feat(scanner): structural analyzer for Actions poll bounds

[seonghobae]

Successor of #1088. This stacked G-06 slice adds a bounded structural GitHub Actions + shell control-flow analyzer without replacing the packaged regex family.

It preserves detector IDs github-actions-transport-only-poll-bound and github-actions-transport-failure-budget-poll-bound and all existing regex corpus as migration oracles.

This pull request does not Close #1087 or #1088. ADR-0009 Status is Proposed.

What this adds

• classify_poll_loops(workflow_text) in appguardrail_core/actions_poll_analyzer.py
• Loop-local causal safety: initialization must precede this loop; helper/sibling bounds cannot donate; forward -gt/-ge and statically positive owning-job timeout-minutes / ${{ N }} are total bounds; reversed, unreachable, zero/negative/dynamic, and quoted/comment text are not
• Additive analyzer only: existing regex YAML rules are unchanged; this slice does not hook _scan_file

Verification

Focused tests: tests/test_actions_poll_structural_analyzer.py, tests/test_github_actions_poll_bound_control_flow_regression.py, tests/test_github_actions_poll_bounds.py.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Added a dedicated exact-head coverage workflow at .github/workflows/actions-poll-analyzer-coverage.yml.

It checks out this stacked head and measures 100% statement and branch coverage of appguardrail_core/actions_poll_analyzer.py, running tests/test_actions_poll_structural_analyzer.py plus the existing issue 1088 poll regex tests.

Concurrency is actions-poll-analyzer-coverage-{repository}-{PR number} and fails closed when the PR number is missing.

Issues 1087 and 1088 stay open. This does not retarget off 1088, does not hook _scan_file, and does not rewrite regex YAML. Draft status is unchanged.

[seonghobae]

Follow-up evidence, not approval.

Exact head is now 5baeab93de2a940b024dd31463ce7417ae990e3a. Dedicated workflow .github/workflows/actions-poll-analyzer-coverage.yml uses concurrency actions-poll-analyzer-coverage-{repository}-{PR number} and fails closed without a PR number. Local 162 tests / 100% analyzer statement+branch coverage. Hosted exact-head coverage was queued on this head; predecessor 529ecb0 GREEN does not transfer.

Stay Draft. Do not Close #1087 or #1088. Do not hook _scan_file on this slice.

[seonghobae]

Stacked successor Draft #1152 (feat/actions-poll-analyzer-emit-1087 @ 255cfd866efd971396e132992a474074487f1939) now hooks classify_poll_loops into production _scan_file without rewriting the regex YAML.

It preserves detector IDs github-actions-transport-only-poll-bound and github-actions-transport-failure-budget-poll-bound, merges regex plus analyzer hits by (rule_id, file) so the historical vulnerable fixture still emits count==1, and keeps the historical fixed fixture negative. Analyzer-only helper-loop / reversed / unreachable / split-do cases that regex adjacency misses can now be reported.

This does not Close #1087, #1088, or #1133.