@hawkeyexl/manni 4.3.1 → 4.4.1

package/dist/chunk-MMTSSTG7.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import {
+  displayPath
+} from "./chunk-PU6DFJMY.js";
+import {
+  escapeWorkflowCommandMessage,
+  escapeWorkflowCommandProperty
+} from "./chunk-MNH7QO4Z.js";
+
+// src/term/reporters/github.ts
+function renderFindingsGithub(report) {
+  return report.findings.map((finding) => {
+    const params = [`file=${escapeWorkflowCommandProperty(displayPath(finding.file, report.cwd))}`];
+    if (finding.line !== void 0) params.push(`line=${String(finding.line)}`);
+    params.push(`title=${escapeWorkflowCommandProperty(finding.ruleId)}`);
+    return `::${finding.severity} ${params.join(",")}::${escapeWorkflowCommandMessage(finding.message)}`;
+  }).join("\n");
+}
+
+export {
+  renderFindingsGithub
+};
+//# sourceMappingURL=chunk-MMTSSTG7.js.map

package/dist/chunk-MMTSSTG7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/term/reporters/github.ts"],"sourcesContent":["/**\n * GitHub workflow commands, one per reported finding:\n * `::error file=<file>,line=<n>,title=<ruleId>::<message>`, with `::warning`\n * and `::notice` for the lower levels. Uses meta's escapes. A clean run is the\n * empty string, which the CLI prints nothing for.\n */\nimport { escapeWorkflowCommandMessage, escapeWorkflowCommandProperty } from \"../../meta/internal.js\";\nimport type { TermReport } from \"../commands/findings.js\";\nimport { displayPath } from \"../commands/run.js\";\n\nexport function renderFindingsGithub(report: TermReport): string {\n  return report.findings\n    .map((finding) => {\n      const params = [`file=${escapeWorkflowCommandProperty(displayPath(finding.file, report.cwd))}`];\n      if (finding.line !== undefined) params.push(`line=${String(finding.line)}`);\n      params.push(`title=${escapeWorkflowCommandProperty(finding.ruleId)}`);\n      return `::${finding.severity} ${params.join(\",\")}::${escapeWorkflowCommandMessage(finding.message)}`;\n    })\n    .join(\"\\n\");\n}\n"],"mappings":";;;;;;;;;;AAUO,SAAS,qBAAqB,QAA4B;AAC/D,SAAO,OAAO,SACX,IAAI,CAAC,YAAY;AAChB,UAAM,SAAS,CAAC,QAAQ,8BAA8B,YAAY,QAAQ,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE;AAC9F,QAAI,QAAQ,SAAS,OAAW,QAAO,KAAK,QAAQ,OAAO,QAAQ,IAAI,CAAC,EAAE;AAC1E,WAAO,KAAK,SAAS,8BAA8B,QAAQ,MAAM,CAAC,EAAE;AACpE,WAAO,KAAK,QAAQ,QAAQ,IAAI,OAAO,KAAK,GAAG,CAAC,KAAK,6BAA6B,QAAQ,OAAO,CAAC;AAAA,EACpG,CAAC,EACA,KAAK,IAAI;AACd;","names":[]}

package/dist/chunk-MNH7QO4Z.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+
+// src/shared/github.ts
+function escapeWorkflowCommandMessage(message) {
+  return message.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+}
+function escapeWorkflowCommandProperty(value) {
+  return value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A").replace(/:/g, "%3A").replace(/,/g, "%2C");
+}
+
+export {
+  escapeWorkflowCommandMessage,
+  escapeWorkflowCommandProperty
+};
+//# sourceMappingURL=chunk-MNH7QO4Z.js.map

package/dist/chunk-MNH7QO4Z.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/github.ts"],"sourcesContent":["/**\n * GitHub Actions workflow-command primitives, shared by every renderer in\n * every tool that emits `::error ...::<message>`.\n *\n * Its own module rather than a local function so a second renderer cannot\n * re-derive the rule and get the ordering wrong — the ordering is the part that\n * is easy to miss. Under `src/shared/` because the a11y reporter needs the\n * same two functions, and one tool must not reach into another's internals.\n */\n\n/**\n * Escape a workflow command's **message**.\n *\n * `::error ...::<message>` is a line-oriented protocol: a literal newline ends\n * the command, so an unescaped multi-line message truncates the annotation and\n * spills the rest into the log as plain text. `%` is the escape introducer, so\n * an unescaped one corrupts the message the runner decodes. Ajv quotes a\n * schema's `pattern` regex verbatim, which is where a stray `%` comes from in\n * practice.\n *\n * `%` **must** be replaced first. Doing the newlines first would turn a literal\n * LF into `%0A` and then the `%` pass would rewrite that to `%250A`, so the\n * annotation would display the escape sequence as text instead of a line break.\n *\n * Only these three. GitHub also treats `,` and `:` specially, but in the\n * command's *property* values (`file=`, `line=`), not in the message — encoding\n * them here would show up as `%3A` in the rendered annotation. That is what\n * {@link escapeWorkflowCommandProperty} is for.\n *\n * @see https://docs.github.com/actions/reference/workflow-commands-for-github-actions\n */\nexport function escapeWorkflowCommandMessage(message: string): string {\n  return message\n    .replace(/%/g, \"%25\")\n    .replace(/\\r/g, \"%0D\")\n    .replace(/\\n/g, \"%0A\");\n}\n\n/**\n * Escape a workflow command's **property value** — the right-hand side of\n * `file=`, `line=`, `col=`.\n *\n * Everything the message needs, plus `,` and `:`. Properties are comma-\n * separated and each is `name:value`-adjacent in the grammar, so an unescaped\n * separator inside a value silently re-partitions the command: a real path like\n * `docs/report,final.md` yields `file=docs/report` and a stray property named\n * `final.md`, and the annotation lands on the wrong file — or nowhere — with no\n * error anywhere.\n *\n * `%` first, for the same reason as the message escaper.\n */\nexport function escapeWorkflowCommandProperty(value: string): string {\n  return value\n    .replace(/%/g, \"%25\")\n    .replace(/\\r/g, \"%0D\")\n    .replace(/\\n/g, \"%0A\")\n    .replace(/:/g, \"%3A\")\n    .replace(/,/g, \"%2C\");\n}\n"],"mappings":";;;AA+BO,SAAS,6BAA6B,SAAyB;AACpE,SAAO,QACJ,QAAQ,MAAM,KAAK,EACnB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK;AACzB;AAeO,SAAS,8BAA8B,OAAuB;AACnE,SAAO,MACJ,QAAQ,MAAM,KAAK,EACnB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,MAAM,KAAK,EACnB,QAAQ,MAAM,KAAK;AACxB;","names":[]}