jekyll-client-search 0.3.1 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d3574c3adc2e2e00dd76ef5b5011358fcb9abfe3ed0cfbd372dffee00f913fc
-  data.tar.gz: 76f691ec62695d6e99677bc952fe85ae07c477df563f83b29f063a58f5b0d8c0
+  metadata.gz: 60acab6161a3d4eafb265742c337c86bbc26e444bc0ce202a02e5ce80049c3f0
+  data.tar.gz: bf05aa7d4945bb3e82acd8ab5127ab2e84bb457eb9868f79d235a8a5ce701a53
 SHA512:
-  metadata.gz: 23b5534d2c60626e5ee068687f2c4313f6e7494f1e382b89928f37b3eaf50fad3f979808e696c6a2bf3d17a5a00764674667b9f8f4041b4fc6f73a71953fcee7
-  data.tar.gz: 9403f90fd84ee7798fa07281001faf534028247e2f99aea46a9a305b8c3ac57191ae0059cb49ca8eb377b1ba7633b5960f3c481bc24e0cc6de872d30132b3521
+  metadata.gz: cc8c5846be7c3a812a94c59aea41ecbb58c9672fa5948b4a306193e6d5914fc18f7104263f9a0ec84a1d405099dbc72dfc6c38c84cc3135133111b3f1c199ab8
+  data.tar.gz: e5eb813ed9b6dc1ba7abf34a96bbefa1c353453d8596d79dbf0f04290c7b502f18306419f4b5adc33712a8a18896def5fe0389293ffe43f7f7fbed2622083d6c

data/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 ## Unreleased
 
+## 0.3.3 — 2026-09-11
+
+### Refactored
+- Extract duplicated `normalize` function from `client-search-base.js` and `client-search-dropdown.js` into new shared module `assets/client-search-shared.js` (exposes `window.ClientSearchShared.normalize` and `window.ClientSearchShared.coreFields`) — eliminates CodeFactor duplicate-code finding and ensures consistent normalization across both runtimes
+
+## 0.3.2 — 2026-09-10
+
+### Added
+- Semgrep security scan in CI (`semgrep ci` job in `.github/workflows/ci.yml`) — runs on every push and pull request using the `SEMGREP_APP_TOKEN` secret and the Semgrep Pro engine with the organization's full policy (2,900+ rules)
+- `.semgrep.yml` with custom Ruby ReDoS detection rules and usage documentation
+- Semgrep step in pre-commit hook (`bin/install-hooks.sh`)
+- Dependabot configuration for GitHub Actions (`.github/dependabot.yml`) — weekly SHA-pinned action updates
+- CodeFactor and Semgrep badges in README.md
+- Documentation of CodeQL, Semgrep, CodeFactor, and Dependabot in README.md, README.developer.md, and AGENTS.md
+- Semgrep usage guide in README.developer.md (local commands, nosemgrep annotations, SHA pinning)
+
+### Fixed
+- Pin all GitHub Actions to full 40-character commit SHAs with version comments to prevent supply-chain attacks via mutable tag repointing (Semgrep: `github-actions-mutable-action-tag`)
+- Replace `Object.assign({}, entry, ...)` in benchmark with explicit field construction to avoid mass-assignment taint (Semgrep: `insecure-object-assign`)
+- Replace manual arXiv query string with `URI.encode_www_form` for correct URL encoding (Semgrep: `avoid-tainted-http-request`)
+
+### Changed
+- Add `nosemgrep` annotations with justifications for false positives (static ERB template, array-form `Open3.capture2`, fixed-host arXiv request) and acceptable risks (local loopback Ollama HTTP in tests and benchmarks)
+
 ## 0.3.1 — 2026-09-09
 
 ### Fixed

data/README.developer.md

@@ -24,9 +24,50 @@ are required for the default test run.
 ## Quality checks and git hooks
 
 The project uses a focused quality stack: RuboCop (style), bundler-audit
-(security), RSpec (Ruby tests), and `npm test` (JavaScript tests). This
-covers the actionable ground without the maintenance burden of additional
-code-smell tools on a small focused gem.
+(security), RSpec (Ruby tests), `npm test` (JavaScript tests), and Semgrep
+(security scanning). This covers the actionable ground without the
+maintenance burden of additional code-smell tools on a small focused gem.
+
+External automated code review services:
+- [CodeQL](https://codeql.github.com) — GitHub native security scanning
+  (Ruby + JavaScript), runs on every push.
+- [Semgrep](https://semgrep.dev) — CI security scan using the Semgrep Pro
+  engine with the organization's full policy (2,900+ rules). Runs as a CI
+  job (`semgrep ci`) and in the pre-commit hook (custom rules only). See
+  `.semgrep.yml` for local configuration and usage instructions.
+- [CodeFactor](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search) —
+  automated code review (RuboCop, Brakeman, bundler-audit, duplication).
+- [Dependabot](https://docs.github.com/en/code-security/dependabot) — weekly
+  GitHub Actions version updates (SHA-pinned actions updated automatically).
+
+### Semgrep usage
+
+The project uses two Semgrep scanning modes:
+
+1. **Pre-commit hook** — runs `semgrep scan --config .semgrep.yml` with only
+   the custom ReDoS rules defined in `.semgrep.yml`. Fast (~3s).
+2. **CI job** — runs `semgrep ci` with the full organization policy from the
+   Semgrep AppSec Platform, including Pro engine rules. Findings are uploaded
+   to the dashboard for triage.
+
+Local commands:
+
+```bash
+semgrep scan --config .semgrep.yml --error lib/ assets/   # custom rules only
+semgrep ci --dry-run                                        # full org policy, no upload
+semgrep ci                                                   # full org policy, upload to dashboard
+```
+
+To suppress a false positive or acceptable risk, add an inline annotation
+with the full rule ID and a justification:
+
+```ruby
+# nosemgrep: problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request
+# Acceptable risk: local loopback Ollama test endpoint.
+```
+
+All GitHub Actions are pinned to full 40-character commit SHAs with version
+comments. Dependabot updates the SHAs and version comments automatically.
 
 ### Rake tasks
 
@@ -55,12 +96,12 @@ This installs two hooks:
 
 | Hook | What it runs | When |
 | --- | --- | --- |
-| `pre-commit` | `rubocop` only (~2s) | Before each commit |
+| `pre-commit` | `rubocop + semgrep` (~5s) | Before each commit |
 | `pre-push` | `rubocop + rspec` (~15s) | Before each push |
 
-The pre-commit hook is intentionally fast (style only) to avoid bypassing
-with `--no-verify`. The full test suite runs on pre-push and in CI. Skip
-either with `git commit --no-verify` or `git push --no-verify`.
+The pre-commit hook is intentionally fast (style + security) to avoid
+bypassing with `--no-verify`. The full test suite runs on pre-push and in
+CI. Skip either with `git commit --no-verify` or `git push --no-verify`.
 
 ### CI checks
 
@@ -71,6 +112,7 @@ request across Ruby 3.2/3.3/3.4 and Node 22/24:
 - `bundle exec bundle-audit check --update` (Ruby dependency security)
 - `npm audit --audit-level=high` (JavaScript dependency security)
 - `npm outdated` (non-blocking — warns about outdated npm packages)
+- `semgrep ci` (security scan with custom rules from `.semgrep.yml`)
 
 ## Build-time related articles
 

data/README.md

@@ -8,6 +8,8 @@
 [![License: AGPL v3](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue.svg)](LICENSE)
 [![DeepWiki](https://img.shields.io/badge/DeepWiki-docs-7B68EE.svg)](https://deepwiki.com/gundestrup/jekyll-client-search)
 [![Coverage](https://img.shields.io/badge/coverage-100%25%20branches-brightgreen.svg)](#testing-strategy)
+[![Semgrep](https://img.shields.io/badge/semgrep-scanning-brightgreen.svg)](https://semgrep.dev)
+[![CodeFactor](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search/badge)](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search)
 
 A Jekyll plugin that generates a JSON document index for client-side search.
 Supports lexical search ([MiniSearch](https://lucaong.github.io/minisearch/),
@@ -1140,10 +1142,30 @@ bundle exec rake ci
 
 GitHub Actions are configured in `.github/workflows/`:
 
-- `ci.yml` runs the test and gem build checks on pushes and pull requests.
+- `ci.yml` runs the test and gem build checks on pushes and pull requests,
+  plus a Semgrep security scan job.
 - `release.yml` runs on `v*` tags or manual dispatch, verifies the gem, and
   publishes it using RubyGems trusted publishing.
 
+Additional automated code quality and security services:
+
+- [CodeQL](https://codeql.github.com) — GitHub native code scanning for
+  security vulnerabilities (Ruby + JavaScript).
+- [Semgrep](https://semgrep.dev) — CI security scan using the Semgrep Pro
+  engine with the organization's full policy (2,900+ rules). Custom ReDoS
+  detection rules are defined in `.semgrep.yml`. Findings are triaged on the
+  [Semgrep AppSec Platform](https://semgrep.dev) dashboard. False positives
+  and acceptable risks are annotated inline with `# nosemgrep: rule.id`.
+- [CodeFactor](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search) —
+  automated code review with RuboCop, Brakeman, bundler-audit, and duplication
+  checks.
+- [Dependabot](https://docs.github.com/en/code-security/dependabot) — weekly
+  checks for GitHub Actions version updates (SHA-pinned actions are kept
+  up to date automatically).
+
+All GitHub Actions are pinned to full 40-character commit SHAs with version
+comments to prevent supply-chain attacks via mutable tag repointing.
+
 Before enabling releases:
 
 1. Configure the GitHub repository as a RubyGems trusted publisher.

data/assets/client-search-base.js

@@ -58,48 +58,8 @@
                 return;
             }
 
-            var coreFields = [
-                "id", "title", "url", "excerpt", "content",
-                "categories", "tags", "categoriesText", "tagsText",
-                "date", "date_timestamp", "embedding"
-            ];
-
-            function normalize(entry) {
-                var id = entry.id || entry.url;
-                if (!id) {
-                    return null;
-                }
-                var categories = Array.isArray(entry.categories) ? entry.categories : [];
-                var tags = Array.isArray(entry.tags) ? entry.tags : [];
-                var normalized = {
-                    id: id,
-                    title: entry.title || "Untitled",
-                    url: entry.url || "#",
-                    excerpt: entry.excerpt || "",
-                    content: entry.content || "",
-                    date: entry.date || "",
-                    date_timestamp: Number(entry.date_timestamp) || 0,
-                    categories: categories,
-                    tags: tags,
-                    categoriesText: categories.join(" "),
-                    tagsText: tags.join(" ")
-                };
-                if (entry.source) {
-                    normalized.source = entry.source;
-                }
-                if (Array.isArray(entry.embedding) && entry.embedding.length > 0) {
-                    normalized.embedding = entry.embedding;
-                }
-                Object.keys(entry).forEach(function (key) {
-                    if (coreFields.indexOf(key) === -1 && key !== "source" && !(key in normalized)) {
-                        var value = entry[key];
-                        if (value !== null && value !== undefined && value !== "") {
-                            normalized[key] = value;
-                        }
-                    }
-                });
-                return normalized;
-            }
+            var normalize = window.ClientSearchShared.normalize;
+            var coreFields = window.ClientSearchShared.coreFields;
 
             function buildIndex(data) {
                 if (!Array.isArray(data)) {

data/assets/client-search-dropdown.js

@@ -41,39 +41,7 @@
         return key.replace(/_([a-z])/g, function (_, char) { return char.toUpperCase(); });
     }
 
-    function normalize(entry) {
-        var id = entry.id || entry.url;
-        if (!id) {
-            return null;
-        }
-        var categories = Array.isArray(entry.categories) ? entry.categories : [];
-        var tags = Array.isArray(entry.tags) ? entry.tags : [];
-        var normalized = {
-            id: id,
-            title: entry.title || "Untitled",
-            url: entry.url || "#",
-            excerpt: entry.excerpt || "",
-            content: entry.content || "",
-            date: entry.date || "",
-            date_timestamp: Number(entry.date_timestamp) || 0,
-            categories: categories,
-            tags: tags,
-            categoriesText: categories.join(" "),
-            tagsText: tags.join(" ")
-        };
-        if (entry.source) {
-            normalized.source = entry.source;
-        }
-        Object.keys(entry).forEach(function (key) {
-            if (!(key in normalized) && key !== "embedding") {
-                var value = entry[key];
-                if (value !== null && value !== undefined && value !== "") {
-                    normalized[key] = value;
-                }
-            }
-        });
-        return normalized;
-    }
+    var normalize = window.ClientSearchShared.normalize;
 
     function loadIndex(config) {
         if (sharedIndex && sharedDocuments) {

data/assets/client-search-shared.js

@@ -0,0 +1,57 @@
+(function () {
+    "use strict";
+
+    /**
+     * ClientSearch shared utilities — used by the base runtime and the
+     * dropdown runtime to normalize search index entries into a uniform
+     * document format.
+     *
+     * Loaded before client-search-base.js and client-search-dropdown.js.
+     * Exposes window.ClientSearchShared.normalize(entry).
+     */
+
+    var CORE_FIELDS = [
+        "id", "title", "url", "excerpt", "content",
+        "categories", "tags", "categoriesText", "tagsText",
+        "date", "date_timestamp", "embedding"
+    ];
+
+    function normalize(entry) {
+        var id = entry.id || entry.url;
+        if (!id) {
+            return null;
+        }
+        var categories = Array.isArray(entry.categories) ? entry.categories : [];
+        var tags = Array.isArray(entry.tags) ? entry.tags : [];
+        var normalized = {
+            id: id,
+            title: entry.title || "Untitled",
+            url: entry.url || "#",
+            excerpt: entry.excerpt || "",
+            content: entry.content || "",
+            date: entry.date || "",
+            date_timestamp: Number(entry.date_timestamp) || 0,
+            categories: categories,
+            tags: tags,
+            categoriesText: categories.join(" "),
+            tagsText: tags.join(" ")
+        };
+        if (entry.source) {
+            normalized.source = entry.source;
+        }
+        if (Array.isArray(entry.embedding) && entry.embedding.length > 0) {
+            normalized.embedding = entry.embedding;
+        }
+        Object.keys(entry).forEach(function (key) {
+            if (CORE_FIELDS.indexOf(key) === -1 && key !== "source" && !(key in normalized)) {
+                var value = entry[key];
+                if (value !== null && value !== undefined && value !== "") {
+                    normalized[key] = value;
+                }
+            }
+        });
+        return normalized;
+    }
+
+    window.ClientSearchShared = { normalize: normalize, coreFields: CORE_FIELDS };
+})();

data/lib/jekyll/client_search/configuration.rb

@@ -105,7 +105,7 @@ module Jekyll
       end
 
       def runtime_assets
-        assets = ["assets/client-search-base.js", "assets/adapters/#{engine}.js"]
+        assets = ["assets/client-search-shared.js", "assets/client-search-base.js", "assets/adapters/#{engine}.js"]
         assets.concat(query_embedder_assets) if engine == "semantic" && embedding_enabled?
         assets << "assets/client-search-related.js" if related_enabled?
         assets << "assets/client-search-dropdown.js" if dropdown_enabled?

data/lib/jekyll/client_search/dropdown_tag.rb

@@ -90,24 +90,30 @@ module Jekyll
 
       def build_scripts(configuration, prefix)
         scripts = []
-        engine = configuration.engine_url
-        if engine
-          attrs = ["src=\"#{CGI.escapeHTML(engine)}\""]
-          if configuration.engine_crossorigin
-            crossorigin = CGI.escapeHTML(configuration.engine_crossorigin)
-            attrs << "crossorigin=\"#{crossorigin}\""
-          end
-          if configuration.engine_sri
-            integrity = CGI.escapeHTML(configuration.engine_sri)
-            attrs << "integrity=\"#{integrity}\""
-          end
-          scripts << "<script #{attrs.join(' ')}></script>"
-        end
+        engine = engine_script(configuration)
+        scripts << engine if engine
         scripts << "<script src=\"#{prefix}/assets/search-runtime-config.js\"></script>"
+        scripts << "<script src=\"#{prefix}/assets/client-search-shared.js\"></script>"
         scripts << "<script src=\"#{prefix}/assets/client-search-dropdown.js\"></script>"
         scripts << "<script src=\"#{prefix}/assets/adapters/#{configuration.engine}.js\"></script>"
         scripts.map { |script| "  #{script}" }.join("\n")
       end
+
+      def engine_script(configuration)
+        url = configuration.engine_url
+        return nil unless url
+
+        attrs = ["src=\"#{CGI.escapeHTML(url)}\""]
+        if configuration.engine_crossorigin
+          crossorigin = CGI.escapeHTML(configuration.engine_crossorigin)
+          attrs << "crossorigin=\"#{crossorigin}\""
+        end
+        if configuration.engine_sri
+          integrity = CGI.escapeHTML(configuration.engine_sri)
+          attrs << "integrity=\"#{integrity}\""
+        end
+        "<script #{attrs.join(' ')}></script>"
+      end
     end
   end
 end

data/lib/jekyll/client_search/search_tag.rb

@@ -69,6 +69,7 @@ module Jekyll
         scripts << engine if engine
         scripts << "<script src=\"#{prefix}/assets/search-runtime-config.js\"></script>"
         scripts.concat(embedder_scripts(configuration, prefix))
+        scripts << "<script src=\"#{prefix}/assets/client-search-shared.js\"></script>"
         scripts << "<script src=\"#{prefix}/assets/client-search-base.js\"></script>"
         scripts << "<script src=\"#{prefix}/assets/adapters/#{configuration.engine}.js\"></script>"
         scripts.map { |script| "  #{script}" }.join("\n")

data/lib/jekyll/client_search/version.rb

@@ -2,6 +2,6 @@
 
 module Jekyll
   module ClientSearch
-    VERSION = "0.3.1"
+    VERSION = "0.3.3"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-client-search
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.3
 platform: ruby
 authors:
 - Svend Gundestrup
@@ -48,6 +48,7 @@ files:
 - assets/client-search-base.js
 - assets/client-search-dropdown.js
 - assets/client-search-related.js
+- assets/client-search-shared.js
 - assets/includes/related-articles.html
 - assets/layouts/post-with-related.html
 - assets/query-embedders/ollama-api.js