@leverege/build-tools 1.8.4

package/.publishrc

@@ -0,0 +1,15 @@
+{
+  "validations": {
+    "vulnerableDependencies": false,
+    "uncommittedChanges": true,
+    "untrackedFiles": true,
+    "branch": "development",
+    "gitTag": true,
+    "sensitiveData": false
+  },
+  "confirm": true,
+  "publishCommand": "npm publish",
+  "publishTag": "latest",
+  "prePublishScript": "npm run build",
+  "postPublishScript": false
+}

package/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+## [1.6.3] - 2019-07-02
+### Added
+- (pkglint) Added pkglint check for valid files
+
+## [1.5.0] - 2019-06-07
+### Added
+- (Dnsify) Added new Dnsify script to add new DNS records to cloudflare
+
+## [1.4.0] - 2019-05-02
+### Added
+- (Helmify) Added new Helmify script to bootstrap helm templates
+
+## [0.7.1] - 2019-03-07
+### Updated
+- (Overwhelm) Replaced glob library to fix vulnerability issue
+
+## [0.5.0] - 2019-03-04
+### Replaced
+- (Encrypt/Decrypt) Deprecate OpenSSL for GCP KMS encryption method
+
+## [0.4.0] - 2019-02-21
+### Added
+- (Circleate) Added smoke test step to do security audit
+- (Circleate) Account for edge cases with non-standard container name
+
+### Removed
+- (Circleate) Deleted junit reporter for test coverage

package/LICENSE.md

@@ -0,0 +1,3 @@
+Copyright (c) 2018 - Leverege LLC
+
+This proprietary software is owned by Leverege LLC ("Leverege") for its exclusive use except when otherwise noted. Any user of this software agrees to hold Leverege harmless for any and all damages or liabilities that arise out of the use of the software for any purpose. Leverege does not warrant suitability for any purpose. Except when noted, Leverege explicitly does not grant the user of the software any right to use, modify, or redistribute the source code for any purpose, and will pursue all legal remedies against violators as permitted under the laws of United States. 

package/README.md

@@ -0,0 +1,32 @@
+# Leverege Build Tools
+
+A collection of build tools for all Leverege code. 
+
+## Installing
+
+Install build-tools
+
+```
+npm install --save-dev @leverege/build-tools
+```
+
+And add the script you want in package.json like
+
+```
+"scripts": {
+	"circleate": "circleate"
+}
+```
+
+## Tool Descriptions
+Most of these tools should be bootstrapped with a template, but if you need descriptions of the tools:
+
+* **circleate**: bootstrap .circleci config repo
+* **decrypt-secrets**: decrypts secrets (env, service accounts)
+* **dockreate**: bootstrap docker repo
+* **encrypt-secrets**: encrypts secrets (env, service accounts)
+
+## Authors
+
+* **John Phelps** - Dockreate, getfbcfg, getjson, pkgck
+* **Yitaek Hwang** - circleate, encrypt/decrypt secrets

package/lib/server/auditate/help.js

@@ -0,0 +1,119 @@
+"use strict";
+
+const groupBy = require('lodash.groupby');
+
+const keyBy = require('lodash.keyby');
+
+const countBy = require('lodash.countby');
+
+const orderBy = require('lodash.orderby');
+
+const map = require('lodash.map');
+
+const first = require('lodash.first');
+
+module.exports = (config = {}) => {
+  function affectsProd(resolves) {
+    return !(config['prod-only'] && resolves.every(({
+      dev
+    }) => dev));
+  }
+
+  function requireAttention(auditResult) {
+    const {
+      actions,
+      advisories
+    } = auditResult;
+    const reviewActions = actions.filter(({
+      action,
+      resolves,
+      isMajor
+    }) => (action === 'review' || isMajor) && affectsProd(resolves));
+    const reviewAdvisories = reviewActions.reduce((acc, {
+      resolves
+    }) => {
+      const advisoriesToInclude = resolves.reduce((result, {
+        id
+      }) => Object.assign({}, result, {
+        [id]: advisories[id]
+      }), {});
+      return Object.assign({}, acc, advisoriesToInclude);
+    }, {});
+    return Object.assign({}, auditResult, {
+      actions: reviewActions,
+      advisories: reviewAdvisories
+    });
+  }
+
+  function getHighestSeverity({
+    advisories
+  }) {
+    for (const severity of ['critical', 'high', 'moderate', 'low']) {
+      if (Object.keys(advisories).find(key => advisories[key].severity === severity)) {
+        return severity;
+      }
+    }
+  }
+
+  function filterAuditResultsBySeverity(auditResult, highestSeverity) {
+    const {
+      actions,
+      advisories
+    } = auditResult;
+    const groupedAdvisories = groupBy(advisories, 'severity');
+    const advisoriesForSeverity = keyBy(groupedAdvisories[highestSeverity], 'id');
+    const actionsForSeverity = actions.reduce((acc, action) => {
+      const resolvesSevereAdvisory = action.resolves.some(({
+        id
+      }) => advisoriesForSeverity[id]);
+      return resolvesSevereAdvisory ? [].concat(acc, action) : acc;
+    }, []);
+    return Object.assign({}, auditResult, {
+      actions: actionsForSeverity,
+      advisories
+    });
+  }
+
+  function getAutoFixCount(auditResult) {
+    return auditResult.actions.filter(({
+      action,
+      resolves,
+      isMajor
+    }) => action !== 'review' && !isMajor && affectsProd(resolves)).length;
+  }
+
+  function findRootLibs(resolves) {
+    return resolves.reduce((acc, resolve) => [].concat(acc, resolve.path.split('>')[0]), []);
+  }
+
+  function getMostProblematicDependency({
+    actions
+  }) {
+    const rootLibraries = actions.reduce((libs, {
+      resolves
+    }) => [].concat(libs, findRootLibs(resolves)), []);
+    return first(orderBy(map(countBy(rootLibraries), (count, lib) => ({
+      count,
+      name: lib
+    })), ({
+      count
+    }) => count, ['desc']));
+  }
+
+  return function help(npmAuditResultJson) {
+    const npmAuditResult = JSON.parse(npmAuditResultJson);
+    const resultsThatRequireAttention = requireAttention(npmAuditResult);
+    const highestSeverity = getHighestSeverity(resultsThatRequireAttention);
+    const auditResult = filterAuditResultsBySeverity(resultsThatRequireAttention, highestSeverity);
+    const autoFixCount = getAutoFixCount(npmAuditResult);
+    const exitCode = config['exit-zero'] || !auditResult.actions.length && !autoFixCount ? 0 : 1;
+    return {
+      npmAuditResult,
+      auditResult,
+      autoFixCount,
+      mostProblematicDependency: getMostProblematicDependency(resultsThatRequireAttention),
+      highestSeverity,
+      exitCode
+    };
+  };
+};

package/lib/server/auditate/index.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+"use strict";
+
+const getStdin = require('get-stdin');
+
+const options = require('minimist')(process.argv.slice(2));
+
+const help = require('./help');
+
+const report = require('./report');
+
+const defaults = {
+  'exit-zero': false,
+  'prod-only': false
+};
+const config = Object.assign({}, defaults, options);
+getStdin().then(help(config)).then(result => report(result).then(theReport => {
+  console.log(theReport);
+  process.exit(result.exitCode);
+})).catch(error => {
+  console.error(error);
+  process.exit(1);
+});

package/lib/server/auditate/report.js

@@ -0,0 +1,61 @@
+"use strict";
+
+const auditReport = require('npm-audit-report');
+
+const chalk = require('chalk');
+
+function automaticFixes(autoFixCount) {
+  return autoFixCount ? `run ${chalk.yellow('`npm audit fix`')} to automatically fix ${chalk.yellow(autoFixCount)} issues. These should all be non-breaking upgrades, so don't stress.` : '';
+}
+
+function fixesToReview({
+  actions,
+  advisories
+}, highestSeverity) {
+  const advisoryIds = Object.keys(advisories);
+
+  if (!actions.length || !advisoryIds.length) {
+    return '';
+  }
+
+  return `Resolve the ${chalk.green(actions.length)} ${chalk.green(highestSeverity)} severity issues above and run this command again to move to the next severity.`;
+}
+
+function mostProblematic(mostProblematicDependency) {
+  if (!mostProblematicDependency) {
+    return '';
+  }
+
+  const {
+    name,
+    count
+  } = mostProblematicDependency;
+  return count && count > 2 ? `The most problematic dependency seems to be ${chalk.blue(name)} with ${chalk.blue(count)} issue${count ? 's' : ''} that need your attention.` : '';
+}
+
+module.exports = async function printFullReport({
+  npmAuditResult,
+  auditResult,
+  autoFixCount,
+  mostProblematicDependency,
+  highestSeverity
+}) {
+  const {
+    report
+  } = await auditReport(npmAuditResult, {
+    reporter: 'install',
+    withColor: true,
+    withUnicode: true
+  });
+  const hints = [].concat(automaticFixes(autoFixCount)).concat(fixesToReview(auditResult, highestSeverity)).concat(mostProblematic(mostProblematicDependency)).filter(Boolean);
+  const help = hints.length ? `
+
+${chalk.green('=== A little bit of help ===')}
+
+Where to start:
+${hints.reduce((acc, hint) => `${acc}
+- ${hint}
+`, '')}
+` : '';
+  return `${report}${help}`;
+};