Module diffscan 

What the added lines of a change do (ADR-055): the content checks of openmoat policy check-diff, on top of its path checks (ADR-050).

Each check is a pure function over one changed file: its path, the lines it adds with their numbers in the new file, and the blocks of lines it removes and adds together (Block). Nothing is read from disk or the network: the same change gives the same findings on every machine.

• Supply chain (manifest.rs, lockfile.rs): a new dependency that is a near miss of a popular name (the bundled lists of packages.rs, the ones the shell classifier uses), an npm install script, a dependency or a locked package fetched from outside its registry, and a lockfile hash that changes while the version stays.
• CI takeover (ci.rs): GitHub workflow and action files.
• Backdoors (backdoor.rs): a downloaded or decoded script that runs, a Python start-up file, a Dockerfile ADD from a URL, a long encoded blob in source code.
• Secrets (keys.rs): a private key, a real-looking value in a .env file. Known token formats are the push check’s scanner, which the CLI already runs on every added line (diff-secret).
• New network endpoints (hosts.rs): one finding per host the change adds that the policy’s network allow list does not name; the caller decides that with the compiled policy (new_hosts).

Every rule is in RULES, with its default level; the policy’s check_diff.levels (Settings) sets another one, or off.

Structs

Block

One run of removed and added lines with no kept line between them.

Change

One file a change writes, as the checks see it.

Hit

One thing a check found.

Rule

One content check: its stable id, the level it reports at, and what it finds.

Settings

The policy’s check_diff: section: a level for any content check.

Enums

Level

How much a content finding holds up a merge.

Constants

CI_INJECTION

${{ github.event.* }}, ${{ inputs.* }} or ${{ github.head_ref }} inside a script.

CI_PERMISSIONS

permissions: write-all or a write scope.

CI_PR_TARGET

pull_request_target, and with it a checkout of the pull request’s code.

CI_SECRET_OUT

A secret printed into the log or handed to curl/wget in a script.

CI_UNPINNED

uses: an action at a tag or branch, not a full commit SHA.

DECODE_EXEC

Decoded text (base64, hex, compressed) run as code.

DOCKER_REMOTE_ADD

A Dockerfile ADD of a URL without --checksum.

ENCODED_BLOB

A long base64 blob in source code.

ENV_SECRET

A real-looking secret value in a .env file.

INSTALL_SCRIPT

An npm preinstall, install or postinstall script.

LOCK_INTEGRITY

A lockfile hash changed or removed while the package’s version stays.

NEW_HOST

A host the policy’s network allow list does not name.

PACKAGE_NEAR_MISS

A dependency name one typo or trick away from a popular package’s.

PACKAGE_SOURCE

A dependency or a locked package fetched from git, plain http or another host.

PIPE_TO_SHELL

A downloaded script piped into a shell or an interpreter.

PRIVATE_KEY

A private key (PEM or PuTTY).

PYTHON_STARTUP

A .pth file with an import line, which every Python start runs.

RULES

Every content check, in the order the docs list them.

Functions

new_hosts

Each host changes add that allowed (the policy’s network decision) does not allow: the index of the change it is first named in, and its finding.

rule

The rule id names, if it is a content check.

scan

Every content finding of change, but NEW_HOST (new_hosts), in line order.