@ktpartners/dgs-platform 2.9.0 → 3.3.0

package/deliver-great-systems/bin/lib/package-runner.test.cjs

@@ -0,0 +1,198 @@
+/**
+ * package-runner.test.cjs -- Unit tests for exit-code-aware tool invocation
+ *
+ * Covers PKG-11 exit-code layer (findings vs tool_failure vs missing vs timeout),
+ * 50 MB buffer handling (PITFALLS.md execSync 1 MiB truncation), Snyk/OSV/govulncheck
+ * exit-code edge cases, env passthrough, and ECOSYSTEM_OVERRIDES export.
+ *
+ * All fabrications use `node -e` so tests run without any security tool installed.
+ */
+'use strict';
+const { test, describe } = require('node:test');
+const assert = require('node:assert');
+const {
+  runTool,
+  FINDINGS_EXIT_CODES,
+  ECOSYSTEM_OVERRIDES,
+  DEFAULT_TIMEOUT_MS,
+  DEFAULT_MAX_BUFFER,
+} = require('./package-runner.cjs');
+
+const NODE = process.execPath;
+const fakeExitCode = (code, stdout = '', stderr = '') =>
+  [NODE, '-e', `process.stdout.write(${JSON.stringify(stdout)}); process.stderr.write(${JSON.stringify(stderr)}); process.exit(${code})`];
+const fakeTimeout = (ms) =>
+  [NODE, '-e', `setTimeout(() => {}, ${ms});`];
+const fakeLargeStdout = (bytes) =>
+  [NODE, '-e', `const s = 'x'.repeat(${bytes}); process.stdout.write(JSON.stringify({ buf: s }));`];
+const fakeEnvEcho = (varName) =>
+  [NODE, '-e', `process.stdout.write(process.env[${JSON.stringify(varName)}] || '');`];
+const fakeMissingBinary = () => ['definitely-not-a-binary-xxx-' + Date.now()];
+
+describe('runTool - outcome mapping', () => {
+  test('exitCode 0 with stdout -> outcome: "ok"', () => {
+    const r = runTool(process.cwd(), 'snyk', fakeExitCode(0, '{}'));
+    assert.strictEqual(r.outcome, 'ok');
+    assert.strictEqual(r.exitCode, 0);
+    assert.strictEqual(r.stdout, '{}');
+  });
+
+  test('Snyk exit 1 (findings) -> outcome: "ok" because 1 in FINDINGS_EXIT_CODES.snyk', () => {
+    const r = runTool(process.cwd(), 'snyk', fakeExitCode(1, '{"vulns":[]}'));
+    assert.strictEqual(r.outcome, 'ok');
+    assert.strictEqual(r.exitCode, 1);
+  });
+
+  test('Snyk exit 2 -> outcome: "tool_failure", stderr preserved', () => {
+    const r = runTool(process.cwd(), 'snyk', fakeExitCode(2, '', 'boom'));
+    assert.strictEqual(r.outcome, 'tool_failure');
+    assert.strictEqual(r.exitCode, 2);
+    assert.strictEqual(r.stderr, 'boom');
+  });
+
+  test('npm-audit exit 1 -> outcome: "ok"', () => {
+    const r = runTool(process.cwd(), 'npm-audit', fakeExitCode(1, '{}'));
+    assert.strictEqual(r.outcome, 'ok');
+  });
+
+  test('pip-audit exit 1 -> outcome: "ok"', () => {
+    const r = runTool(process.cwd(), 'pip-audit', fakeExitCode(1, '{}'));
+    assert.strictEqual(r.outcome, 'ok');
+  });
+
+  test('bundler-audit exit 1 -> outcome: "ok"', () => {
+    const r = runTool(process.cwd(), 'bundler-audit', fakeExitCode(1, '{}'));
+    assert.strictEqual(r.outcome, 'ok');
+  });
+
+  test('osv-scanner exit 1 -> outcome: "ok"', () => {
+    const r = runTool(process.cwd(), 'osv-scanner', fakeExitCode(1, '{}'));
+    assert.strictEqual(r.outcome, 'ok');
+  });
+
+  test('osv-scanner exit 128 -> outcome: "ok" (no-packages-found legitimate)', () => {
+    const r = runTool(process.cwd(), 'osv-scanner', fakeExitCode(128, '{}'));
+    assert.strictEqual(r.outcome, 'ok');
+  });
+
+  test('govulncheck exit 0 -> outcome: "ok" (always)', () => {
+    const r = runTool(process.cwd(), 'govulncheck', fakeExitCode(0, '{}'));
+    assert.strictEqual(r.outcome, 'ok');
+  });
+
+  test('govulncheck exit 1 (hypothetical failure) -> outcome: "tool_failure"', () => {
+    const r = runTool(process.cwd(), 'govulncheck', fakeExitCode(1, '', 'fail'));
+    assert.strictEqual(r.outcome, 'tool_failure');
+  });
+
+  test('exitCode 127 -> outcome: "missing"', () => {
+    const r = runTool(process.cwd(), 'snyk', fakeExitCode(127, '', 'not found'));
+    assert.strictEqual(r.outcome, 'missing');
+  });
+
+  test('ENOENT spawn error -> outcome: "missing"', () => {
+    const r = runTool(process.cwd(), 'snyk', fakeMissingBinary());
+    assert.strictEqual(r.outcome, 'missing');
+    assert.strictEqual(r.exitCode, 127);
+  });
+
+  test('timeout (SIGTERM after timeoutMs) -> outcome: "timeout", timedOut: true, duration >= timeoutMs', () => {
+    const r = runTool(process.cwd(), 'snyk', fakeTimeout(60000), { timeoutMs: 300 });
+    assert.strictEqual(r.outcome, 'timeout');
+    assert.strictEqual(r.timedOut, true);
+    assert.ok(r.duration >= 200, `expected duration >= 200, got ${r.duration}`);
+  });
+
+  test('toolKey null -> outcome: "no_native_tool_for_ecosystem", spawnSync NOT invoked', () => {
+    const start = Date.now();
+    const r = runTool(process.cwd(), null, [NODE, '-e', 'process.exit(0)']);
+    const dt = Date.now() - start;
+    assert.strictEqual(r.outcome, 'no_native_tool_for_ecosystem');
+    // spawnSync not called: must return essentially instantly (<50ms) and duration: 0
+    assert.strictEqual(r.duration, 0);
+    assert.ok(dt < 100, `no-spawn branch should be immediate, got ${dt}ms`);
+  });
+
+  test('toolKey undefined -> outcome: "no_native_tool_for_ecosystem"', () => {
+    const r = runTool(process.cwd(), undefined, [NODE, '-e', 'process.exit(0)']);
+    assert.strictEqual(r.outcome, 'no_native_tool_for_ecosystem');
+  });
+});
+
+describe('runTool - buffer and env', () => {
+  test('10 MB stdout is captured intact (no truncation)', () => {
+    const bytes = 10 * 1024 * 1024;
+    const r = runTool(process.cwd(), 'snyk', fakeLargeStdout(bytes));
+    assert.strictEqual(r.outcome, 'ok');
+    assert.ok(r.stdout.length >= bytes, `expected stdout.length >= ${bytes}, got ${r.stdout.length}`);
+  });
+
+  test('opts.env is merged into child process env (child can read injected var)', () => {
+    const r = runTool(process.cwd(), 'snyk', fakeEnvEcho('DGS_TEST_INJECT'), {
+      env: { DGS_TEST_INJECT: 'hello-world' },
+    });
+    assert.strictEqual(r.outcome, 'ok');
+    assert.strictEqual(r.stdout, 'hello-world');
+  });
+
+  test('process.env is inherited (e.g., child sees PATH)', () => {
+    const r = runTool(process.cwd(), 'snyk', fakeEnvEcho('PATH'));
+    assert.strictEqual(r.outcome, 'ok');
+    assert.ok(r.stdout.length > 0, 'PATH should be inherited and non-empty');
+  });
+});
+
+describe('runTool - JSON parsing', () => {
+  test('on ok with expectJson and well-formed JSON, parsed field is populated', () => {
+    const r = runTool(process.cwd(), 'snyk', fakeExitCode(0, '{"ok":true,"count":3}'), { expectJson: true });
+    assert.strictEqual(r.outcome, 'ok');
+    assert.deepStrictEqual(r.parsed, { ok: true, count: 3 });
+  });
+
+  test('on ok with expectJson and malformed JSON, outcome downgrades to tool_failure', () => {
+    const r = runTool(process.cwd(), 'snyk', fakeExitCode(0, 'not json {'), { expectJson: true });
+    assert.strictEqual(r.outcome, 'tool_failure');
+    assert.ok(/JSON parse error/.test(r.stderr));
+  });
+
+  test('on ok without expectJson, parsed is not set', () => {
+    const r = runTool(process.cwd(), 'snyk', fakeExitCode(0, '{"a":1}'));
+    assert.strictEqual(r.outcome, 'ok');
+    assert.strictEqual(r.parsed, undefined);
+  });
+
+  test('govulncheck NDJSON-style multi-object stream is NOT parsed by runner (runner treats it as raw)', () => {
+    // govulncheck emits NDJSON — runner should deliver stdout untouched when expectJson is false.
+    const ndjson = '{"message":{"type":"osv"}}\n{"message":{"type":"finding"}}';
+    const r = runTool(process.cwd(), 'govulncheck', fakeExitCode(0, ndjson), { expectJson: false });
+    assert.strictEqual(r.outcome, 'ok');
+    assert.strictEqual(r.stdout, ndjson);
+    assert.strictEqual(r.parsed, undefined);
+  });
+});
+
+describe('runTool - exports', () => {
+  test('ECOSYSTEM_OVERRIDES exports yarn: { force_tool: "osv", reason: string }', () => {
+    assert.ok(ECOSYSTEM_OVERRIDES.yarn);
+    assert.strictEqual(ECOSYSTEM_OVERRIDES.yarn.force_tool, 'osv');
+    assert.strictEqual(typeof ECOSYSTEM_OVERRIDES.yarn.reason, 'string');
+    assert.ok(ECOSYSTEM_OVERRIDES.yarn.reason.length > 0);
+  });
+
+  test('FINDINGS_EXIT_CODES exports all 6 tool keys with correct code arrays', () => {
+    assert.deepStrictEqual(Array.from(FINDINGS_EXIT_CODES.snyk), [1]);
+    assert.deepStrictEqual(Array.from(FINDINGS_EXIT_CODES['npm-audit']), [1]);
+    assert.deepStrictEqual(Array.from(FINDINGS_EXIT_CODES['osv-scanner']), [1, 128]);
+    assert.deepStrictEqual(Array.from(FINDINGS_EXIT_CODES['pip-audit']), [1]);
+    assert.deepStrictEqual(Array.from(FINDINGS_EXIT_CODES.govulncheck), []);
+    assert.deepStrictEqual(Array.from(FINDINGS_EXIT_CODES['bundler-audit']), [1]);
+  });
+
+  test('DEFAULT_TIMEOUT_MS is 300000', () => {
+    assert.strictEqual(DEFAULT_TIMEOUT_MS, 300_000);
+  });
+
+  test('DEFAULT_MAX_BUFFER is 50 * 1024 * 1024', () => {
+    assert.strictEqual(DEFAULT_MAX_BUFFER, 50 * 1024 * 1024);
+  });
+});

package/deliver-great-systems/bin/lib/package-scan-provenance.cjs

@@ -0,0 +1,56 @@
+'use strict';
+/**
+ * package-scan-provenance.cjs — PKG-33
+ *
+ * Resolves the commit that introduced a dependency manifest entry by running
+ * `git log --format=%H%x00%s -S <packageName> -- <manifestPath>` in the repo
+ * directory, then extracts a DGS plan-id (NNN-NN) from the commit subject.
+ *
+ * Pure module modulo the spawnFn seam: caller injects spawnSync for tests.
+ *
+ * Exports:
+ *   provenanceLookup({ repoDir, manifestPath, packageName, spawnFn })
+ *     -> { commit: string|null, plan: string|null }
+ *   _extractPlanIdFromSubject(subject) -> string|null
+ */
+const { spawnSync } = require('child_process');
+
+const PLAN_ID_REGEX = /\b(\d{3}-\d{2})\b/;
+
+function _extractPlanIdFromSubject(subject) {
+  if (subject === null || subject === undefined) return null;
+  const m = String(subject).match(PLAN_ID_REGEX);
+  return m ? m[1] : null;
+}
+
+function provenanceLookup(args) {
+  const { repoDir, manifestPath, packageName } = args || {};
+  const spawnFn = (args && args.spawnFn) || spawnSync;
+  if (!repoDir || !manifestPath || !packageName) {
+    return { commit: null, plan: null };
+  }
+  let result;
+  try {
+    result = spawnFn('git', ['log', '--format=%H%x00%s', '-S', packageName, '--', manifestPath], {
+      cwd: repoDir,
+      encoding: 'utf-8',
+      timeout: 5000,
+    });
+  } catch {
+    return { commit: null, plan: null };
+  }
+  if (!result || result.error || typeof result.stdout !== 'string' || result.stdout.length === 0) {
+    return { commit: null, plan: null };
+  }
+  const lines = result.stdout.split('\n').filter(l => l.length > 0);
+  if (lines.length === 0) return { commit: null, plan: null };
+  // git log emits newest-first; the oldest commit is the LAST non-empty line.
+  const oldestLine = lines[lines.length - 1];
+  const [fullSha, subject] = oldestLine.split('\u0000');
+  if (!fullSha) return { commit: null, plan: null };
+  const shortSha = String(fullSha).slice(0, 7);
+  const planId = _extractPlanIdFromSubject(subject || '');
+  return { commit: shortSha, plan: planId };
+}
+
+module.exports = { provenanceLookup, _extractPlanIdFromSubject };

package/deliver-great-systems/bin/lib/package-scan-provenance.test.cjs

@@ -0,0 +1,103 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert');
+const { provenanceLookup, _extractPlanIdFromSubject } = require('./package-scan-provenance.cjs');
+
+test.describe('_extractPlanIdFromSubject (PKG-33)', () => {
+  test.test('feat(149-01): ... → 149-01', () => {
+    assert.strictEqual(_extractPlanIdFromSubject('feat(149-01): implement scanner'), '149-01');
+  });
+  test.test('test(152-03): ... → 152-03', () => {
+    assert.strictEqual(_extractPlanIdFromSubject('test(152-03): add gate-parity describe block'), '152-03');
+  });
+  test.test('commit with inline 149-01 → 149-01', () => {
+    assert.strictEqual(_extractPlanIdFromSubject('Merge branch feature/149-01-foundation'), '149-01');
+  });
+  test.test('three-digit phase: feat(999-42) → 999-42', () => {
+    assert.strictEqual(_extractPlanIdFromSubject('feat(999-42): something'), '999-42');
+  });
+  test.test('missing zero pad: 149-1 → null', () => {
+    assert.strictEqual(_extractPlanIdFromSubject('feat(149-1): ...'), null);
+  });
+  test.test('wrong digit count: 12-345 → null', () => {
+    assert.strictEqual(_extractPlanIdFromSubject('feat(12-345): ...'), null);
+  });
+  test.test('random text → null', () => {
+    assert.strictEqual(_extractPlanIdFromSubject('random commit message'), null);
+  });
+  test.test('empty subject → null', () => {
+    assert.strictEqual(_extractPlanIdFromSubject(''), null);
+  });
+  test.test('null subject → null', () => {
+    assert.strictEqual(_extractPlanIdFromSubject(null), null);
+  });
+  test.test('undefined subject → null', () => {
+    assert.strictEqual(_extractPlanIdFromSubject(undefined), null);
+  });
+});
+
+test.describe('provenanceLookup (PKG-33)', () => {
+  test.test('empty git log output => {commit:null, plan:null}', () => {
+    const spawnFn = () => ({ status: 0, stdout: '', stderr: '' });
+    const r = provenanceLookup({ repoDir: '/tmp/x', manifestPath: 'package.json', packageName: 'lodash', spawnFn });
+    assert.deepStrictEqual(r, { commit: null, plan: null });
+  });
+  test.test('git log returns one commit with plan-id => {commit:<7sha>, plan:<plan-id>}', () => {
+    const spawnFn = () => ({
+      status: 0,
+      stdout: 'abc1234567890def1234567890\u0000feat(152-03): add gate-parity describe block\n',
+      stderr: '',
+    });
+    const r = provenanceLookup({ repoDir: '/tmp/x', manifestPath: 'package.json', packageName: 'lodash', spawnFn });
+    assert.strictEqual(r.commit, 'abc1234');
+    assert.strictEqual(r.plan, '152-03');
+  });
+  test.test('git log returns multiple commits => picks OLDEST (last line)', () => {
+    const spawnFn = () => ({
+      status: 0,
+      stdout: 'newSHA99999999999999999999\u0000feat(153-01): update\n' +
+              'oldSHA1111111111111111111\u0000feat(149-01): add lodash dep\n',
+      stderr: '',
+    });
+    const r = provenanceLookup({ repoDir: '/tmp/x', manifestPath: 'package.json', packageName: 'lodash', spawnFn });
+    assert.strictEqual(r.commit, 'oldSHA1');
+    assert.strictEqual(r.plan, '149-01');
+  });
+  test.test('git log commit without plan-id => {commit:<sha>, plan:null}', () => {
+    const spawnFn = () => ({
+      status: 0,
+      stdout: 'def5678901234567890123456\u0000chore: bump deps\n',
+      stderr: '',
+    });
+    const r = provenanceLookup({ repoDir: '/tmp/x', manifestPath: 'package.json', packageName: 'lodash', spawnFn });
+    assert.strictEqual(r.commit, 'def5678');
+    assert.strictEqual(r.plan, null);
+  });
+  test.test('git not found / spawn error => {commit:null, plan:null}', () => {
+    const spawnFn = () => ({ error: new Error('ENOENT'), status: null, stdout: '', stderr: '' });
+    const r = provenanceLookup({ repoDir: '/tmp/x', manifestPath: 'package.json', packageName: 'lodash', spawnFn });
+    assert.deepStrictEqual(r, { commit: null, plan: null });
+  });
+  test.test('missing manifestPath => {commit:null, plan:null} (no-op)', () => {
+    const spawnFn = () => { throw new Error('should not be called'); };
+    const r = provenanceLookup({ repoDir: '/tmp/x', manifestPath: null, packageName: 'lodash', spawnFn });
+    assert.deepStrictEqual(r, { commit: null, plan: null });
+  });
+  test.test('missing packageName => {commit:null, plan:null} (no-op)', () => {
+    const spawnFn = () => { throw new Error('should not be called'); };
+    const r = provenanceLookup({ repoDir: '/tmp/x', manifestPath: 'package.json', packageName: null, spawnFn });
+    assert.deepStrictEqual(r, { commit: null, plan: null });
+  });
+  test.test('spawnFn receives argv: ["git", "log", "--format=%H%x00%s", "-S", packageName, "--", manifestPath]', () => {
+    let capturedArgv = null;
+    let capturedOpts = null;
+    const spawnFn = (cmd, argv, opts) => {
+      capturedArgv = [cmd, ...argv];
+      capturedOpts = opts;
+      return { status: 0, stdout: '', stderr: '' };
+    };
+    provenanceLookup({ repoDir: '/tmp/r', manifestPath: 'package.json', packageName: 'lodash', spawnFn });
+    assert.deepStrictEqual(capturedArgv, ['git', 'log', '--format=%H%x00%s', '-S', 'lodash', '--', 'package.json']);
+    assert.strictEqual(capturedOpts.cwd, '/tmp/r');
+  });
+});