@blamejs/exceptd-skills 0.18.9 → 0.18.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +36 -0
- package/bin/exceptd.js +204 -118
- package/data/_indexes/_meta.json +3 -3
- package/data/_indexes/frequency.json +2 -2
- package/data/d3fend-catalog.json +6 -6
- package/data/playbooks/identity-sso-compromise.json +2 -2
- package/data/playbooks/sbom.json +1 -1
- package/lib/citation-resolve.js +11 -0
- package/lib/collectors/containers.js +13 -0
- package/lib/collectors/cred-stores.js +18 -9
- package/lib/collectors/secrets.js +4 -2
- package/lib/cross-ref-api.js +29 -7
- package/lib/cve-regression-watcher.js +47 -15
- package/lib/framework-gap.js +52 -19
- package/lib/gap-detectors.js +8 -3
- package/lib/lint-skills.js +3 -2
- package/lib/playbook-runner.js +125 -7
- package/lib/refresh-external.js +58 -7
- package/lib/refresh-network.js +18 -5
- package/lib/rfc-cli.js +113 -18
- package/lib/schemas/playbook.schema.json +1 -1
- package/lib/scoring.js +71 -8
- package/lib/source-advisories.js +58 -9
- package/lib/ttp-mapper.js +31 -3
- package/lib/upstream-check-cli.js +13 -1
- package/lib/validate-catalog-meta.js +51 -7
- package/lib/validate-cve-catalog.js +10 -0
- package/lib/validate-playbooks.js +19 -1
- package/lib/verify.js +35 -34
- package/lib/xml-tokenizer.js +187 -25
- package/manifest.json +53 -53
- package/orchestrator/dispatcher.js +53 -9
- package/orchestrator/index.js +9 -7
- package/orchestrator/pipeline.js +62 -14
- package/orchestrator/scanner.js +60 -9
- package/package.json +1 -1
- package/sbom.cdx.json +115 -100
- package/scripts/build-indexes.js +21 -3
- package/scripts/builders/cwe-chains.js +5 -2
- package/scripts/builders/section-offsets.js +17 -8
- package/scripts/builders/summary-cards.js +12 -4
- package/scripts/check-catalog-gap-budget.js +3 -3
- package/scripts/check-codebase-patterns-currency.js +1 -0
- package/scripts/check-codebase-patterns.js +166 -11
- package/scripts/check-sbom-currency.js +69 -3
- package/scripts/check-test-count.js +28 -16
- package/scripts/check-test-subjects.js +148 -0
- package/scripts/check-version-tags.js +24 -5
- package/scripts/predeploy.js +32 -8
- package/scripts/refresh-upstream-catalogs.js +169 -44
- package/scripts/release.js +28 -11
package/scripts/release.js
CHANGED
|
@@ -264,14 +264,14 @@ function cmdPrepare(opts) {
|
|
|
264
264
|
// bootstrap-mode test enforces would otherwise fail at gates time.
|
|
265
265
|
var top = _changelogTopVersion();
|
|
266
266
|
if (top !== next) {
|
|
267
|
-
|
|
268
|
-
|
|
269
|
-
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
|
|
273
|
-
|
|
274
|
-
|
|
267
|
+
// Throw (not process.exit) so a stdout write earlier in this phase can't be
|
|
268
|
+
// truncated when piped, and so `release all` aborts the whole sequence here
|
|
269
|
+
// rather than continuing past a failed prepare. Matches the throw-style
|
|
270
|
+
// guards above (clean-tree / on-main); the dispatcher maps it to exit 1.
|
|
271
|
+
throw new Error(
|
|
272
|
+
"CHANGELOG.md top heading is '## " + top + "', expected '## " + next + "'. " +
|
|
273
|
+
"Write the " + next + " entry first (terse, behavior-change framed, no internal " +
|
|
274
|
+
"narrative), then re-run prepare. Example heading: ## " + next + " — <YYYY-MM-DD>");
|
|
275
275
|
}
|
|
276
276
|
|
|
277
277
|
// The `## <next>` heading exists; confirm the section extracts cleanly and
|
|
@@ -539,8 +539,25 @@ function cmdRelease() {
|
|
|
539
539
|
var next = _readJsonVersion("package.json");
|
|
540
540
|
|
|
541
541
|
_section("release workflow");
|
|
542
|
-
|
|
543
|
-
|
|
542
|
+
// Select the release.yml run created by THIS tag push — not merely the
|
|
543
|
+
// newest run. gh exposes the tag ref as headBranch for tag-triggered runs;
|
|
544
|
+
// event=="push" excludes workflow_dispatch runs. Filtering by headBranch==tag
|
|
545
|
+
// uniquely identifies this run even when a prior tag points at the same
|
|
546
|
+
// commit (so it's preferable to headSha matching, and needs no extra git
|
|
547
|
+
// call). Bounded retries cover the few-seconds window GitHub needs to
|
|
548
|
+
// register the run after the tag push.
|
|
549
|
+
var tag = "v" + next;
|
|
550
|
+
var runId = "";
|
|
551
|
+
for (var _i = 0; _i < 30 && !runId; _i++) {
|
|
552
|
+
runId = _capture("gh", ["run", "list", "--workflow=release.yml",
|
|
553
|
+
"--event=push", "--json", "databaseId,headBranch,event",
|
|
554
|
+
"--jq", '[.[] | select(.headBranch=="' + tag + '")] | sort_by(.databaseId) | last | .databaseId']).stdout;
|
|
555
|
+
if (!runId && _i < 29) {
|
|
556
|
+
// Short bounded wait between polls — the run usually appears within
|
|
557
|
+
// a few seconds of the tag push.
|
|
558
|
+
_spawn(process.execPath, ["-e", "setTimeout(function(){},2000)"], { stdio: "ignore" });
|
|
559
|
+
}
|
|
560
|
+
}
|
|
544
561
|
if (runId) {
|
|
545
562
|
_run("gh", ["run", "watch", runId, "--exit-status"], { allowFail: true });
|
|
546
563
|
var concl = _capture("gh", ["run", "view", runId, "--json", "conclusion", "--jq", ".conclusion"]).stdout;
|
|
@@ -553,7 +570,7 @@ function cmdRelease() {
|
|
|
553
570
|
}
|
|
554
571
|
_ok("release.yml: success");
|
|
555
572
|
} else {
|
|
556
|
-
throw new Error("release: no release.yml run found for
|
|
573
|
+
throw new Error("release: no release.yml run found for " + tag + " — the publish workflow has not started; " +
|
|
557
574
|
"confirm the tag was pushed and the workflow fired before treating the release as done");
|
|
558
575
|
}
|
|
559
576
|
|