@intentius/chant 0.54.0 → 0.54.1

package/dist/audit/discover.d.ts

@@ -63,6 +63,15 @@ export declare function ciLexiconForPath(path: string): AuditLexicon | undefined
 /**
  * Whether a path is worth reading/fetching at all. Bounds the local walk and,
  * crucially, the remote fetch (so we never pull a whole repo's contents).
+ *
+ * nginx configs (#1979) ride along the way `wrangler.toml` does: the NGX
+ * scanner (`./nginx.ts`) reads them directly, no lexicon plugin — but a
+ * scanner can only see what this filter admits, so its own path detector is
+ * part of the candidate set. (Found the hard way: the checks shipped wired
+ * into the CLI while no `.conf` ever survived collection, so they were
+ * unreachable on both the local and hosted paths.) Content confirmation —
+ * a `conf.d/` file that isn't nginx — happens at parse time in the scanner,
+ * never here.
  */
 export declare function isCandidatePath(path: string): boolean;
 /**

package/dist/audit/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/audit/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,cAAc,sGAAuG,CAAC;AAEnI;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,GAAE,SAAS,MAAM,EAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAe1G;AAgLD,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAKvE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQrD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;AAErD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAiBzF;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAehH;AA0BD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAiCtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAEvF;AAED,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAiB1D"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/audit/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAGvD,mEAAmE;AACnE,eAAO,MAAM,cAAc,sGAAuG,CAAC;AAEnI;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,GAAE,SAAS,MAAM,EAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAe1G;AAgLD,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAKvE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASrD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;AAErD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAiBzF;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAehH;AA0BD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAiCtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAEvF;AAED,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAiB1D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/discover.ts

@@ -33,6 +33,7 @@ import { basename, join, relative } from "path";
 import { parseYAML } from "../yaml";
 import type { LexiconPlugin } from "../lexicon";
 import type { AuditInput, AuditLexicon } from "./core";
+import { isNginxConfigPath } from "./nginx";
 
 /** Lexicons the auditor knows how to detect and run checks for. */
 export const AUDIT_LEXICONS = ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm", "fountain"] as const;
@@ -267,6 +268,15 @@ export function ciLexiconForPath(path: string): AuditLexicon | undefined {
 /**
  * Whether a path is worth reading/fetching at all. Bounds the local walk and,
  * crucially, the remote fetch (so we never pull a whole repo's contents).
+ *
+ * nginx configs (#1979) ride along the way `wrangler.toml` does: the NGX
+ * scanner (`./nginx.ts`) reads them directly, no lexicon plugin — but a
+ * scanner can only see what this filter admits, so its own path detector is
+ * part of the candidate set. (Found the hard way: the checks shipped wired
+ * into the CLI while no `.conf` ever survived collection, so they were
+ * unreachable on both the local and hosted paths.) Content confirmation —
+ * a `conf.d/` file that isn't nginx — happens at parse time in the scanner,
+ * never here.
  */
 export function isCandidatePath(path: string): boolean {
   const name = basename(path);
@@ -275,6 +285,7 @@ export function isCandidatePath(path: string): boolean {
   if (name === "Chart.yaml") return true;
   if (isSecretBearingName(name)) return true;
   if (isWranglerConfigName(name)) return true;
+  if (isNginxConfigPath(path)) return true;
   return /\.(ya?ml|json|template)$/i.test(name);
 }
 

package/src/cli/commands/audit.test.ts

@@ -614,3 +614,38 @@ describe("Wrangler config audit (#446)", () => {
     rmSync(dir, { recursive: true, force: true });
   });
 });
+
+describe("nginx config audit (#1979)", () => {
+  function tmpRepo(): string {
+    const dir = join(tmpdir(), `chant-audit-nginx-${process.pid}-${Math.random().toString(36).slice(2)}`);
+    mkdirSync(dir, { recursive: true });
+    return dir;
+  }
+
+  test("audits an nginx config end to end, even when no lexicon is installed", async () => {
+    // The whole-path proof the family shipped without: an nginx file must
+    // survive candidate COLLECTION (isCandidatePath) before the NGX scanner
+    // can ever see it — a scanner-level unit test cannot catch a filter that
+    // drops the file first.
+    const dir = tmpRepo();
+    mkdirSync(join(dir, "nginx"), { recursive: true });
+    writeFileSync(
+      join(dir, "nginx", "default.conf"),
+      "server {\n  listen 80;\n  location /files {\n    autoindex on;\n  }\n}\n",
+    );
+    const result = await auditCommand({ path: dir, plugins: [], format: "json" });
+    expect(result.status).toBe("no-lexicons"); // no lexicon installed — still not a clean miss
+    expect(result.findings.map((f) => f.checkId)).toContain("NGX003");
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("a systemd-style conf.d drop-in is collected but contributes nothing (content-confirmed)", async () => {
+    const dir = tmpRepo();
+    mkdirSync(join(dir, "conf.d"), { recursive: true });
+    writeFileSync(join(dir, "conf.d", "override.conf"), "[Service]\nRestart=always\n");
+    const result = await auditCommand({ path: dir, plugins: [] });
+    expect(result.success).toBe(true);
+    expect(result.findings.map((f) => f.checkId)).not.toEqual(expect.arrayContaining([expect.stringMatching(/^NGX/)]));
+    rmSync(dir, { recursive: true, force: true });
+  });
+});