@decohere/ci-tools 0.0.1-dev.119 → 0.0.1-dev.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.119",
+  "version": "0.0.1-dev.12",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",
@@ -16,13 +16,12 @@
   "exports": {
     "./lib/svg": "./src/lib/svg.mjs",
     "./lib/lcov": "./src/lib/lcov.mjs",
-    "./lib/github-issue": "./src/lib/github-issue.mjs",
     "./coverage/badge": "./src/coverage/badge.mjs",
     "./coverage/report": "./src/coverage/report.mjs",
+    "./coverage/enforce-thresholds": "./src/coverage/enforce-thresholds.mjs",
     "./badges/ci-status": "./src/badges/ci-status.mjs",
     "./pages/artifact": "./src/pages/artifact.mjs",
     "./pages/smoke": "./src/pages/smoke.mjs",
-    "./audit/format": "./src/audit/format.mjs",
     "./audit/summarize": "./src/audit/summarize.mjs",
     "./audit/enforce": "./src/audit/enforce.mjs",
     "./audit/upsert-issue": "./src/audit/upsert-issue.mjs",
@@ -32,11 +31,7 @@
     "./changeset/check-status": "./src/changeset/check-status.mjs",
     "./github/create-issue": "./src/github/create-issue.mjs",
     "./github/ensure-metadata": "./src/github/ensure-metadata.mjs",
-    "./github/create-or-update-pr": "./src/github/create-or-update-pr.mjs",
-    "./github/publish-verify": "./src/github/publish-verify.mjs",
-    "./github/credential-nudge": "./src/github/credential-nudge.mjs",
-    "./github/oidc-bootstrap-nudge": "./src/github/oidc-bootstrap-nudge.mjs",
-    "./github/smoke-create-launcher": "./src/github/smoke-create-launcher.mjs"
+    "./github/create-or-update-pr": "./src/github/create-or-update-pr.mjs"
   },
   "scripts": {
     "test": "vitest run"

package/src/audit/enforce.mjs

@@ -1,5 +1,4 @@
 import { readFileSync } from "node:fs";
-import { formatLog, highCritical, parseAudit } from "./format.mjs";
 
 const auditFilePath = process.argv[2] ?? "npm-audit.json";
 
@@ -11,13 +10,12 @@ try {
 	process.exit(1);
 }
 
-const parsed = parseAudit(data);
-const blocking = highCritical(parsed);
+const vulnerabilities = data.metadata?.vulnerabilities ?? {};
+const high = vulnerabilities.high ?? 0;
+const critical = vulnerabilities.critical ?? 0;
 
-if (blocking.length > 0) {
-	console.error(
-		`Security gate failed: high=${parsed.high}, critical=${parsed.critical}\n${formatLog({ ...parsed, advisories: blocking })}`,
-	);
+if (high > 0 || critical > 0) {
+	console.error(`Security gate failed: high=${high}, critical=${critical}`);
 	process.exit(1);
 }
 

package/src/audit/summarize.mjs

@@ -1,24 +1,46 @@
 import { appendFileSync, readFileSync } from "node:fs";
-import { formatLog, formatMarkdown, parseAudit } from "./format.mjs";
 
 const auditFilePath = process.argv[2] ?? "npm-audit.json";
 
-function writeSummary(text) {
+function writeSummary(lines) {
+	const summaryText = `${lines.join("\n")}\n`;
 	if (process.env.GITHUB_STEP_SUMMARY) {
-		appendFileSync(process.env.GITHUB_STEP_SUMMARY, text);
+		appendFileSync(process.env.GITHUB_STEP_SUMMARY, summaryText);
+		return;
 	}
+	process.stdout.write(summaryText);
 }
 
 let data = null;
 try {
 	data = JSON.parse(readFileSync(auditFilePath, "utf8"));
 } catch {
-	const msg = `npm audit output could not be parsed (${auditFilePath}).\n`;
-	process.stderr.write(msg);
-	writeSummary(`## Security Audit\n\n- ${msg}`);
-	process.exit(1);
+	writeSummary([
+		"## Security Audit",
+		"",
+		"- npm audit output could not be parsed.",
+		`- See uploaded \`${auditFilePath}\` artifact for raw output.`,
+	]);
+	process.exit(0);
 }
 
-const parsed = parseAudit(data);
-process.stdout.write(formatLog(parsed));
-writeSummary(formatMarkdown(parsed));
+const vulnerabilities = data.metadata?.vulnerabilities ?? {};
+const info = vulnerabilities.info ?? 0;
+const low = vulnerabilities.low ?? 0;
+const moderate = vulnerabilities.moderate ?? 0;
+const high = vulnerabilities.high ?? 0;
+const critical = vulnerabilities.critical ?? 0;
+const total = vulnerabilities.total ?? info + low + moderate + high + critical;
+
+writeSummary([
+	"## Security Audit",
+	"",
+	`| Severity  | Count |`,
+	`|-----------|-------|`,
+	`| Critical  | ${critical} |`,
+	`| High      | ${high} |`,
+	`| Moderate  | ${moderate} |`,
+	`| Low       | ${low} |`,
+	`| Info      | ${info} |`,
+	`| **Total** | **${total}** |`,
+]);

package/src/audit/upsert-issue.mjs

@@ -1,19 +1,68 @@
-import { existsSync, readFileSync } from "node:fs";
-import { upsertIssue } from "../lib/github-issue.mjs";
-import { formatMarkdown, parseAudit } from "./format.mjs";
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
 
 const auditFilePath = process.argv[2] ?? "npm-audit.json";
 const ISSUE_TITLE = "security(ci): npm audit vulnerabilities detected";
 
-function runUrl() {
-	if (
-		process.env.GITHUB_SERVER_URL &&
-		process.env.GITHUB_REPOSITORY &&
-		process.env.GITHUB_RUN_ID
-	) {
-		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+function runGh(args) {
+	const result = spawnSync("gh", args, { encoding: "utf8", env: process.env });
+	if (result.status !== 0) {
+		throw new Error(result.stderr || result.stdout || `gh command failed: ${args.join(" ")}`);
 	}
-	return "(run URL unavailable)";
+	return result.stdout;
+}
+
+function readAuditSummary(filePath) {
+	const data = JSON.parse(readFileSync(filePath, "utf8"));
+	const vulnerabilities = data.metadata?.vulnerabilities ?? {};
+	const info = vulnerabilities.info ?? 0;
+	const low = vulnerabilities.low ?? 0;
+	const moderate = vulnerabilities.moderate ?? 0;
+	const high = vulnerabilities.high ?? 0;
+	const critical = vulnerabilities.critical ?? 0;
+	const total = vulnerabilities.total ?? info + low + moderate + high + critical;
+	return { total, critical, high, moderate, low, info };
+}
+
+function buildBody(summary) {
+	const runUrl =
+		process.env.GITHUB_SERVER_URL && process.env.GITHUB_REPOSITORY && process.env.GITHUB_RUN_ID
+			? `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`
+			: "(run URL unavailable)";
+	const sha = process.env.GITHUB_SHA ? process.env.GITHUB_SHA.slice(0, 12) : "unknown";
+
+	return [
+		"## npm audit detected vulnerabilities",
+		"",
+		`- Total: ${summary.total}`,
+		`- Critical: ${summary.critical}`,
+		`- High: ${summary.high}`,
+		`- Moderate: ${summary.moderate}`,
+		`- Low: ${summary.low}`,
+		`- Info: ${summary.info}`,
+		"",
+		`- Commit: ${sha}`,
+		`- Workflow run: ${runUrl}`,
+		"",
+		"This issue is managed by CI and will be updated on subsequent main-branch runs while vulnerabilities remain.",
+	].join("\n");
+}
+
+function findExistingIssueNumber() {
+	const output = runGh([
+		"issue",
+		"list",
+		"--state",
+		"open",
+		"--limit",
+		"200",
+		"--json",
+		"number,title",
+	]);
+	const issues = JSON.parse(output);
+	return issues.find((issue) => issue.title === ISSUE_TITLE)?.number ?? null;
 }
 
 if (!existsSync(auditFilePath)) {
@@ -21,21 +70,21 @@ if (!existsSync(auditFilePath)) {
 	process.exit(0);
 }
 
-const parsed = parseAudit(JSON.parse(readFileSync(auditFilePath, "utf8")));
-if (parsed.total === 0) {
+const summary = readAuditSummary(auditFilePath);
+if (summary.total === 0) {
 	console.log("No vulnerabilities found; skipping issue create/update.");
 	process.exit(0);
 }
 
-const sha = process.env.GITHUB_SHA ? process.env.GITHUB_SHA.slice(0, 12) : "unknown";
-const body = [
-	formatMarkdown(parsed).trim(),
-	"",
-	`- Commit: \`${sha}\``,
-	`- Workflow run: ${runUrl()}`,
-	"",
-	"This issue is managed by CI: main-branch runs and the nightly audit update it in place while vulnerabilities remain.",
-].join("\n");
-
-const result = upsertIssue({ title: ISSUE_TITLE, body });
-console.log(`${result.created ? "Opened" : "Updated"} issue #${result.number} ${result.url}`);
+const body = buildBody(summary);
+const tempFile = path.join(os.tmpdir(), `npm-audit-issue-${Date.now()}.md`);
+writeFileSync(tempFile, body, "utf8");
+
+const existingIssueNumber = findExistingIssueNumber();
+if (existingIssueNumber) {
+	runGh(["issue", "comment", String(existingIssueNumber), "--body-file", tempFile]);
+	console.log(`Updated existing issue #${existingIssueNumber}.`);
+} else {
+	runGh(["issue", "create", "--title", ISSUE_TITLE, "--body-file", tempFile]);
+	console.log("Created new npm audit tracking issue.");
+}