export const AnalistaGithubActionsMensagens = {
    resumoWorkflow: (score, total) => `GitHub Actions Workflow: Score ${score}/100, ${total} issue(s) found`,
    workflowOtimo: 'Workflow follows all GitHub Actions best practices',
    workflowBom: 'Workflow is good with few low-priority issues',
    workflowRegular: 'Workflow needs attention - moderate issues found',
    workflowRuim: 'Workflow needs urgent improvements - critical issues found',
    erroAnalisarWorkflow: (erro) => `Error analyzing workflow: ${erro instanceof Error ? erro.message : String(erro)}`,
    missingCodeowners: 'Missing CODEOWNERS',
    missingCodeOfConduct: 'README without Code of Conduct',
    missingStaleBot: 'Missing Stale bot',
    missingReleaseAutomation: 'Missing release automation',
    missingIssueTemplates: 'Missing issue templates',
    missingPrTemplate: 'Missing PR template',
    missingSemanticVersioning: 'Semantic versioning automation not detected',
    missingChangelogAutomation: 'Missing changelog automation',
    missingLicenseHeaders: 'Many files missing SPDX license header',
    suspiciousActionDetected: (uses) => `Suspicious action detected: ${uses}`,
    suspiciousActionDetectedSugestao: 'Prefer official actions or verified organizations. Review the fork code before using.',
    possibleVulnerableNpmDependency: (dep) => `Possible vulnerable npm dependency: ${dep}`,
    workflowInstallsDepsWithoutAudit: 'Workflow installs dependencies without security audit',
    workflowInstallsDepsWithoutAuditSugestao: 'Add an npm audit, snyk or similar step to detect vulnerabilities',
    checkoutsWithoutPersistCredentials: (count) => `${count} checkout(s) without persist-credentials: false`,
    checkoutsWithoutPersistCredentialsSugestao: 'Add persist-credentials: false to avoid token exposure, unless the workflow needs to write to the repository',
    workflowWithoutTimeout: 'Workflow without timeout configured',
    workflowWithoutTimeoutSugestao: 'Add timeout-minutes to prevent infinite executions',
    possibleScriptInjection: 'Possible script injection via GitHub context',
    possibleScriptInjectionSugestao: 'Sanitize input or use environment variables',
    hardcodedSecret: 'Hardcoded secret in workflow',
    hardcodedSecretSugestao: 'Use ${{ secrets.SECRET_NAME }}',
    sudoUsageDetected: 'Sudo usage detected',
    sudoUsageDetectedSugestao: 'Use container with specific user instead of sudo',
    absoluteTempPathHardcoded: 'Absolute or temporary path hardcoded',
    absoluteTempPathHardcodedSugestao: 'Use environment variables like $GITHUB_WORKSPACE or ${{ runner.temp }}',
    possibleSecretExposure: 'Possible secret exposure in console output',
    possibleSecretExposureSugestao: 'Use ::add-mask:: before printing or avoid printing secrets',
    pullRequestTargetExecutesForkCode: 'pull_request_target may execute fork code',
    pullRequestTargetExecutesForkCodeSugestao: 'Use pull_request instead of pull_request_target',
    workflowRunUnsafe: 'workflow_run may be unsafe with fork checkout',
    workflowRunUnsafeSugestao: 'Use pull_request or ensure no checkout from external refs',
    checkoutFetchDepthZero: 'checkout with fetch-depth: 0 downloads full history',
    checkoutFetchDepthZeroSugestao: 'Use fetch-depth: 1 if you don\'t need the full history',
    permissionsNotDefined: 'Permissions not defined - uses default GITHUB_TOKEN',
    permissionsNotDefinedSugestao: 'Add permissions: with minimum required scope',
    buildDeployWithoutSecurityAudit: 'Build/deploy workflow without security audit',
    buildDeployWithoutSecurityAuditSugestao: 'Add an npm audit, snyk or similar step',
    workflowWithoutTrigger: 'Workflow without trigger defined (push, pull_request, schedule, etc.)',
    workflowWithoutTriggerSugestao: 'Define explicit triggers to avoid unexpected execution',
    pullRequestTargetGrantsWritePermissions: 'pull_request_target grants write permissions to the repository',
    pullRequestTargetGrantsWritePermissionsSugestao: 'Use pull_request instead of pull_request_target, or carefully validate the source branch',
    workflowDispatchWithoutInputs: 'workflow_dispatch without defined inputs',
    workflowDispatchWithoutInputsSugestao: 'Define required inputs to control manual workflow execution',
    erroAplicarCorrecao: (erro) => `Error applying fix: ${erro}`,
};
//# sourceMappingURL=analyst-github-actions-messages.js.map