/**
 * Cross-workflow trust-boundary analysis (v5.7) - the core "Cordyceps" detection.
 *
 * Every other GitHub Actions check in this tool looks at ONE file at a time.
 * That is structurally blind to the composition attack novee.security described
 * in 2026: a low-privilege, PR-triggered PRODUCER workflow uploads an artifact
 * (whose contents an anonymous contributor controls), and a privileged,
 * `workflow_run`-triggered CONSUMER workflow downloads - and often executes -
 * that artifact WITH secrets and a read/write GITHUB_TOKEN in scope. Neither
 * file is individually wrong; the vulnerability lives in how they connect.
 *
 * This pass models the producer -> consumer graph across all workflow files and
 * flags that trust-boundary crossing.
 */
import type { Finding } from "./types.js";
export declare function scanWorkflowGraph(dir: string): Finding[];
//# sourceMappingURL=workflow-graph.d.ts.map