@cupel-sh/cli 0.11.0 → 0.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +32 -0
- package/bundle/cli.js +76 -61
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -33,6 +33,7 @@ cupel could enumerate for the packages it could see.
|
|
|
33
33
|
```
|
|
34
34
|
cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>]
|
|
35
35
|
[--fail-on-reachable] [--fail-on-potentially-reachable]
|
|
36
|
+
[--exclude <pattern>]
|
|
36
37
|
```
|
|
37
38
|
|
|
38
39
|
| Flag | Effect |
|
|
@@ -41,12 +42,43 @@ cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>]
|
|
|
41
42
|
| `--sarif` | also write a SARIF 2.1.0 report |
|
|
42
43
|
| `--fail-on-reachable` | exit 2 when any reachable finding is present |
|
|
43
44
|
| `--fail-on-potentially-reachable` | exit 2 when any potentially reachable finding is present |
|
|
45
|
+
| `--exclude <pattern>` | leave matching files out of the file count (repeatable) |
|
|
44
46
|
|
|
45
47
|
`--fail-on-unknown`, the old name of `--fail-on-potentially-reachable`, still
|
|
46
48
|
works and prints a warning. It will be removed in the next major version.
|
|
47
49
|
|
|
48
50
|
Requires Node 22 or newer.
|
|
49
51
|
|
|
52
|
+
## Coverage
|
|
53
|
+
|
|
54
|
+
Every scan counts the source files in the repository by language and says how
|
|
55
|
+
many it scanned, how many an entrypoint reaches, and what happened to each of
|
|
56
|
+
the rest:
|
|
57
|
+
|
|
58
|
+
```
|
|
59
|
+
📂 Source files: 142 · 97.6% scanned · 64 reached from an entrypoint
|
|
60
|
+
JavaScript and TypeScript: 128 files · 100% scanned · 64 reached · 12 excluded
|
|
61
|
+
Python: 14 files · 78.5% scanned · 0 reached · 3 failed
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
A file that could not be scanned is listed with its reason: not UTF-8, over the
|
|
65
|
+
size cap, a syntax error, a symlink loop, and so on. The SARIF report carries
|
|
66
|
+
every one of them.
|
|
67
|
+
|
|
68
|
+
The count follows `.gitignore`, `.git/info/exclude` and git's global excludes
|
|
69
|
+
file, with or without git installed. A file git tracks is counted even when an
|
|
70
|
+
ignore pattern matches it. Dependency and build directories (`node_modules`,
|
|
71
|
+
`dist`, `.venv`, …) are left out. To leave out more, list patterns in a
|
|
72
|
+
`.cupelignore` file (gitignore syntax) or pass `--exclude`. Other tools' ignore
|
|
73
|
+
files, such as `.eslintignore` or `.dockerignore`, are not read.
|
|
74
|
+
|
|
75
|
+
`.vue`, `.svelte` and `.astro` files are read: their scripts, an Astro page's
|
|
76
|
+
frontmatter and client scripts, and their templates. A call a template makes is
|
|
77
|
+
found like any other. A component cupel cannot read in full (a component with no
|
|
78
|
+
import, a custom directive, a template in another language) is named in the
|
|
79
|
+
report, and nothing is ruled out through it.
|
|
80
|
+
Go and Rust files are counted as not scanned until cupel reads them.
|
|
81
|
+
|
|
50
82
|
## Signing in
|
|
51
83
|
|
|
52
84
|
A scan needs an advisory database. **On GitHub Actions there is nothing to set
|