fix(ci): match expression contexts and job names case-insensitively in verify-action-pins (modelcontextprotocol#4934)

Author: iosayin

scripts/verify-action-pins.mjs

@@ -85,7 +85,7 @@ const repoRoot = path.resolve(
 // other `secrets` reference, so every spelling of every other name, a dynamic
 // index included, still reads as a secret.
 const DEFAULT_TOKEN =
-  /\bsecrets\s*(?:\.\s*GITHUB_TOKEN\b|\[\s*(['"])GITHUB_TOKEN\1\s*\])/g;
+  /\bsecrets\s*(?:\.\s*GITHUB_TOKEN\b|\[\s*(['"])GITHUB_TOKEN\1\s*\])/gi;
 // Where the first expression in a string opens. Everything from there on is
 // searched, rather than each `${{ … }}` body: finding where an expression ENDS
 // needs a parser, since a quoted string inside one may itself contain `}}`
@@ -124,7 +124,7 @@ function handedSecret(job, inherited) {
     const open = text.indexOf(EXPRESSION_OPEN);
     return (
       open !== -1 &&
-      /\bsecrets\b/.test(text.slice(open).replace(DEFAULT_TOKEN, ""))
+      /\bsecrets\b/i.test(text.slice(open).replace(DEFAULT_TOKEN, ""))
     );
   });
 }
@@ -188,6 +188,13 @@ export function credentialedJobs(yaml, file) {
       "permissions" in job ? job.permissions : workflow.permissions;
     if (mints(permissions) || handedSecret(job, workflow.env)) held.add(name);
   }
+  // Job name lookup without regard to case: GitHub matches needs expressions
+  // case-insensitively against jobs defined in the workflow.
+  const jobsByName = new Map(
+    jobs.map(([name, job]) => [name.toLowerCase(), { name, job }]),
+  );
+  const resolveJob = (ref) => jobsByName.get(String(ref).toLowerCase());
+
   // Artifacts are scoped to the run, not to a `needs` edge: a job can download
   // what ANY job that finished before it uploaded, which is every job in its
   // transitive `needs`. So for `source (uploads) → bridge → publish
@@ -197,12 +204,13 @@ export function credentialedJobs(yaml, file) {
   // about the chain.
   const upstreamOf = (name) => {
     const seen = new Set();
-    const queue = [...needsOf(workflow.jobs[name])];
+    const queue = [...needsOf(resolveJob(name)?.job ?? {})];
     while (queue.length > 0) {
-      const next = queue.pop();
-      if (seen.has(next) || !workflow.jobs[next]) continue;
-      seen.add(next);
-      queue.push(...needsOf(workflow.jobs[next]));
+      const nextRef = queue.pop();
+      const resolved = resolveJob(nextRef);
+      if (!resolved || seen.has(resolved.name)) continue;
+      seen.add(resolved.name);
+      queue.push(...needsOf(resolved.job));
     }
     return seen;
   };
@@ -213,19 +221,25 @@ export function credentialedJobs(yaml, file) {
   // reference that names no job (bare `needs`, `needs.*`, a dynamic index)
   // counts every job the reader needs.
   const NEEDS_USE =
-    /\bneeds\b\s*(\.\s*([\w-]+|\*)|\[\s*(?:'([^']*)'|"([^"]*)"|[^\]]*)\s*\])?\s*(?:\.\s*(\w+)|\[\s*['"](\w+)['"]\s*\])?/g;
+    /\bneeds\b\s*(\.\s*([\w-]+|\*)|\[\s*(?:'([^']*)'|"([^"]*)"|[^\]]*)\s*\])?\s*(?:\.\s*(\w+)|\[\s*['"](\w+)['"]\s*\])?/gi;
   const outputsReadBy = (job) => {
     const read = new Set();
     for (const text of stringsIn(job)) {
       const open = text.indexOf(EXPRESSION_OPEN);
       if (open === -1) continue;
       for (const m of text.slice(open).matchAll(NEEDS_USE)) {
         const named = m[2] ?? m[3] ?? m[4];
-        const property = m[5] ?? m[6];
+        const property = (m[5] ?? m[6])?.toLowerCase();
         if (m[1] !== undefined && property === "result") continue;
-        if (named === undefined || named === "*")
-          for (const n of needsOf(job)) read.add(n);
-        else read.add(named);
+        if (named === undefined || named === "*") {
+          for (const n of needsOf(job)) {
+            const resolved = resolveJob(n);
+            if (resolved) read.add(resolved.name);
+          }
+        } else {
+          const resolved = resolveJob(named);
+          if (resolved) read.add(resolved.name);
+        }
       }
     }
     return read;
@@ -235,14 +249,15 @@ export function credentialedJobs(yaml, file) {
     for (const [name, job] of jobs) {
       if (!held.has(name)) continue;
       for (const source of outputsReadBy(job)) {
-        if (workflow.jobs[source] && !held.has(source)) {
+        if (!held.has(source)) {
           held.add(source);
           grew = true;
         }
       }
       if (!mayDownloadArtifact(job)) continue;
       for (const producer of upstreamOf(name)) {
-        if (!held.has(producer) && mayUploadArtifact(workflow.jobs[producer])) {
+        const prodJob = resolveJob(producer)?.job;
+        if (!held.has(producer) && mayUploadArtifact(prodJob)) {
           held.add(producer);
           grew = true;
         }

scripts/verify-action-pins.test.mjs

@@ -107,6 +107,14 @@ test("every spelling of a non-default secret counts; GITHUB_TOKEN in any spellin
     "    uses: org/repo/.github/workflows/lint.yml@v1",
     "    secrets:",
     "      token: ${{ secrets.NPM_TOKEN }}",
+    "  uppercase-secrets:",
+    "    steps:",
+    "      - env:",
+    "          KEY: ${{ SECRETS.DEPLOY_TOKEN }}",
+    "  uppercase-default-exempt:",
+    "    steps:",
+    "      - env:",
+    "          GH_TOKEN: ${{ Secrets['github_token'] }}",
     "  default-bracket:",
     "    steps:",
     "      - env:",
@@ -121,6 +129,7 @@ test("every spelling of a non-default secret counts; GITHUB_TOKEN in any spellin
     "dynamic",
     "inherits",
     "maps-real",
+    "uppercase-secrets",
   ]);
 });
 
@@ -333,6 +342,30 @@ test("outputs read in a job's if, matrix or bracket form count too", () => {
   assert.deepEqual([...credentialedJobs(yaml)].sort(), ["a", "b", "publish"]);
 });
 
+test("needs context and job names match case-insensitively", () => {
+  const yaml = wf(
+    "jobs:",
+    "  detect:",
+    "    runs-on: x",
+    "  build:",
+    "    runs-on: x",
+    "  publish:",
+    "    needs: [detect, build]",
+    "    permissions:",
+    "      id-token: write",
+    "    steps:",
+    "      - env:",
+    "          V1: ${{ NEEDS.detect.outputs.expected }}",
+    "          V2: ${{ needs.BUILD.outputs.artifact }}",
+    "        run: publish",
+  );
+  assert.deepEqual([...credentialedJobs(yaml)].sort(), [
+    "build",
+    "detect",
+    "publish",
+  ]);
+});
+
 test("needs.*.outputs counts every job the reader needs", () => {
   const yaml = wf(
     "jobs:",