@intentius/chant 0.54.1 → 0.54.2

package/dist/audit/secrets.d.ts

@@ -86,10 +86,7 @@ export declare const ENTROPY_RULE_ID = "SEC010";
  * trigger it.
  */
 export declare function looksLikeIdentifierSlug(value: string): boolean;
-/**
- * Scan a set of files for likely secrets/credentials. Pure with respect to
- * the filesystem and network. Findings never carry the matched value —
- * only its rule id, kind, file/line, and a redaction-safe fingerprint.
- */
+/** Is this a dependency lockfile the secrets scan should skip? */
+export declare function isLockfilePath(path: string): boolean;
 export declare function scanForSecrets(files: ScannableFile[], opts?: SecretsScanOptions): AuditFinding[];
 //# sourceMappingURL=secrets.d.ts.map

package/dist/audit/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/audit/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG3C,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC;CAC3B;AAOD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvD;AAkDD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAuBtE;AA2GD,2FAA2F;AAC3F,eAAO,MAAM,eAAe,WAAW,CAAC;AAIxC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK9D;AAsCD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,GAAE,kBAAuB,GAAG,YAAY,EAAE,CAkEpG"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/audit/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG3C,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC;CAC3B;AAOD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvD;AAkDD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAuBtE;AA2GD,2FAA2F;AAC3F,eAAO,MAAM,eAAe,WAAW,CAAC;AAIxC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK9D;AAqED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,GAAE,kBAAuB,GAAG,YAAY,EAAE,CAmEpG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.54.1",
+  "version": "0.54.2",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/secrets.test.ts

@@ -300,4 +300,19 @@ describe("scanForSecrets — file handling", () => {
     expect(findings[0].severity).toBe("error");
     expect(findings[0].lexicon).toBe("secrets");
   });
+
+  test("dependency lockfiles are skipped entirely — integrity hashes are not secrets", () => {
+    // The exact false-positive class that failed the first dogfooding repo:
+    // one lockfile's sha512 integrity fields read as hundreds of SEC010s.
+    const integrity = `"integrity": "sha512-${"a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8s9T0u1V2w3X4y5Z6".repeat(2)}"`;
+    for (const path of ["package-lock.json", "web/package-lock.json", "yarn.lock", "pnpm-lock.yaml", "Cargo.lock", "go.sum"]) {
+      expect(scanForSecrets([{ path, content: `${integrity}\n` }]), path).toEqual([]);
+    }
+    // Even a real credential shape stays silent there — the file is skipped,
+    // not entropy-tuned; a credential does not live in a machine-written
+    // lockfile, and per-file skipping is what keeps the rule explainable.
+    expect(scanForSecrets([{ path: "package-lock.json", content: `${FAKE_AWS_KEY}\n` }])).toEqual([]);
+    // A non-lockfile with the same content still fires.
+    expect(scanForSecrets([{ path: "config.json", content: `${integrity}\n` }]).length).toBeGreaterThan(0);
+  });
 });

package/src/audit/secrets.ts

@@ -337,6 +337,38 @@ function lineNumberFor(starts: number[], index: number): number {
  * the filesystem and network. Findings never carry the matched value —
  * only its rule id, kind, file/line, and a redaction-safe fingerprint.
  */
+/**
+ * Machine-generated dependency lockfiles. Skipped entirely: they are wall-to-
+ * wall content-integrity hashes (`sha512-…` and friends), which the entropy
+ * heuristic reads as hundreds of "possible secrets" per file — a single
+ * `package-lock.json` produced 438 merge-worthy SEC010 findings on the first
+ * repo that dogfooded this at `--fail-on merge-worthy`. Integrity hashes are
+ * public by construction, a credential does not live in a lockfile, and no
+ * other scanner reads them.
+ */
+const LOCKFILE_NAMES = new Set([
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "bun.lock",
+  "deno.lock",
+  "Cargo.lock",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "composer.lock",
+  "Gemfile.lock",
+  "go.sum",
+  "flake.lock",
+]);
+
+/** Is this a dependency lockfile the secrets scan should skip? */
+export function isLockfilePath(path: string): boolean {
+  const name = path.split("/").pop() ?? path;
+  return LOCKFILE_NAMES.has(name);
+}
+
 export function scanForSecrets(files: ScannableFile[], opts: SecretsScanOptions = {}): AuditFinding[] {
   const entropyThreshold = opts.entropyThreshold ?? DEFAULT_ENTROPY_THRESHOLD;
   const entropyMinLength = opts.entropyMinLength ?? DEFAULT_ENTROPY_MIN_LENGTH;
@@ -347,6 +379,7 @@ export function scanForSecrets(files: ScannableFile[], opts: SecretsScanOptions
 
   for (const file of files) {
     if (!file.content) continue;
+    if (isLockfilePath(file.path)) continue;
     const lines = file.content.split("\n");
     const starts = lineStarts(file.content);
     const claimed: Array<[number, number]> = [];