registry / @intentius/chant-lexicon-github / 0.18.19

@intentius/chant-lexicon-github@0.18.19

GitHub Actions lexicon for chant — declarative IaC in TypeScript

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystem

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 252 file(s), 645 KB of source, external domains: example.com, json.schemastore.org, staging.example.com

Source & flagged code

6 flagged

src/lint/rules/rules.test.tsView file

Lines 321-366typescript

321 expect(diags[0].severity).toBe("warning");

322 });

323

324 test("does not flag cancelInProgress with group", () => {

325 const ctx = createContext(`const c = new Concurrency({ cancelInProgress: true, group: "ci-\${{ github.ref }}" });`);

326 const diags = validateConcurrencyRule.check(ctx);

327 expect(diags).toHaveLength(0);

328 });

329

330 test("does not flag concurrency without cancelInProgress", () => {

331 const ctx = createContext(`const c = new Concurrency({ group: "ci" });`);

332 const diags = validateConcurrencyRule.check(ctx);

333 expect(diags).toHaveLength(0);

334 });

335});

336

337// ── GHA020: detect-secrets ──────────────────────────────────────────

338

339describe("GHA020: detect-secrets", () => {

340 test("flags AWS access key", () => {

341 const ctx = createContext(`const key = "AKIAIOSFODNN7EXAMPLE";`);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lint/rules/rules.test.tsView on unpkg · L341

Critical

Secret Pattern

AWS access key ID in src/lint/rules/rules.test.ts

src/lint/rules/rules.test.tsView on unpkg · L341

342 const diags = detectSecretsRule.check(ctx);

343 expect(diags).toHaveLength(1);

344 expect(diags[0].ruleId).toBe("GHA020");

345 expect(diags[0].severity).toBe("error");

346 });

347

348 test("flags RSA private key header", () => {

349 const ctx = createContext(`const key = "-----BEGIN RSA PRIVATE KEY-----";`);

Critical

Secret Pattern

RSA private key in src/lint/rules/rules.test.ts

src/lint/rules/rules.test.tsView on unpkg · L349

350 const diags = detectSecretsRule.check(ctx);

351 expect(diags).toHaveLength(1);

352 });

353

354 test("skips strings referencing secrets.", () => {

355 const ctx = createContext(`const x = "Use secrets.DEPLOY_KEY for deployment";`);

356 const diags = detectSecretsRule.check(ctx);

357 expect(diags).toHaveLength(0);

358 });

359

360 test("does not flag normal strings", () => {

361 const ctx = createContext(`const name = "my-application";`);

362 const diags = detectSecretsRule.check(ctx);

363 expect(diags).toHaveLength(0);

364 });

365});

366

src/composites/deploy-environment.tsView file

Lines 20-60typescript

20 deployJob?: Partial<ConstructorParameters<typeof Job>[0]>;

21 cleanupJob?: Partial<ConstructorParameters<typeof Job>[0]>;

src/lint/rules/detect-secrets.test.tsView file

Lines 1-26typescript

1import { describe, test, expect } from "vitest";

2import * as ts from "typescript";

3import type { LintContext } from "@intentius/chant/lint/rule";

src/composites/docker-build.tsView file

Lines 40-80typescript

40 push = true,

41 platforms,

42 runsOn = "ubuntu-latest",

43 defaults,

44 } = props;

46 const { createProperty

Source & flagged code

6 flagged · loading source

src/lint/rules/rules.test.tsView file

341patternName = aws_access_key severity = critical line = 341 matchedText = const ct...;`);

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code