flattening parallel steps so we can run our existing rego rules without change

Author: SUSTAPLE117

models/github_actions.go

@@ -428,6 +428,14 @@ func (o *GithubActionsSteps) UnmarshalYAML(node *yaml.Node) error {
 	}
 
 	for _, item := range node.Content {
+		// flatten parallel steps
+		if p := mappingValue(item, "parallel"); p != nil {
+			var nested GithubActionsSteps
+			_ = p.Decode(&nested) // recurses; lenient, handles nested parallel
+			*o = append(*o, nested...)
+			continue
+		}
+
 		var step GithubActionsStep
 		if err := item.Decode(&step); err != nil {
 			continue
@@ -438,6 +446,19 @@ func (o *GithubActionsSteps) UnmarshalYAML(node *yaml.Node) error {
 	return nil
 }
 
+// mappingValue returns the value node for key in a mapping node, or nil.
+func mappingValue(node *yaml.Node, key string) *yaml.Node {
+	if node.Kind != yaml.MappingNode {
+		return nil
+	}
+	for i := 0; i+1 < len(node.Content); i += 2 {
+		if node.Content[i].Value == key {
+			return node.Content[i+1]
+		}
+	}
+	return nil
+}
+
 func (o *GithubActionsStep) UnmarshalYAML(node *yaml.Node) error {
 	type Alias GithubActionsStep
 	t := Alias{

models/github_actions_test.go

@@ -711,6 +711,54 @@ jobs:
 	assert.Equal(t, "make build", good.Steps[1].Run)
 }
 
+// TestGithubActionsParallelStepsFlattened verifies that `parallel:` step blocks
+// are flattened inline so their nested run/uses sinks remain visible to rules.
+func TestGithubActionsParallelStepsFlattened(t *testing.T) {
+	input := `build:
+  runs-on: ubuntu-latest
+  steps:
+    - uses: actions/checkout@v6
+    - parallel:
+        - name: Build frontend
+          run: npm run build:frontend
+        - name: Build backend
+          run: npm run build:backend
+    - name: Run tests
+      run: npm test
+`
+	var jobs GithubActionsJobs
+	require.NoError(t, yaml.Unmarshal([]byte(input), &jobs))
+	require.Len(t, jobs, 1)
+
+	steps := jobs[0].Steps
+	require.Len(t, steps, 4)
+	assert.Equal(t, "actions/checkout@v6", steps[0].Uses)
+	assert.Equal(t, "npm run build:frontend", steps[1].Run)
+	assert.Equal(t, "npm run build:backend", steps[2].Run)
+	assert.Equal(t, "npm test", steps[3].Run)
+	// Each flattened child keeps its own line number.
+	assert.Equal(t, 6, steps[1].Line)
+	assert.Equal(t, 8, steps[2].Line)
+
+	t.Run("nested parallel", func(t *testing.T) {
+		nested := `build:
+  steps:
+    - parallel:
+        - parallel:
+            - run: a
+            - run: b
+        - run: c
+`
+		var jobs GithubActionsJobs
+		require.NoError(t, yaml.Unmarshal([]byte(nested), &jobs))
+		runs := make([]string, 0, len(jobs[0].Steps))
+		for _, s := range jobs[0].Steps {
+			runs = append(runs, s.Run)
+		}
+		assert.Equal(t, []string{"a", "b", "c"}, runs)
+	})
+}
+
 func TestGithubActionMetadata(t *testing.T) {
 	var actionMetadata GithubActionsMetadata
 	subject := `name: "My GitHub Action"