import { splitLines } from '../../../shared/helpers/index.js';
export function pontuarWorkflow(src, _relPath) {
    let score = 0;
    const maxScore = 100;
    const issues = [];
    const strengths = [];
    const _linhas = splitLines(src);
    const srcCompleto = src;
    const hardcodedSecrets = (srcCompleto.match(/\b(KEY|TOKEN|SECRET|PASSWORD)\b.*[:=]\s*['"][^'"]+['"]/gi) || []).filter(linha => !/\$\{\{/.test(linha)).length;
    if (hardcodedSecrets === 0) {
        score += 25;
        strengths.push('Sem secrets hardcoded');
    }
    else {
        issues.push(`${hardcodedSecrets} secret(s) hardcoded`);
    }
    const usesLines = srcCompleto.match(/uses:\s*\S+@\S+/g) || [];
    const shaPinned = usesLines.filter(u => /@sha256:/.test(u)).length;
    const actionsOnly = usesLines.filter(u => /actions\//.test(u)).length;
    if (usesLines.length === 0 || shaPinned + actionsOnly === usesLines.length) {
        score += 20;
        strengths.push('Actions com pinning adequado');
    }
    else {
        score += Math.round((shaPinned + actionsOnly) / usesLines.length * 20);
        issues.push(`${usesLines.length - shaPinned - actionsOnly} action(s) sem SHA pinning`);
    }
    const hasCache = /actions\/cache|cache-from|cache-to/.test(srcCompleto);
    if (hasCache) {
        score += 15;
        strengths.push('Caching configurado');
    }
    else {
        issues.push('Sem caching de dependências');
    }
    if (/permissions:/.test(srcCompleto)) {
        score += 15;
        strengths.push('Permissions definidas');
    }
    else {
        issues.push('Permissions não definidas');
    }
    const steps = srcCompleto.match(/-\s*(name:|uses:|run:)/g) || [];
    const namedSteps = srcCompleto.match(/-\s*name:/g) || [];
    if (steps.length === 0 || namedSteps.length === steps.length) {
        score += 10;
        strengths.push('Todos steps com nome');
    }
    else {
        issues.push(`${steps.length - namedSteps.length} step(s) sem nome`);
    }
    const injectionRisks = (srcCompleto.match(/\$\{\{\s*github\.event\.\S+\s*\}\}/g) || []).filter(metrica => /run:/.test(srcCompleto.substring(Math.max(0, srcCompleto.indexOf(metrica) - 100), srcCompleto.indexOf(metrica)))).length;
    if (injectionRisks === 0) {
        score += 15;
        strengths.push('Sem risco de script injection');
    }
    else {
        issues.push(`${injectionRisks} risco(s) de script injection`);
    }
    return {
        score,
        maxScore,
        percentage: Math.round(score / maxScore * 100),
        issues,
        strengths
    };
}
export const pontuadorWorkflow = {
    nome: 'pontuador-workflow',
    categoria: 'workflows',
    descricao: 'Pontua qualidade de GitHub Actions',
    pontuar: pontuarWorkflow
};
//# sourceMappingURL=scorer-workflow.js.map