+ Jobs yaml.Node

+ Name yaml.Node

+ On yaml.Node

+ Permissions yaml.Node

+ type WorkflowPermissions struct

+ CanApprovePullRequestReviews bool

+ DefaultWorkflowPermissions string

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL