@kevinrabun/judges-cli 3.124.0

package/dist/commands/upload.js

@@ -0,0 +1,172 @@
+/**
+ * `judges upload` — Upload SARIF results to GitHub Code Scanning.
+ *
+ * Pushes evaluation results directly to GitHub's Code Scanning API,
+ * making findings visible in the Security tab without needing
+ * github/codeql-action/upload-sarif in CI.
+ *
+ * Usage:
+ *   judges upload results.sarif.json                   Upload SARIF file
+ *   judges upload --file results.json --repo owner/repo  Convert + upload
+ *   judges upload --ref refs/heads/main --sha abc123     Specify git ref
+ */
+import { existsSync, readFileSync } from "fs";
+import { execSync } from "child_process";
+import { resolve, basename } from "path";
+import { gzipSync } from "zlib";
+// ─── Git Helpers ────────────────────────────────────────────────────────────
+function detectGitRef() {
+    try {
+        const branch = execSync("git rev-parse --abbrev-ref HEAD", { encoding: "utf-8" }).trim();
+        return `refs/heads/${branch}`;
+    }
+    catch {
+        return "refs/heads/main";
+    }
+}
+function detectGitSha() {
+    try {
+        return execSync("git rev-parse HEAD", { encoding: "utf-8" }).trim();
+    }
+    catch {
+        return "";
+    }
+}
+function detectRepo() {
+    try {
+        const remote = execSync("git remote get-url origin", { encoding: "utf-8" }).trim();
+        const match = remote.match(/github\.com[/:]([^/]+\/[^/.]+)/);
+        return match?.[1]?.replace(/\.git$/, "") || "";
+    }
+    catch {
+        return "";
+    }
+}
+// ─── Upload ────────────────────────────────────────────────────────────────
+async function uploadSarif(options) {
+    const { sarifPath, repo, ref, commitSha, token } = options;
+    if (!existsSync(sarifPath)) {
+        return { success: false, error: `File not found: ${sarifPath}` };
+    }
+    const sarifContent = readFileSync(sarifPath, "utf-8");
+    // Validate it's valid JSON
+    try {
+        JSON.parse(sarifContent);
+    }
+    catch {
+        return { success: false, error: "Invalid JSON in SARIF file" };
+    }
+    // GitHub requires gzip + base64 encoding
+    const compressed = gzipSync(Buffer.from(sarifContent, "utf-8"));
+    const encoded = compressed.toString("base64");
+    const apiUrl = `https://api.github.com/repos/${repo}/code-scanning/sarifs`;
+    const body = JSON.stringify({
+        commit_sha: commitSha,
+        ref,
+        sarif: encoded,
+        tool_name: "Judges Panel",
+    });
+    try {
+        const response = await fetch(apiUrl, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: "application/vnd.github+json",
+                "Content-Type": "application/json",
+                "X-GitHub-Api-Version": "2022-11-28",
+            },
+            body,
+        });
+        if (response.ok || response.status === 202) {
+            const data = (await response.json());
+            return {
+                success: true,
+                id: data.id,
+                url: data.url,
+            };
+        }
+        const errorData = (await response.json().catch(() => ({})));
+        return {
+            success: false,
+            error: `GitHub API ${response.status}: ${errorData.message || response.statusText}`,
+        };
+    }
+    catch (err) {
+        return {
+            success: false,
+            error: `Upload failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+// ─── CLI Runner ─────────────────────────────────────────────────────────────
+export async function runUpload(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges upload — Upload SARIF results to GitHub Code Scanning
+
+Usage:
+  judges upload <sarif-file>                 Upload SARIF file
+  judges upload --file <sarif-file>          Upload SARIF file (alternate)
+  judges upload --repo <owner/repo>          Specify target repository
+  judges upload --ref <git-ref>              Git ref (default: current branch)
+  judges upload --sha <commit-sha>           Git commit SHA (default: HEAD)
+  judges upload --token <github-token>       GitHub token (default: GITHUB_TOKEN env)
+
+The SARIF file is gzipped and base64-encoded before upload, as required by
+the GitHub Code Scanning API.
+
+Environment Variables:
+  GITHUB_TOKEN                               GitHub API token with security_events scope
+
+Options:
+  --file <path>          Path to SARIF file
+  --repo <owner/repo>    GitHub repository (auto-detected from git remote)
+  --ref <ref>            Git ref (auto-detected from current branch)
+  --sha <sha>            Commit SHA (auto-detected from HEAD)
+  --token <token>        GitHub token (or set GITHUB_TOKEN env var)
+  --help, -h             Show this help
+`);
+        return;
+    }
+    // Parse args
+    const sarifPath = resolve(argv.find((_a, i) => argv[i - 1] === "--file") ||
+        argv.find((a, i) => i > 1 && !a.startsWith("-") && a.endsWith(".json")) ||
+        "");
+    if (!sarifPath || !existsSync(sarifPath)) {
+        console.error("\n  Error: Please provide a SARIF file path.\n");
+        console.error("  Usage: judges upload <sarif-file>\n");
+        process.exit(1);
+    }
+    const repo = argv.find((_a, i) => argv[i - 1] === "--repo") || detectRepo();
+    const ref = argv.find((_a, i) => argv[i - 1] === "--ref") || detectGitRef();
+    const commitSha = argv.find((_a, i) => argv[i - 1] === "--sha") || detectGitSha();
+    const token = argv.find((_a, i) => argv[i - 1] === "--token") || process.env.GITHUB_TOKEN || "";
+    if (!repo) {
+        console.error("\n  Error: Could not detect repository. Use --repo owner/repo\n");
+        process.exit(1);
+    }
+    if (!commitSha) {
+        console.error("\n  Error: Could not detect commit SHA. Use --sha <sha>\n");
+        process.exit(1);
+    }
+    if (!token) {
+        console.error("\n  Error: No GitHub token found. Set GITHUB_TOKEN env var or use --token\n");
+        process.exit(1);
+    }
+    console.log(`\n  Uploading SARIF to GitHub Code Scanning...`);
+    console.log(`  Repository: ${repo}`);
+    console.log(`  Ref: ${ref}`);
+    console.log(`  Commit: ${commitSha.slice(0, 7)}`);
+    console.log(`  File: ${basename(sarifPath)}\n`);
+    const result = await uploadSarif({ sarifPath, repo, ref, commitSha, token });
+    if (result.success) {
+        console.log("  ✅ SARIF uploaded successfully.");
+        if (result.id)
+            console.log(`  Analysis ID: ${result.id}`);
+        console.log(`  View results: https://github.com/${repo}/security/code-scanning\n`);
+    }
+    else {
+        console.error(`  ❌ Upload failed: ${result.error}\n`);
+        process.exit(1);
+    }
+}

package/dist/commands/validate-config.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Config validation — validate .judgesrc against the JSON schema
+ * and report errors with line numbers and fix suggestions.
+ */
+export interface ValidationError {
+    path: string;
+    message: string;
+    suggestion?: string;
+}
+export interface ValidationResult {
+    valid: boolean;
+    errors: ValidationError[];
+    warnings: ValidationError[];
+}
+export declare function validateConfig(config: Record<string, unknown>): ValidationResult;
+export declare function runValidateConfig(argv: string[]): void;

package/dist/commands/validate-config.js

@@ -0,0 +1,267 @@
+/**
+ * Config validation — validate .judgesrc against the JSON schema
+ * and report errors with line numbers and fix suggestions.
+ */
+// ─── Known Fields ───────────────────────────────────────────────────────────
+const KNOWN_TOP_FIELDS = new Set([
+    "preset",
+    "presets",
+    "severity",
+    "minSeverity",
+    "format",
+    "disabledJudges",
+    "disabledRules",
+    "ruleOverrides",
+    "parallel",
+    "concurrency",
+    "failOnFindings",
+    "summary",
+    "baseline",
+    "exclude",
+    "include",
+    "judges",
+    "notifications",
+    "qualityGate",
+    "plugins",
+    "extends",
+    "language",
+    "framework",
+    "dataAdapter",
+    "smartSelect",
+    "customRules",
+    "organizationPolicy",
+    "cache",
+    "autoFix",
+    "triage",
+    "deprecated",
+    "ignorePatterns",
+]);
+const KNOWN_SEVERITIES = new Set(["critical", "high", "medium", "low", "info"]);
+const KNOWN_FORMATS = new Set([
+    "text",
+    "json",
+    "sarif",
+    "markdown",
+    "html",
+    "pdf",
+    "junit",
+    "codeclimate",
+    "github-actions",
+]);
+// ─── Validation Logic ───────────────────────────────────────────────────────
+export function validateConfig(config) {
+    const errors = [];
+    const warnings = [];
+    // Check for unknown top-level fields
+    for (const key of Object.keys(config)) {
+        if (!KNOWN_TOP_FIELDS.has(key)) {
+            warnings.push({
+                path: key,
+                message: `Unknown field "${key}"`,
+                suggestion: findClosestMatch(key, KNOWN_TOP_FIELDS),
+            });
+        }
+    }
+    // Validate severity
+    if (config.minSeverity !== undefined) {
+        if (typeof config.minSeverity !== "string" || !KNOWN_SEVERITIES.has(config.minSeverity)) {
+            errors.push({
+                path: "minSeverity",
+                message: `Invalid severity "${config.minSeverity}". Must be one of: ${[...KNOWN_SEVERITIES].join(", ")}`,
+            });
+        }
+    }
+    // Validate format
+    if (config.format !== undefined) {
+        if (typeof config.format !== "string" || !KNOWN_FORMATS.has(config.format)) {
+            errors.push({
+                path: "format",
+                message: `Invalid format "${config.format}". Must be one of: ${[...KNOWN_FORMATS].join(", ")}`,
+            });
+        }
+    }
+    // Validate disabledJudges is array of strings
+    if (config.disabledJudges !== undefined) {
+        if (!Array.isArray(config.disabledJudges)) {
+            errors.push({
+                path: "disabledJudges",
+                message: "disabledJudges must be an array of strings",
+            });
+        }
+    }
+    // Validate disabledRules is array of strings
+    if (config.disabledRules !== undefined) {
+        if (!Array.isArray(config.disabledRules)) {
+            errors.push({
+                path: "disabledRules",
+                message: "disabledRules must be an array of strings",
+            });
+        }
+    }
+    // Validate ruleOverrides
+    if (config.ruleOverrides !== undefined) {
+        if (typeof config.ruleOverrides !== "object" || config.ruleOverrides === null) {
+            errors.push({
+                path: "ruleOverrides",
+                message: "ruleOverrides must be an object",
+            });
+        }
+        else {
+            for (const [rule, override] of Object.entries(config.ruleOverrides)) {
+                if (typeof override === "object" && override !== null) {
+                    const ov = override;
+                    if (ov.severity && !KNOWN_SEVERITIES.has(ov.severity)) {
+                        errors.push({
+                            path: `ruleOverrides.${rule}.severity`,
+                            message: `Invalid severity "${ov.severity}"`,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    // Validate concurrency
+    if (config.concurrency !== undefined) {
+        if (typeof config.concurrency !== "number" || config.concurrency < 1) {
+            errors.push({
+                path: "concurrency",
+                message: "concurrency must be a positive number",
+            });
+        }
+    }
+    // Validate exclude/include patterns
+    for (const field of ["exclude", "include"]) {
+        if (config[field] !== undefined) {
+            if (!Array.isArray(config[field])) {
+                errors.push({
+                    path: field,
+                    message: `${field} must be an array of glob patterns`,
+                });
+            }
+        }
+    }
+    // Validate notifications
+    if (config.notifications !== undefined) {
+        const notifs = config.notifications;
+        if (notifs.channels && !Array.isArray(notifs.channels)) {
+            errors.push({
+                path: "notifications.channels",
+                message: "notifications.channels must be an array",
+            });
+        }
+    }
+    // Validate qualityGate
+    if (config.qualityGate !== undefined) {
+        const qg = config.qualityGate;
+        if (qg.maxFindings !== undefined && (typeof qg.maxFindings !== "number" || qg.maxFindings < 0)) {
+            errors.push({
+                path: "qualityGate.maxFindings",
+                message: "qualityGate.maxFindings must be a non-negative number",
+            });
+        }
+        if (qg.minScore !== undefined &&
+            (typeof qg.minScore !== "number" || qg.minScore < 0 || qg.minScore > 100)) {
+            errors.push({
+                path: "qualityGate.minScore",
+                message: "qualityGate.minScore must be between 0 and 100",
+            });
+        }
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+        warnings,
+    };
+}
+function findClosestMatch(input, candidates) {
+    let best;
+    let bestDist = Infinity;
+    for (const c of candidates) {
+        const dist = levenshtein(input.toLowerCase(), c.toLowerCase());
+        if (dist < bestDist && dist <= 3) {
+            bestDist = dist;
+            best = c;
+        }
+    }
+    return best ? `Did you mean "${best}"?` : undefined;
+}
+function levenshtein(a, b) {
+    const m = a.length, n = b.length;
+    const dp = Array.from({ length: m + 1 }, (_, i) => Array.from({ length: n + 1 }, (_, j) => (i === 0 ? j : j === 0 ? i : 0)));
+    for (let i = 1; i <= m; i++) {
+        for (let j = 1; j <= n; j++) {
+            dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
+        }
+    }
+    return dp[m][n];
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runValidateConfig(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges validate-config — Validate .judgesrc configuration
+
+Usage:
+  judges validate-config                        Validate .judgesrc in current directory
+  judges validate-config --config path/to/.judgesrc   Validate specific file
+
+Options:
+  --config <path>    Config file to validate (default: .judgesrc)
+  --format json      JSON output
+  --strict           Treat warnings as errors
+  --help, -h         Show this help
+`);
+        return;
+    }
+    const { readFileSync, existsSync } = require("fs");
+    const { resolve } = require("path");
+    const configPath = argv.find((_a, i) => argv[i - 1] === "--config") || ".judgesrc";
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const strict = argv.includes("--strict");
+    const resolved = resolve(configPath);
+    if (!existsSync(resolved)) {
+        console.error(`Error: config file not found: ${resolved}`);
+        process.exit(1);
+    }
+    let config;
+    try {
+        config = JSON.parse(readFileSync(resolved, "utf-8"));
+    }
+    catch (e) {
+        console.error(`Error: invalid JSON in ${resolved}: ${e instanceof Error ? e.message : e}`);
+        process.exit(1);
+    }
+    const result = validateConfig(config);
+    if (strict && result.warnings.length > 0) {
+        result.valid = false;
+        result.errors.push(...result.warnings);
+    }
+    if (format === "json") {
+        console.log(JSON.stringify(result, null, 2));
+        process.exit(result.valid ? 0 : 1);
+    }
+    if (result.valid && result.warnings.length === 0) {
+        console.log(`\n  ✅ Config is valid: ${resolved}\n`);
+        return;
+    }
+    console.log(`\n  Config Validation: ${resolved}\n`);
+    if (result.errors.length > 0) {
+        console.log(`  ❌ Errors (${result.errors.length}):`);
+        for (const e of result.errors) {
+            console.log(`    ${e.path}: ${e.message}`);
+            if (e.suggestion)
+                console.log(`      💡 ${e.suggestion}`);
+        }
+        console.log("");
+    }
+    if (result.warnings.length > 0) {
+        console.log(`  ⚠️  Warnings (${result.warnings.length}):`);
+        for (const w of result.warnings) {
+            console.log(`    ${w.path}: ${w.message}`);
+            if (w.suggestion)
+                console.log(`      💡 ${w.suggestion}`);
+        }
+        console.log("");
+    }
+    process.exit(result.valid ? 0 : 1);
+}

package/dist/commands/vendor-lock-detect.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Vendor lock detect — scan code for vendor-specific APIs and SDKs
+ * commonly embedded by AI models. Flag portability risks.
+ *
+ * All analysis local.
+ */
+export declare function runVendorLockDetect(argv: string[]): void;