@birdapi/velinstyle 1.2.2 → 1.3.0

package/core/security/score/score.js

@@ -0,0 +1,102 @@
+/**
+ * Aggregate Security Engine findings into category scores + overall.
+ */
+
+const SEV_WEIGHT = { error: 18, warning: 8, info: 2 };
+
+/**
+ * @param {import('../registry.js').SecurityFinding[]} findings
+ */
+export function scoreFindings(findings) {
+  const byCat = {};
+  for (const f of findings) {
+    const cat = f.code || f.category || 'repo';
+    // findings carry rule category via ruleId prefix or explicit
+  }
+
+  const categories = {
+    supplyChain: { label: 'Supply Chain', findings: [] },
+    secrets: { label: 'Secrets', findings: [] },
+    dependencies: { label: 'Dependencies', findings: [] },
+    publish: { label: 'Publish', findings: [] },
+    ci: { label: 'CI', findings: [] },
+    workflows: { label: 'Workflows', findings: [] },
+    malware: { label: 'Malware', findings: [] },
+    repo: { label: 'Repository', findings: [] },
+    consumer: { label: 'Consumer', findings: [] },
+  };
+
+  for (const f of findings) {
+    const cat = mapFindingCategory(f);
+    if (!categories[cat]) categories[cat] = { label: cat, findings: [] };
+    categories[cat].findings.push(f);
+  }
+
+  /** @type {Record<string, { score: number, gate: string, label: string, count: number }>} */
+  const scores = {};
+  let totalDeduction = 0;
+  let errorCount = 0;
+
+  for (const [key, bucket] of Object.entries(categories)) {
+    let ded = 0;
+    for (const f of bucket.findings) {
+      ded += SEV_WEIGHT[f.severity] || 4;
+      if (f.severity === 'error') errorCount += 1;
+    }
+    ded = Math.min(100, ded);
+    const score = Math.max(0, 100 - ded);
+    const gate = gateFromFindings(bucket.findings);
+    if (key === 'malware' && bucket.findings.length === 0) {
+      scores[key] = {
+        score: null,
+        na: true,
+        gate: 'pass',
+        label: bucket.label,
+        count: 0,
+        note: 'no malware rules fired',
+      };
+    } else {
+      scores[key] = { score, gate, label: bucket.label, count: bucket.findings.length };
+      totalDeduction += ded * 0.12;
+    }
+  }
+
+  const securityScore = Math.max(0, Math.min(100, Math.round(100 - totalDeduction)));
+  const overallGate = errorCount > 0 ? 'fail' : Object.values(scores).some((s) => s.gate === 'warn') ? 'warn' : 'pass';
+  const overall = overallGate === 'fail' ? 'BLOCKED' : overallGate === 'warn' ? 'READY_WITH_WARNINGS' : 'READY';
+
+  return { securityScore, scores, overall, overallGate, findings };
+}
+
+function mapFindingCategory(f) {
+  if (f.category) {
+    if (f.category === 'deps') return 'dependencies';
+    if (f.category === 'ci') return 'ci';
+    if (f.category === 'secrets') return 'secrets';
+    if (f.category === 'publish') return 'publish';
+    if (f.category === 'malware') return 'malware';
+    if (f.category === 'consumer') return 'consumer';
+    if (f.category === 'repo') return 'repo';
+  }
+  const id = f.ruleId || '';
+  if (id.startsWith('secrets.') || id.startsWith('secret.')) return 'secrets';
+  if (id === 'deps.lifecycle-hooks' || id === 'deps.typosquat' || id.startsWith('malware.')) return 'malware';
+  if (id.startsWith('deps.') || id.startsWith('dependency.')) return 'dependencies';
+  if (id.startsWith('workflow.') || id.startsWith('ci.')) return 'ci';
+  if (id.startsWith('publish.') || id.startsWith('release.')) return 'publish';
+  if (id.startsWith('consumer.')) return 'consumer';
+  if (id.includes('supply') || id.startsWith('lockfile') || id.startsWith('lifecycle')) return 'supplyChain';
+  return 'repo';
+}
+
+function gateFromFindings(findings) {
+  if (findings.some((f) => f.severity === 'error')) return 'fail';
+  if (findings.some((f) => f.severity === 'warning')) return 'warn';
+  return 'pass';
+}
+
+export function gateLabel(gate) {
+  if (gate === 'fail') return 'FAIL';
+  if (gate === 'warn') return 'WARNING';
+  return 'PASS';
+}

package/core/security/timeline/timeline.js

@@ -0,0 +1,76 @@
+/**
+ * Security Timeline — local last-run stamps.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+
+const CATEGORIES = ['repository', 'dependencies', 'publish', 'ci', 'secrets', 'consumer', 'audit'];
+
+/**
+ * @param {string} root
+ */
+export function timelinePath(root) {
+  return join(root, '.velin', 'security', 'timeline.json');
+}
+
+/**
+ * @param {string} root
+ */
+export function loadTimeline(root) {
+  const p = timelinePath(root);
+  if (!existsSync(p)) {
+    return { version: 1, entries: {} };
+  }
+  try {
+    return JSON.parse(readFileSync(p, 'utf-8'));
+  } catch {
+    return { version: 1, entries: {} };
+  }
+}
+
+/**
+ * @param {string} root
+ * @param {string[]} categories
+ * @param {Date} [when]
+ */
+export function touchTimeline(root, categories, when = new Date()) {
+  const data = loadTimeline(root);
+  const iso = when.toISOString();
+  const dateLabel = when.toLocaleDateString('de-DE', { day: '2-digit', month: '2-digit', year: 'numeric' });
+  for (const c of categories) {
+    const key = normalizeCat(c);
+    data.entries[key] = { at: iso, label: dateLabel };
+  }
+  const p = timelinePath(root);
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, `${JSON.stringify(data, null, 2)}\n`, 'utf-8');
+  return data;
+}
+
+function normalizeCat(c) {
+  if (c === 'repo') return 'repository';
+  if (c === 'deps') return 'dependencies';
+  return c;
+}
+
+/**
+ * Rows for Experience / report.
+ * @param {ReturnType<typeof loadTimeline>} data
+ */
+export function timelineRows(data) {
+  const labels = {
+    repository: 'Repository geprüft',
+    dependencies: 'Dependencies geprüft',
+    publish: 'Publish geprüft',
+    ci: 'CI geprüft',
+    secrets: 'Secrets geprüft',
+    consumer: 'Consumer geprüft',
+    audit: 'Audit geprüft',
+  };
+  return CATEGORIES.filter((k) => data.entries?.[k]).map((k) => ({
+    key: k,
+    title: labels[k] || k,
+    date: data.entries[k].label || data.entries[k].at?.slice(0, 10),
+    at: data.entries[k].at,
+  }));
+}