feat: adds new github-env audit

[ubiratansoares]

• Pulls dangerous triggers detection logic from WorkflowAudit and moves to impl DangerousTriggers instance methods
• Reuses only that logic in the context of to implement a new audit

cargo run -- tests/test-data/github_env.yml

error[github-env]: dangerous use of $GITHUB_ENV
  --> tests/test-data/github_env.yml:12:9
   |
12 |           run: |
   |  _________^
13 | |           message=$(echo "$TITLE" | grep -oP '[{\[][^}\]]+[}\]]' | sed 's/{\|}\|\[\|\]//g')
14 | |           echo "message=$message" >> $GITHUB_ENV
   | |_________________________________________________^ GITHUB_ENV used in the context of a dangerous Workflow trigger
   |
   = note: audit confidence → High

2 findings (1 ignored): 0 unknown, 0 informational, 0 low, 0 medium, 1 high

Some questions below!

[woodruffw]

Thanks @ubiratansoares! I'll give this a more detailed review later today.

Pulls dangerous triggers detection logic from WorkflowAudit and moves to impl DangerousTriggers instance methods

Rather than use sharing APIs across audits, I think we can probably turn these into APIs on models::Workflow -- Workflow::has_pull_request_target and similar would probably be good.

[ubiratansoares]

I address all the comments, including moving dangerous triggers detection logic to models::Workflow.

I also added some docs covering the basics based on the discussions we have in the related issue, but I did not go deep there are safe ways to use $GITHUB_ENV. Happy to extended those docs based on additional input!

[ubiratansoares]

@woodruffw we miss an example here, happy to raise a PR there, lmk!

[woodruffw]

@woodruffw we miss an example here, happy to raise a PR there, lmk!

Please do, thanks!

[woodruffw]

Just thinking out loud: in terms of improving this, we could probably use a regexp like:

^.+\s*>>?\s*"?\$\{?GITHUB_ENV\}?"?.*$

That'll catch a bunch of common cases, but it's also a mess. So we can defer that for a follow-up.

[woodruffw]

LGTM, thanks @ubiratansoares!

I'll make a follow-up to track refinements here.