Documentation
¶
Overview ¶
Package expr parses the GitHub Actions expression language (${{ ... }}) and extracts the context references it contains: secrets.X, vars.X, env.X, matrix.X, needs.X.outputs.Y and friends.
Two rules govern this package, and they come straight from the product principles: detection is purely deterministic, and anything that cannot be resolved statically is reported as unresolved rather than guessed. A caller must never turn an unresolved reference into a finding.
Index ¶
Constants ¶
const ( CtxSecrets = "secrets" CtxVars = "vars" CtxEnv = "env" CtxMatrix = "matrix" CtxNeeds = "needs" CtxInputs = "inputs" CtxGitHub = "github" CtxSteps = "steps" CtxJob = "job" CtxJobs = "jobs" CtxRunner = "runner" CtxStrategy = "strategy" )
Context names that can root a reference chain.
Variables ¶
This section is empty.
Functions ¶
func HasExpression ¶
HasExpression reports whether s contains a ${{ }} block.
Types ¶
type Ref ¶
type Ref struct {
Context string // root context, lowercased ("secrets")
Path []string // resolved segments after the root
Dynamic bool // true when a segment could not be resolved statically
Raw string // source text of the reference
Offset int // byte offset of the reference in the scanned string
End int // byte offset just past the reference
}
Ref is one reference to a context, for example secrets.NPM_TOKEN.
Dynamic marks a reference whose path could not be fully resolved at rest, such as secrets[format('{0}_KEY', env.REGION)]. Path then holds only the segments resolved before the dynamic one, and callers must treat the reference as UNKNOWN.
type Result ¶
type Result struct {
Refs []Ref
Unresolved []Unresolved
Blocks int // number of ${{ }} blocks found
}
Result is the outcome of scanning one string.
func Scan ¶
Scan extracts every reference from the ${{ }} blocks in s. Text outside the blocks is ignored. Offsets are relative to s.
func ScanCondition ¶
ScanCondition scans an `if:` value, which GitHub accepts either wrapped in ${{ }} or bare.
type Unresolved ¶
type Unresolved struct {
Text string // the expression source, without the ${{ }} delimiters
Offset int // byte offset of the expression in the scanned string
Reason string
}
Unresolved is an expression Yumlab could not parse. It never becomes a finding: it is counted and reported as UNKNOWN.
Source Files