Class: Rules::GithubDependencyRefs

Inherits:
Base
  • Object
show all
Defined in:
lib/rules/github_dependency_refs.rb

Constant Summary collapse

GITHUB_DEP =

Matches: npm install github:owner/repo#sha, or git+github.com/… in run blocks

/(?:npm|pnpm|yarn|bun)\s+(?:install|add)\s+.*(?:github:|git\+https:\/\/github\.com)/

Instance Method Summary collapse

Instance Method Details

#check(workflow) ⇒ Object 



10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
 
# File 'lib/rules/github_dependency_refs.rb', line 10

def check(workflow)
    findings = []

    workflow.raw_lines.each_with_index do |line, i|
        next if line.strip.start_with?("#")

        if line.match?(GITHUB_DEP)
            findings << finding(workflow,
                line: i + 1,
                code: line.strip,
                message: "Package installed from GitHub commit/branch ref — bypasses registry integrity checks",
                fix: "Install from the package registry instead of GitHub refs"
            )
        end
    end

    findings
end

#description ⇒ Object 



4
 
# File 'lib/rules/github_dependency_refs.rb', line 4

def description = "Direct GitHub commit/branch reference in package install"

#name ⇒ Object 



3
 
# File 'lib/rules/github_dependency_refs.rb', line 3

def name = "github-dependency-refs"

#severity ⇒ Object 



5
 
# File 'lib/rules/github_dependency_refs.rb', line 5

def severity = :medium