Module rules 

Functions

artifact_boundary_crossing

MVP Rule 5: Artifact produced by privileged step consumed across trust boundary.

authority_propagation

MVP Rule 1: Authority (secret/identity) propagated across a trust boundary.

floating_image

Tier 6 Rule: Container image without Docker digest pinning.

long_lived_credential

Stretch Rule 9: Secret name matches known long-lived/static credential pattern.

over_privileged_identity

MVP Rule 2: Identity scope broader than actual usage.

persisted_credential

Stretch Rule: checkout step with persistCredentials: true writes credentials to disk.

run_all_rules

Run all rules against a graph.

unpinned_action

MVP Rule 3: Third-party action/image without SHA pin.

untrusted_with_authority

MVP Rule 4: Untrusted step has direct access to secret/identity.