@greenarmor/ges-scanner-integration 0.6.0 → 0.6.2

package/dist/index.d.ts

@@ -4,10 +4,32 @@ export interface ScanResult {
     findings: number;
     output: string;
 }
-export declare function runNpmAudit(): ScanResult;
-export declare function runPnpmAudit(): ScanResult;
+export interface SbomResult {
+    scanner: string;
+    status: "generated" | "error" | "not-available";
+    format: string;
+    components: number;
+    output: string;
+}
+export type Ecosystem = "node" | "python" | "rust" | "go" | "ruby" | "java" | "php" | "dotnet" | "unknown";
+export type NodePackageManager = "pnpm" | "npm" | "yarn" | "bun";
+export type PythonToolchain = "pip" | "poetry" | "pipenv" | "pdm" | "uv";
+export interface ProjectDetection {
+    ecosystem: Ecosystem;
+    nodePackageManager?: NodePackageManager;
+    pythonToolchain?: PythonToolchain;
+}
+export declare function detectEcosystem(dir?: string): Ecosystem;
+export declare function detectProject(dir?: string): ProjectDetection;
 export declare function runTrivy(): ScanResult;
 export declare function runGitleaks(): ScanResult;
 export declare function runSemgrep(): ScanResult;
-export declare function runAllScans(): ScanResult[];
+export declare function runSyft(): ScanResult;
+export declare function runTrivySbom(): ScanResult;
+export declare function runGrype(): ScanResult;
+export declare function runDependencyAudit(detection: ProjectDetection): ScanResult;
+export declare function runAllScans(detection?: ProjectDetection): ScanResult[];
+export declare function runAllSbomScans(): ScanResult[];
+export declare function runAllScansWithSbom(detection?: ProjectDetection): ScanResult[];
 export declare function formatScanResults(results: ScanResult[]): string;
+export declare function formatSbomResults(results: ScanResult[]): string;

package/dist/index.js

@@ -1,9 +1,74 @@
 import { execSync } from "node:child_process";
-export function runNpmAudit() {
-    return runScan("npm audit", "npm audit", "--audit-level=high --json");
+import { existsSync } from "node:fs";
+const NODE_PM_MARKERS = [
+    { file: "pnpm-lock.yaml", pm: "pnpm" },
+    { file: "yarn.lock", pm: "yarn" },
+    { file: "bun.lockb", pm: "bun" },
+    { file: "package-lock.json", pm: "npm" },
+];
+const PYTHON_TOOLCHAIN_MARKERS = [
+    { file: "uv.lock", toolchain: "uv" },
+    { file: "pdm.lock", toolchain: "pdm" },
+    { file: "poetry.lock", toolchain: "poetry" },
+    { file: "Pipfile.lock", toolchain: "pipenv" },
+    { file: "requirements.txt", toolchain: "pip" },
+];
+export function detectEcosystem(dir = ".") {
+    return detectProject(dir).ecosystem;
 }
-export function runPnpmAudit() {
-    return runScan("pnpm audit", "pnpm audit", "--audit-level=high --json");
+export function detectProject(dir = ".") {
+    const detection = { ecosystem: "unknown" };
+    if (NODE_PM_MARKERS.some((m) => existsSync(`${dir}/${m.file}`)) || existsSync(`${dir}/package.json`)) {
+        detection.ecosystem = "node";
+        for (const marker of NODE_PM_MARKERS) {
+            if (existsSync(`${dir}/${marker.file}`)) {
+                detection.nodePackageManager = marker.pm;
+                break;
+            }
+        }
+        if (!detection.nodePackageManager && existsSync(`${dir}/package.json`)) {
+            detection.nodePackageManager = "npm";
+        }
+        return detection;
+    }
+    if (PYTHON_TOOLCHAIN_MARKERS.some((m) => existsSync(`${dir}/${m.file}`)) || existsSync(`${dir}/pyproject.toml`)) {
+        detection.ecosystem = "python";
+        for (const marker of PYTHON_TOOLCHAIN_MARKERS) {
+            if (existsSync(`${dir}/${marker.file}`)) {
+                detection.pythonToolchain = marker.toolchain;
+                break;
+            }
+        }
+        if (!detection.pythonToolchain) {
+            detection.pythonToolchain = "pip";
+        }
+        return detection;
+    }
+    if (existsSync(`${dir}/Cargo.toml`) || existsSync(`${dir}/Cargo.lock`)) {
+        detection.ecosystem = "rust";
+        return detection;
+    }
+    if (existsSync(`${dir}/go.mod`) || existsSync(`${dir}/go.sum`)) {
+        detection.ecosystem = "go";
+        return detection;
+    }
+    if (existsSync(`${dir}/Gemfile`) || existsSync(`${dir}/Gemfile.lock`)) {
+        detection.ecosystem = "ruby";
+        return detection;
+    }
+    if (existsSync(`${dir}/pom.xml`) || existsSync(`${dir}/build.gradle`) || existsSync(`${dir}/build.gradle.kts`) || existsSync(`${dir}/gradle.lockfile`)) {
+        detection.ecosystem = "java";
+        return detection;
+    }
+    if (existsSync(`${dir}/composer.json`) || existsSync(`${dir}/composer.lock`)) {
+        detection.ecosystem = "php";
+        return detection;
+    }
+    if (existsSync(`${dir}/packages.lock.json`) || existsSync(`${dir}/nuget.config`)) {
+        detection.ecosystem = "dotnet";
+        return detection;
+    }
+    return detection;
 }
 export function runTrivy() {
     return runScan("Trivy", "trivy", "fs --severity HIGH,CRITICAL .");
@@ -14,6 +79,102 @@ export function runGitleaks() {
 export function runSemgrep() {
     return runScan("Semgrep", "semgrep", "--config auto --json .");
 }
+export function runSyft() {
+    return runScan("Syft (SBOM)", "syft", ". -o cyclonedx-json");
+}
+export function runTrivySbom() {
+    return runScan("Trivy SBOM", "trivy", "sbom . --format cyclonedx-json");
+}
+export function runGrype() {
+    return runScan("Grype (SBOM scan)", "grype", "sbom:./sbom.json --fail-on high");
+}
+function getNodeAuditor(pm) {
+    const auditors = {
+        pnpm: { name: "pnpm audit", command: "pnpm", args: "audit --audit-level=high --json" },
+        npm: { name: "npm audit", command: "npm", args: "audit --audit-level=high --json" },
+        yarn: { name: "yarn audit", command: "yarn", args: "audit --level high --json" },
+        bun: { name: "bun audit", command: "bun", args: "audit --audit-level=high --json" },
+    };
+    if (pm && auditors[pm])
+        return auditors[pm];
+    return null;
+}
+function getPythonAuditor(toolchain) {
+    const auditors = {
+        pip: { name: "pip-audit", command: "pip-audit", args: "--format json" },
+        poetry: { name: "pip-audit", command: "pip-audit", args: "--format json" },
+        pipenv: { name: "pip-audit", command: "pip-audit", args: "--format json" },
+        pdm: { name: "pip-audit", command: "pip-audit", args: "--format json" },
+        uv: { name: "pip-audit", command: "pip-audit", args: "--format json" },
+    };
+    if (toolchain && auditors[toolchain])
+        return auditors[toolchain];
+    return null;
+}
+const UNIVERSAL_AUDITORS = {
+    node: [],
+    python: [],
+    rust: [{ name: "cargo audit", command: "cargo", args: "audit --json" }],
+    go: [{ name: "govulncheck", command: "govulncheck", args: "./..." }],
+    ruby: [{ name: "bundle-audit", command: "bundle-audit", args: "check --format json" }],
+    java: [{ name: "OWASP Dependency-Check", command: "dependency-check", args: "--scan . --format JSON --out /dev/null" }],
+    php: [{ name: "composer audit", command: "composer", args: "audit --format json" }],
+    dotnet: [{ name: "dotnet audit", command: "dotnet", args: "list package --vulnerable --include-transitive" }],
+    unknown: [],
+};
+export function runDependencyAudit(detection) {
+    let primary = null;
+    if (detection.ecosystem === "node") {
+        primary = getNodeAuditor(detection.nodePackageManager);
+    }
+    else if (detection.ecosystem === "python") {
+        primary = getPythonAuditor(detection.pythonToolchain);
+    }
+    if (primary) {
+        const result = runScan(primary.name, primary.command, primary.args);
+        if (result.status !== "not-available") {
+            return result;
+        }
+    }
+    const fallbacks = UNIVERSAL_AUDITORS[detection.ecosystem] || [];
+    for (const auditor of fallbacks) {
+        const result = runScan(auditor.name, auditor.command, auditor.args);
+        if (result.status !== "not-available") {
+            return result;
+        }
+    }
+    const tried = [primary, ...fallbacks].filter(Boolean).map((a) => a.name);
+    return {
+        scanner: "Dependency Audit",
+        status: "not-available",
+        findings: 0,
+        output: tried.length > 0
+            ? `Auditor not found: ${tried.join(", ")}`
+            : `No dependency auditor configured for ecosystem: ${detection.ecosystem}`,
+    };
+}
+export function runAllScans(detection) {
+    const detected = detection ?? detectProject();
+    return [
+        runDependencyAudit(detected),
+        runTrivy(),
+        runGitleaks(),
+        runSemgrep(),
+    ];
+}
+export function runAllSbomScans() {
+    return [
+        runSyft(),
+        runTrivySbom(),
+        runGrype(),
+    ];
+}
+export function runAllScansWithSbom(detection) {
+    return [
+        ...runAllScans(detection),
+        ...runAllSbomScans(),
+    ];
+}
 function runScan(name, command, args) {
     try {
         const output = execSync(`${command} ${args}`, {
@@ -46,19 +207,23 @@ function runScan(name, command, args) {
         };
     }
 }
-export function runAllScans() {
-    return [
-        runNpmAudit(),
-        runTrivy(),
-        runGitleaks(),
-        runSemgrep(),
-    ];
-}
 export function formatScanResults(results) {
     const lines = ["", "  Security Scan Results", "  -------------------"];
     for (const result of results) {
         const statusIcon = result.status === "pass" ? "PASS" : result.status === "fail" ? "FAIL" : result.status === "error" ? "ERROR" : "N/A";
-        lines.push(`  ${result.scanner.padEnd(20)} ${statusIcon}`);
+        lines.push(`  ${result.scanner.padEnd(28)} ${statusIcon}`);
+    }
+    lines.push("");
+    return lines.join("\n");
+}
+export function formatSbomResults(results) {
+    const sbomScanners = results.filter((r) => r.scanner.includes("SBOM") || r.scanner.includes("Syft") || r.scanner.includes("Grype"));
+    if (sbomScanners.length === 0)
+        return "";
+    const lines = ["", "  SBOM Scan Results", "  -----------------"];
+    for (const result of sbomScanners) {
+        const statusIcon = result.status === "pass" ? "GENERATED" : result.status === "fail" ? "FAIL" : result.status === "error" ? "ERROR" : "N/A";
+        lines.push(`  ${result.scanner.padEnd(28)} ${statusIcon}`);
     }
     lines.push("");
     return lines.join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@greenarmor/ges-scanner-integration",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "type": "module",
   "description": "GESF Scanner Integration - Trivy, Gitleaks, Semgrep, npm audit",
   "main": "./dist/index.js",
@@ -12,7 +12,7 @@
     }
   },
   "dependencies": {
-    "@greenarmor/ges-core": "0.6.0"
+    "@greenarmor/ges-core": "0.6.2"
   },
   "devDependencies": {
     "typescript": "^6.0.0",