Do you guy think of creating a transfomation prototype?

[bepp-boop]

This is currently my thesis to create something that detect and potentially fix it? I saw you added tree-sitter, which I also used as foundation to capture. I was asking about wondering about the context expression detection and maybe capture the right one and transforming them that also included the correct interpolation. I.E shell.

• name: Example step
  run: |
  echo 'Hello ${{ inputs.name }}'

it can be made safer by converting it into:

• name: Example step
  env:
  NAME: ${{ inputs.name }} # <- Assign the expression to an environment variable
  run: |
  echo "Hello $NAME"

[woodruffw]

Hi @bepp-boop, thanks for opening a discussion! If I understand you correctly, you're asking whether we've considered a fix/patch mode for automatically fixing findings.

If that's right, the answer is yes! That's being tracked here: #28.

My understanding is that tree-sitter doesn't allow this at the AST level, but it might be possible to do this by doing source edits and re-parses. I'm curious if you have any thoughts on doing that in a scalable/reliable manner, from your research.

One possible approach is here as well: https://docs.rs/tree-sitter-edit/latest/tree_sitter_edit/index.html

[woodruffw]

Closing in favor of continued discussion in #28. Please follow up there @bepp-boop!