@cejel/cejel 0.5.0 → 0.6.0

package/README.md

@@ -92,7 +92,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.5.0 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.6.0 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -115,8 +115,9 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.5.0` is the coordinated release version for npm,
-> standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
+> **Distribution note:** Cejel `0.6.0` is the coordinated release version for npm,
+> standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry. A GitLab CI
+> template and Code Quality export live in [`docs/gitlab-ci.md`](./docs/gitlab-ci.md).
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
 specifier above, and check the version that will run before comparing certificates:
@@ -177,16 +178,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.5.0`:
+**Docker / OCI.** The current container release is `0.6.0`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.5.0
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.0
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.5.0 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.0 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -516,7 +517,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.5.0"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.0"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 

package/dist/index.js

@@ -34,7 +34,7 @@ import {
 
 // src/index.ts
 init_esm_shims();
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "fs";
 import { dirname, join, resolve } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
@@ -372,7 +372,7 @@ function verifyWitanIssuanceSignature(options) {
       reason: `key type ${JSON.stringify(parsed.keyType)} is not one this build verifies (supported: ${WITAN_ISSUANCE_SUPPORTED_KEY_TYPES.join(", ")}); verify with OpenSSH instead \u2014 see docs/issuance.md`
     };
   }
-  const fingerprint = sshPublicKeyFingerprint(parsed.publicKeyBlob);
+  const fingerprint2 = sshPublicKeyFingerprint(parsed.publicKeyBlob);
   let signatureVerified;
   try {
     const publicKey = ed25519PublicKeyFromBlob(parsed.publicKeyBlob);
@@ -407,16 +407,16 @@ function verifyWitanIssuanceSignature(options) {
     return { status: "invalid", reason: error instanceof Error ? error.message : String(error) };
   }
   if (signers.length === 0) {
-    return { status: "unlisted_key", keyType: parsed.keyType, fingerprint };
+    return { status: "unlisted_key", keyType: parsed.keyType, fingerprint: fingerprint2 };
   }
   const signedKeyBase64 = parsed.publicKeyBlob.toString("base64");
   const listed = signers.some(
     (entry) => entry.uninterpretedOptions === void 0 && entry.keyType === parsed.keyType && normalizeBase64(entry.keyBase64) === signedKeyBase64 && entry.principals.includes(expectedPrincipal) && (entry.namespaces === void 0 || entry.namespaces.includes(expectedNamespace))
   );
   if (!listed) {
-    return { status: "unlisted_key", keyType: parsed.keyType, fingerprint };
+    return { status: "unlisted_key", keyType: parsed.keyType, fingerprint: fingerprint2 };
   }
-  return { status: "valid", principal: expectedPrincipal, keyType: parsed.keyType, fingerprint };
+  return { status: "valid", principal: expectedPrincipal, keyType: parsed.keyType, fingerprint: fingerprint2 };
 }
 function normalizeBase64(value) {
   return Buffer.from(value, "base64").toString("base64");
@@ -470,6 +470,71 @@ function parseIssuerPublicKey(contents) {
   return { keyType, keyBase64, fingerprint: sshPublicKeyFingerprint(blob) };
 }
 
+// src/export/gitlab-codequality.ts
+init_esm_shims();
+import { createHash as createHash2 } from "crypto";
+var GITLAB_CODEQUALITY_SEVERITY = {
+  critical: "critical",
+  warning: "major",
+  info: "info"
+};
+function normalizeRepoRelativePath(raw) {
+  let path = raw.replaceAll("\\", "/");
+  while (path.startsWith("./")) path = path.slice(2);
+  if (path.length === 0 || path.startsWith("/") || /^[A-Za-z]:/.test(path)) return void 0;
+  if (path.split("/").some((segment) => segment === ".." || segment === "")) return void 0;
+  return path;
+}
+function fingerprint(rule, path, line, identity) {
+  return createHash2("sha256").update(JSON.stringify([rule, path, line, identity])).digest("hex");
+}
+function exportGitLabCodeQuality(report) {
+  const ingestedCount = (report.consumedSignals ?? []).reduce(
+    (total, signal) => total + signal.findings.length,
+    0
+  );
+  if (report.verdict === "insufficient_source") {
+    return {
+      entries: [],
+      excludedUnlocated: 0,
+      excludedIngested: ingestedCount,
+      abstainedReason: report.insufficientSourceReason
+    };
+  }
+  const entries = [];
+  let excludedUnlocated = 0;
+  const seen = /* @__PURE__ */ new Set();
+  for (const criterion of report.criteria) {
+    for (const finding of criterion.findings) {
+      const path = finding.evidence.path === void 0 ? void 0 : normalizeRepoRelativePath(finding.evidence.path);
+      const line = finding.evidence.line;
+      if (path === void 0 || line == null) {
+        excludedUnlocated += 1;
+        continue;
+      }
+      const print = fingerprint(criterion.id, path, line, finding.summary);
+      if (seen.has(print)) continue;
+      seen.add(print);
+      entries.push({
+        description: finding.summary,
+        check_name: criterion.id,
+        fingerprint: print,
+        location: { path, lines: { begin: line } },
+        severity: GITLAB_CODEQUALITY_SEVERITY[finding.severity]
+      });
+    }
+  }
+  return { entries, excludedUnlocated, excludedIngested: ingestedCount };
+}
+function renderGitLabCodeQualityFooter(result) {
+  if (result.abstainedReason !== void 0) {
+    return `Cejel: abstained report (insufficient_source): exported 0 entries. ${result.abstainedReason}
+`;
+  }
+  return `Cejel: exported ${result.entries.length} located finding(s); ${result.excludedUnlocated} without a file and line excluded; ${result.excludedIngested} ingested third-party finding(s) not exported.
+`;
+}
+
 // src/terminal.ts
 init_esm_shims();
 function renderMinScoreAbstentionFailure(summary, minScore) {
@@ -739,12 +804,14 @@ Usage:
   npx ${NPX_PACKAGE_NAME} [path] [options]
   npx ${NPX_PACKAGE_NAME} scan [path] [options]
   npx ${NPX_PACKAGE_NAME} verify <report.json> <attestation.json> [issuance.json issuance.json.sig]
+  npx ${NPX_PACKAGE_NAME} export gitlab-codequality <report.json> [-o gl-code-quality-report.json]
   npx ${NPX_PACKAGE_NAME} issue [path] --report <report.json> --attestation <attestation.json> --key <key.pub> --engagement-ref <ref>
 
 Commands:
   scan    score a repository (default when the command is omitted)
   verify  verify the report/attestation binding; with an issuance pair, also check the issuer
           signature against docs/security/${ISSUER_SIGNERS_FILE} and docs/security/${ISSUER_REVOCATIONS_FILE}
+  export  write report.json's located findings as a GitLab Code Quality report (offline)
   issue   re-run this version at the certificate's revision and, only if report.json reproduces
           byte for byte, write an unsigned issuance.json for the issuer to sign through ssh-agent
 
@@ -789,6 +856,9 @@ async function runWitanCli(args, rubricVersion) {
   if (invocation.command === "issue") {
     return runIssue(invocation.options);
   }
+  if (invocation.command === "export") {
+    return runExport(invocation);
+  }
   const options = invocation.options;
   if (options.showVersion) {
     process.stdout.write(`${cliVersion()}
@@ -890,6 +960,13 @@ function parseCliInvocation(args) {
     }
     return parseVerifyArgs(verifyArgs);
   }
+  if (command === "export") {
+    const exportArgs = args.slice(1);
+    if (exportArgs.some((arg) => arg === "-h" || arg === "--help")) {
+      return { command: "scan", options: parseArgs(["--help"]) };
+    }
+    return parseExportArgs(exportArgs);
+  }
   if (command === "issue") {
     const issueArgs = args.slice(1);
     if (issueArgs.some((arg) => arg === "-h" || arg === "--help")) {
@@ -902,6 +979,54 @@ function parseCliInvocation(args) {
   }
   return { command: "scan", options: parseArgs(args) };
 }
+var EXPORT_USAGE = () => `Usage: npx ${NPX_PACKAGE_NAME} export gitlab-codequality <report.json> [-o gl-code-quality-report.json]`;
+function parseExportArgs(args) {
+  const [format, ...rest] = args;
+  if (format !== "gitlab-codequality") throw new Error(EXPORT_USAGE());
+  const positionals = [];
+  let outPath = "gl-code-quality-report.json";
+  for (let index = 0; index < rest.length; index += 1) {
+    const arg = rest[index];
+    if (arg === void 0) continue;
+    if (arg === "-o" || arg === "--out") {
+      const value = rest[index + 1];
+      if (!value) throw new Error(`Missing value for ${arg}`);
+      outPath = value;
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("-")) throw new Error(`Unknown Cejel export flag: ${arg}`);
+    positionals.push(arg);
+  }
+  const [reportPath] = positionals;
+  if (positionals.length !== 1 || !reportPath) throw new Error(EXPORT_USAGE());
+  return {
+    command: "export",
+    format,
+    reportPath: resolve(reportPath),
+    outPath: resolve(outPath)
+  };
+}
+function runExport(invocation) {
+  const reportArtifact = readJsonArtifact(invocation.reportPath, "report");
+  const reportResult = WitanReportSchema.safeParse(reportArtifact.value);
+  if (!reportResult.success) {
+    const members = reportResult.error.issues.map(
+      (issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`
+    );
+    process.stderr.write(
+      `Cejel: report validation failed:
+${members.map((member) => `  - ${member}`).join("\n")}
+`
+    );
+    return 1;
+  }
+  const result = exportGitLabCodeQuality(reportResult.data);
+  writeFileSync(invocation.outPath, `${JSON.stringify(result.entries, null, 2)}
+`, "utf8");
+  process.stderr.write(renderGitLabCodeQualityFooter(result));
+  return 0;
+}
 var VERIFY_USAGE = () => `Usage: npx ${NPX_PACKAGE_NAME} verify <report.json> <attestation.json> [issuance.json issuance.json.sig] [--signers <file>] [--revocations <file>]`;
 function parseVerifyArgs(args) {
   const positionals = [];
@@ -1043,7 +1168,7 @@ ${members.map((member) => `  - ${member}`).join("\n")}
     return 1;
   }
   const statement = readJsonArtifact(invocation.attestationPath, "attestation");
-  const reportSha256 = createHash2("sha256").update(reportArtifact.contents).digest("hex");
+  const reportSha256 = createHash3("sha256").update(reportArtifact.contents).digest("hex");
   const result = verifyWitanAttestationBinding(statement.value, reportResult.data, {
     reportSha256
   });
@@ -1060,7 +1185,7 @@ ${result.errors.map((error) => `  - ${error}`).join("\n")}
     process.stdout.write("Cejel: signature and signer identity were not verified.\n");
     return 0;
   }
-  const attestationSha256 = createHash2("sha256").update(statement.contents).digest("hex");
+  const attestationSha256 = createHash3("sha256").update(statement.contents).digest("hex");
   return runVerifyIssuance(invocation, {
     reportSha256,
     attestationSha256,
@@ -1163,8 +1288,8 @@ ${members.map((member) => `  - ${member}`).join("\n")}
   }
   const suppliedReport = reportResult.data;
   const attestationArtifact = readJsonArtifact(options.attestationPath, "attestation");
-  const reportSha256 = createHash2("sha256").update(reportArtifact.contents).digest("hex");
-  const attestationSha256 = createHash2("sha256").update(attestationArtifact.contents).digest("hex");
+  const reportSha256 = createHash3("sha256").update(reportArtifact.contents).digest("hex");
+  const attestationSha256 = createHash3("sha256").update(attestationArtifact.contents).digest("hex");
   const attestationBinding = verifyWitanAttestationBinding(
     attestationArtifact.value,
     suppliedReport,
@@ -1196,7 +1321,7 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     toolVersion: cliVersion()
   });
   const reproducedBytes = serializeWitanReport(reproduction.report);
-  const reproducedSha256 = createHash2("sha256").update(reproducedBytes, "utf8").digest("hex");
+  const reproducedSha256 = createHash3("sha256").update(reproducedBytes, "utf8").digest("hex");
   if (reproducedSha256 !== reportSha256) {
     process.stderr.write(
       [
@@ -1417,6 +1542,7 @@ export {
   WitanReportSchema,
   parseArgs,
   parseCliInvocation,
+  parseExportArgs,
   parseIssueArgs,
   parseVerifyArgs,
   runWitanFreeCli,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {