/**
 * WGL037: Security Gate on a Regex Match of an Untrusted Ref
 *
 * Flags a `rules:if` that gates execution on a regex match (`=~`) over an
 * attacker-controllable ref variable (e.g. `$CI_COMMIT_REF_NAME =~ /^release/`).
 * An outside contributor can craft a branch name that satisfies the pattern
 * (`release-evil`), passing a gate meant for trusted refs. Match the full ref
 * with `==`, or gate on a protected condition instead.
 */
import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
export declare const wgl037: PostSynthCheck;
//# sourceMappingURL=wgl037.d.ts.map