use annotate_snippets::{AnnotationKind, Group, Level, Snippet};use anyhow::{Result, anyhow};use regex::Regex;use serde_yaml::Value;use std::{    collections::HashMap,    fs,    ops::Range,    path::{Path, PathBuf},    sync::LazyLock,}; static GITHUB_INPUT_PATTERN: LazyLock<Regex> = LazyLock::new(|| {    Regex::new(r#"\$\{\{[[:blank:]]*([[:alnum:]]|[[:punct:]])+?[[:blank:]]*\}\}"#)        .expect("Should compile")}); pub struct WorkflowFile {    raw_content: String,    pub parsed_content: Value,} impl WorkflowFile {    pub fn load(workflow_file_path: &Path) -> Result<Self> {        fs::read_to_string(workflow_file_path)            .map_err(|_| {                anyhow!(                    "Could not read workflow file at {}",                    workflow_file_path.display()                )            })            .and_then(|file_content| {                serde_yaml::from_str(&file_content)                    .map(|parsed_content| Self {                        raw_content: file_content,                        parsed_content,                    })                    .map_err(|e| anyhow!("Failed to parse workflow file: {e:?}"))            })    }} pub struct WorkflowValidationError {    file_path: PathBuf,    contents: WorkflowFile,    errors: Vec<RunValidationError>,} impl WorkflowValidationError {    pub fn new(        errors: Vec<RunValidationError>,        contents: WorkflowFile,        file_path: PathBuf,    ) -> Self {        Self {            file_path,            contents,            errors,        }    }     pub fn annotation_group<'a>(&'a self) -> Group<'a> {        let raw_content = &self.contents.raw_content;        let mut identical_lines = HashMap::new();         let ranges = self            .errors            .iter()            .flat_map(|error| error.found_injection_patterns.iter())            .map(|(line, pattern_range)| {                let initial_offset = identical_lines                    .get(&(line.as_str(), pattern_range.start))                    .copied()                    .unwrap_or_default();                 let line_start = raw_content[initial_offset..]                    .find(line.as_str())                    .map(|offset| offset + initial_offset)                    .unwrap_or_default();                 let pattern_start = line_start + pattern_range.start;                let pattern_end = pattern_start + pattern_range.len();                 identical_lines.insert((line.as_str(), pattern_range.start), pattern_end);                 pattern_start..pattern_end            });         Level::ERROR            .primary_title("Found GitHub input injection in run command")            .element(                Snippet::source(&self.contents.raw_content)                    .path(self.file_path.display().to_string())                    .annotations(ranges.map(|range| {                        AnnotationKind::Primary                            .span(range)                            .label("This should be passed via an environment variable")                    })),            )    }} pub struct RunValidationError {    found_injection_patterns: Vec<(String, Range<usize>)>,} pub fn validate_run_command(command: &str) -> Result<(), RunValidationError> {    let patterns: Vec<_> = command        .lines()        .flat_map(move |line| {            GITHUB_INPUT_PATTERN                .find_iter(line)                .map(|m| (line.to_owned(), m.range()))        })        .collect();     if patterns.is_empty() {        Ok(())    } else {        Err(RunValidationError {            found_injection_patterns: patterns,        })    }}