@blamejs/exceptd-skills 0.18.9 → 0.18.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. package/CHANGELOG.md +36 -0
  2. package/bin/exceptd.js +204 -118
  3. package/data/_indexes/_meta.json +3 -3
  4. package/data/_indexes/frequency.json +2 -2
  5. package/data/d3fend-catalog.json +6 -6
  6. package/data/playbooks/identity-sso-compromise.json +2 -2
  7. package/data/playbooks/sbom.json +1 -1
  8. package/lib/citation-resolve.js +11 -0
  9. package/lib/collectors/containers.js +13 -0
  10. package/lib/collectors/cred-stores.js +18 -9
  11. package/lib/collectors/secrets.js +4 -2
  12. package/lib/cross-ref-api.js +29 -7
  13. package/lib/cve-regression-watcher.js +47 -15
  14. package/lib/framework-gap.js +52 -19
  15. package/lib/gap-detectors.js +8 -3
  16. package/lib/lint-skills.js +3 -2
  17. package/lib/playbook-runner.js +125 -7
  18. package/lib/refresh-external.js +58 -7
  19. package/lib/refresh-network.js +18 -5
  20. package/lib/rfc-cli.js +113 -18
  21. package/lib/schemas/playbook.schema.json +1 -1
  22. package/lib/scoring.js +71 -8
  23. package/lib/source-advisories.js +58 -9
  24. package/lib/ttp-mapper.js +31 -3
  25. package/lib/upstream-check-cli.js +13 -1
  26. package/lib/validate-catalog-meta.js +51 -7
  27. package/lib/validate-cve-catalog.js +10 -0
  28. package/lib/validate-playbooks.js +19 -1
  29. package/lib/verify.js +35 -34
  30. package/lib/xml-tokenizer.js +187 -25
  31. package/manifest.json +53 -53
  32. package/orchestrator/dispatcher.js +53 -9
  33. package/orchestrator/index.js +9 -7
  34. package/orchestrator/pipeline.js +62 -14
  35. package/orchestrator/scanner.js +60 -9
  36. package/package.json +1 -1
  37. package/sbom.cdx.json +115 -100
  38. package/scripts/build-indexes.js +21 -3
  39. package/scripts/builders/cwe-chains.js +5 -2
  40. package/scripts/builders/section-offsets.js +17 -8
  41. package/scripts/builders/summary-cards.js +12 -4
  42. package/scripts/check-catalog-gap-budget.js +3 -3
  43. package/scripts/check-codebase-patterns-currency.js +1 -0
  44. package/scripts/check-codebase-patterns.js +166 -11
  45. package/scripts/check-sbom-currency.js +69 -3
  46. package/scripts/check-test-count.js +28 -16
  47. package/scripts/check-test-subjects.js +148 -0
  48. package/scripts/check-version-tags.js +24 -5
  49. package/scripts/predeploy.js +32 -8
  50. package/scripts/refresh-upstream-catalogs.js +169 -44
  51. package/scripts/release.js +28 -11
@@ -264,14 +264,14 @@ function cmdPrepare(opts) {
264
264
  // bootstrap-mode test enforces would otherwise fail at gates time.
265
265
  var top = _changelogTopVersion();
266
266
  if (top !== next) {
267
- console.error("");
268
- console.error("release: CHANGELOG.md top heading is '## " + top + "', expected '## " + next + "'.");
269
- console.error("Write the " + next + " entry first (terse, behavior-change framed, no internal");
270
- console.error("narrative), then re-run prepare. Example heading:");
271
- console.error("");
272
- console.error(" ## " + next + " — <YYYY-MM-DD>");
273
- console.error("");
274
- process.exit(2);
267
+ // Throw (not process.exit) so a stdout write earlier in this phase can't be
268
+ // truncated when piped, and so `release all` aborts the whole sequence here
269
+ // rather than continuing past a failed prepare. Matches the throw-style
270
+ // guards above (clean-tree / on-main); the dispatcher maps it to exit 1.
271
+ throw new Error(
272
+ "CHANGELOG.md top heading is '## " + top + "', expected '## " + next + "'. " +
273
+ "Write the " + next + " entry first (terse, behavior-change framed, no internal " +
274
+ "narrative), then re-run prepare. Example heading: ## " + next + " — <YYYY-MM-DD>");
275
275
  }
276
276
 
277
277
  // The `## <next>` heading exists; confirm the section extracts cleanly and
@@ -539,8 +539,25 @@ function cmdRelease() {
539
539
  var next = _readJsonVersion("package.json");
540
540
 
541
541
  _section("release workflow");
542
- var runId = _capture("gh", ["run", "list", "--workflow=release.yml", "--limit", "1",
543
- "--json", "databaseId", "--jq", ".[0].databaseId"]).stdout;
542
+ // Select the release.yml run created by THIS tag push — not merely the
543
+ // newest run. gh exposes the tag ref as headBranch for tag-triggered runs;
544
+ // event=="push" excludes workflow_dispatch runs. Filtering by headBranch==tag
545
+ // uniquely identifies this run even when a prior tag points at the same
546
+ // commit (so it's preferable to headSha matching, and needs no extra git
547
+ // call). Bounded retries cover the few-seconds window GitHub needs to
548
+ // register the run after the tag push.
549
+ var tag = "v" + next;
550
+ var runId = "";
551
+ for (var _i = 0; _i < 30 && !runId; _i++) {
552
+ runId = _capture("gh", ["run", "list", "--workflow=release.yml",
553
+ "--event=push", "--json", "databaseId,headBranch,event",
554
+ "--jq", '[.[] | select(.headBranch=="' + tag + '")] | sort_by(.databaseId) | last | .databaseId']).stdout;
555
+ if (!runId && _i < 29) {
556
+ // Short bounded wait between polls — the run usually appears within
557
+ // a few seconds of the tag push.
558
+ _spawn(process.execPath, ["-e", "setTimeout(function(){},2000)"], { stdio: "ignore" });
559
+ }
560
+ }
544
561
  if (runId) {
545
562
  _run("gh", ["run", "watch", runId, "--exit-status"], { allowFail: true });
546
563
  var concl = _capture("gh", ["run", "view", runId, "--json", "conclusion", "--jq", ".conclusion"]).stdout;
@@ -553,7 +570,7 @@ function cmdRelease() {
553
570
  }
554
571
  _ok("release.yml: success");
555
572
  } else {
556
- throw new Error("release: no release.yml run found for the tag — the publish workflow has not started; " +
573
+ throw new Error("release: no release.yml run found for " + tag + " — the publish workflow has not started; " +
557
574
  "confirm the tag was pushed and the workflow fired before treating the release as done");
558
575
  }
559
576