Function parseSecurityTrigger

pkg/workflow/trigger_parser.go:565–609

parseSecurityTrigger parses security-related triggers

(input string)

// parseSecurityTrigger parses security-related triggers
func parseSecurityTrigger(input string) (*TriggerIR, error) {
	tokens := strings.Fields(input)
	if len(tokens) < 2 {
		return nil, nil
	}

	if tokens[0] == "dependabot" && len(tokens) >= 3 && tokens[1] == "pull" && tokens[2] == "request" {
		// "dependabot pull request" - filter pull requests by Dependabot author.
		// Guard against the Dependabot Confused Deputy attack (@dependabot recreate) by
		// requiring the PR author to also be dependabot[bot], not just the current actor.
		// Reference: https://labs.boostsecurity.io/articles/weaponizing-dependabot-pwn-request-at-its-finest/
		return &TriggerIR{
			Event:      "pull_request",
			Types:      []string{"opened", "synchronize", "reopened"},
			Conditions: []string{"github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]'"},
			AdditionalEvents: map[string]any{
				"workflow_dispatch": nil,
			},
		}, nil
	}

	if tokens[0] == "security" && tokens[1] == "alert" {
		// "security alert" - code scanning alert
		return &TriggerIR{
			Event: "code_scanning_alert",
			Types: []string{"created", "reopened", "fixed"},
			AdditionalEvents: map[string]any{
				"workflow_dispatch": nil,
			},
		}, nil
	}

	if len(tokens) >= 3 && tokens[0] == "code" && tokens[1] == "scanning" && tokens[2] == "alert" {
		// "code scanning alert" - explicit code scanning alert
		return &TriggerIR{
			Event: "code_scanning_alert",
			Types: []string{"created", "reopened", "fixed"},
			AdditionalEvents: map[string]any{
				"workflow_dispatch": nil,
			},
		}, nil
	}

	return nil, nil
}

// parseExternalTrigger parses external integration triggers
func parseExternalTrigger(input string) (*TriggerIR, error) {