# validation-ordering-check.yml
rules:
  - id: validation-before-api
    pattern: |
      Must verify that all safe output handler implementations:
      1. Perform schema validation before API calls
      2. Enforce limits before API calls
      3. Sanitize content before API calls
    check: |
      grep -A 50 "function.*Handler" actions/setup/js/*.cjs | \
      grep -B 5 "octokit\." | \
      grep -q "validateSchema\|enforceLimit\|sanitize"
    severity: CRITICAL

# cross-repo-validation-check.yml
rules:
  - id: cross-repo-allowlist-enforcement
    pattern: |
      All handlers with target-repo support must validate against allowlist
    check: |
      for handler in create_issue.cjs add_comment.cjs; do
        grep -q "validateTargetRepo\|checkAllowedRepos" "actions/setup/js/$handler" || exit 1
      done
    severity: HIGH

# sanitization-check.yml
rules:
  - id: sanitization-completeness
    pattern: |
      All handlers must import and use sanitization functions
    check: |
      for handler in actions/setup/js/*.cjs; do
        [[ "$handler" =~ (test|parse|buffer) ]] && continue
        grep -q "sanitize\|stripHTML\|validateURL" "$handler" || exit 1
      done
    severity: MEDIUM

safe-outputs:
  footer: true  # Applied to all types
  
  create-issue:
    max: 3
    labels: [bug, automated]
  
  add-comment:
    max: 2
    hide-older-comments: true

safe-outputs:
  allowed-github-references:
    - owner/repo-a
    - owner/repo-b
  
  create-issue:
    max: 5
    target-repo: owner/repo-a

safe-outputs:
  staged: true  # Enable preview mode globally
  
  create-issue:
    max: 10  # Safe to set high in staged mode
  
  add-comment:
    max: 5

# safe-output-type-completeness-check.yml
rules:
  - id: type-definition-completeness
    pattern: |
      Each safe output type must have complete documentation
    check: |
      # Extract all "#### Type: " headers
      grep "^#### Type:" docs/src/content/docs/reference/safe-outputs-specification.md | \
      while read -r line; do
        type_name=$(echo "$line" | sed 's/^#### Type: //')
        
        # Check for required sections
        has_schema=$(grep -A 100 "^#### Type: $type_name" spec.md | grep -q "MCP Tool Schema" && echo "yes" || echo "no")
        has_semantics=$(grep -A 100 "^#### Type: $type_name" spec.md | grep -q "Operational Semantics" && echo "yes" || echo "no")
        has_config=$(grep -A 100 "^#### Type: $type_name" spec.md | grep -q "Configuration Parameters" && echo "yes" || echo "no")
        has_security=$(grep -A 100 "^#### Type: $type_name" spec.md | grep -q "Security Requirements" && echo "yes" || echo "no")
        has_permissions=$(grep -A 100 "^#### Type: $type_name" spec.md | grep -q "Required Permissions" && echo "yes" || echo "no")
        
        if [[ "$has_schema" != "yes" ]] || [[ "$has_semantics" != "yes" ]] || \
           [[ "$has_config" != "yes" ]] || [[ "$has_security" != "yes" ]] || \
           [[ "$has_permissions" != "yes" ]]; then
          echo "INCOMPLETE: $type_name (schema=$has_schema, semantics=$has_semantics, config=$has_config, security=$has_security, permissions=$has_permissions)"
        fi
      done
    severity: MEDIUM

# security-checks.yml
rules:
  - id: SEC-001
    name: Privilege Separation Enforcement
    description: Verify agent jobs lack write permissions
    check: |
      grep -A 50 "jobs:" compiled-workflow.lock.yml | \
      grep -A 10 "agent:" | \
      grep -E "issues:.*write|pull-requests:.*write" && exit 1 || exit 0
    severity: CRITICAL
    remediation: Remove write permissions from agent job

  - id: SEC-002
    name: Validation Before API Calls
    description: Ensure validation happens before GitHub API calls
    check: |
      for handler in actions/setup/js/*.cjs; do
        [[ "$handler" =~ test ]] && continue
        # Check that validation functions appear before API calls
        awk '/octokit\./{line=NR} /validate|sanitize/{if(NR<line) valid=1} END{exit !valid}' "$handler" || {
          echo "FAIL: $handler has API calls before validation"
          exit 1
        }
      done
    severity: CRITICAL
    remediation: Reorder code to validate before API calls

  - id: SEC-003
    name: Max Limit Enforcement
    description: Verify max limits are checked before processing
    check: |
      for handler in actions/setup/js/*.cjs; do
        [[ "$handler" =~ test ]] && continue
        grep -q "\.length.*>.*\.max\|enforceMaxLimit\|checkLimit" "$handler" || {
          echo "WARN: $handler may not enforce max limits"
        }
      done
    severity: HIGH
    remediation: Add max limit check before processing operations

  - id: SEC-004
    name: Content Sanitization Required
    description: Verify content sanitization is applied
    check: |
      for handler in actions/setup/js/*.cjs; do
        [[ "$handler" =~ (test|parse|buffer) ]] && continue
        grep -q "sanitize\|stripHTML\|escapeMarkdown" "$handler" || {
          echo "WARN: $handler may not sanitize content"
        }
      done
    severity: MEDIUM
    remediation: Import and use sanitization functions

  - id: SEC-005
    name: Cross-Repository Validation
    description: Verify cross-repo operations check allowlist
    check: |
      for handler in actions/setup/js/*.cjs; do
        grep -q "target.*repo\|targetRepo" "$handler" && {
          grep -q "allowed.*repos\|validateTargetRepo" "$handler" || {
            echo "FAIL: $handler has target-repo but no allowlist check"
            exit 1
          }
        }
      done
    severity: HIGH
    remediation: Add allowlist validation for cross-repo operations

# usability-checks.yml
rules:
  - id: USE-001
    name: Error Code Standardization
    description: Verify handlers use standardized error codes
    check: |
      for handler in actions/setup/js/*.cjs; do
        [[ "$handler" =~ test ]] && continue
        # Check for error codes in E### format
        grep -E "throw.*Error|return.*error" "$handler" | \
        grep -qE "E[0-9]{3}" || {
          echo "WARN: $handler may not use standard error codes"
        }
      done
    severity: LOW
    remediation: Use standard E### error codes

  - id: USE-002
    name: Footer Attribution Required
    description: Verify footers are added when footer:true
    check: |
      for handler in actions/setup/js/*.cjs; do
        grep -q "footer.*true\|addFooter\|attribution" "$handler" || {
          echo "INFO: $handler may not add footers"
        }
      done
    severity: LOW
    remediation: Ensure footer is appended when configured

  - id: USE-003
    name: Staged Mode Preview Format
    description: Verify staged mode uses correct preview format
    check: |
      for handler in actions/setup/js/*.cjs; do
        grep -q "staged.*true\|isStaged" "$handler" && {
          grep -q "🎭\|Staged Mode" "$handler" || {
            echo "WARN: $handler has staged mode but no 🎭 emoji"
          }
        }
      done
    severity: LOW
    remediation: Use 🎭 emoji in staged mode previews

# requirements-checks.yml
rules:
  - id: REQ-001
    name: RFC 2119 Keyword Usage
    description: Verify normative sections use MUST/SHOULD/MAY
    check: |
      # Check sections that should have normative statements
      for section in "Security Architecture" "Configuration Semantics" "Execution Guarantees"; do
        grep -A 200 "## .*$section" docs/src/content/docs/reference/safe-outputs-specification.md | \
        grep -q "MUST\|SHALL\|SHOULD\|MAY" || {
          echo "WARN: Section '$section' may lack RFC 2119 keywords"
        }
      done
    severity: MEDIUM
    remediation: Add MUST/SHOULD/MAY keywords to normative statements

  - id: REQ-002
    name: Safe Output Type Completeness
    description: Verify each type has all required documentation sections
    check: |
      # Extract type names and check for required sections
      grep "^#### Type:" docs/src/content/docs/reference/safe-outputs-specification.md | \
      sed 's/^#### Type: //' | while read -r type; do
        sections_found=0
        for section in "MCP Tool Schema" "Operational Semantics" "Configuration Parameters" "Security Requirements" "Required Permissions"; do
          grep -A 150 "^#### Type: $type" docs/src/content/docs/reference/safe-outputs-specification.md | \
          grep -q "**$section**" && ((sections_found++))
        done
        if [ $sections_found -lt 5 ]; then
          echo "INCOMPLETE: Type '$type' has only $sections_found/5 required sections"
        fi
      done
    severity: MEDIUM
    remediation: Complete documentation for all safe output types

  - id: REQ-003
    name: Verification Method Specification
    description: Verify requirements include verification methods
    check: |
      # Check that key requirements have verification guidance
      for req in "AR1" "AR2" "AR3" "SP1" "SP2" "SP3"; do
        grep -A 30 "**Requirement $req:\|**Property $req:" docs/src/content/docs/reference/safe-outputs-specification.md | \
        grep -q "Verification:\|Formal Definition:" || {
          echo "WARN: Requirement $req may lack verification method"
        }
      done
    severity: LOW
    remediation: Add verification methods to all key requirements

# implementation-checks.yml
rules:
  - id: IMP-001
    name: Handler Registration Completeness
    description: Verify all configured types have handlers
    check: |
      # Extract safe output types from config
      configured_types=$(jq -r '.tools | keys[]' /opt/gh-aw/safeoutputs/config.json 2>/dev/null || echo "")
      
      # Check each has handler file
      for type in $configured_types; do
        handler_file="actions/setup/js/$(echo $type | tr '_' '-').cjs"
        [ ! -f "$handler_file" ] && {
          echo "MISSING: Handler file $handler_file for type $type"
          exit 1
        }
      done
    severity: HIGH
    remediation: Create handler file for configured type

  - id: IMP-002
    name: Permission Computation Accuracy
    description: Verify computed permissions match type requirements
    check: |
      # Compare permissions in workflow vs required permissions
      go test -run TestPermissionsComputation ./pkg/workflow/ || {
        echo "FAIL: Permission computation tests failed"
        exit 1
      }
    severity: HIGH
    remediation: Fix permission computation logic

  - id: IMP-003
    name: Schema Validation Consistency
    description: Verify schemas match specification
    check: |
      # For each type, compare generated schema to spec
      for type in create_issue add_comment; do
        # Extract schema from spec
        spec_required=$(grep -A 20 "\"$type\"" docs/src/content/docs/reference/safe-outputs-specification.md | \
                       grep "\"required\":" | head -1)
        
        # Compare to generated config
        config_required=$(jq -r ".tools.${type}.inputSchema.required" /opt/gh-aw/safeoutputs/config.json 2>/dev/null)
        
        # Simplified check (actual implementation would be more thorough)
        [ -z "$config_required" ] && echo "WARN: Type $type schema may not match spec"
      done
    severity: MEDIUM
    remediation: Update schema generation to match specification