@mh-alikhani/bunready 0.3.2 → 0.3.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +47 -4
- package/README.md +70 -91
- package/docs/README.md +16 -0
- package/docs/adr/0001-data-source-policy.md +1 -1
- package/docs/adr/0002-rule-severity-model.md +1 -1
- package/docs/adr/0003-release-pipeline.md +1 -1
- package/package.json +1 -1
- package/src/cli/args.ts +1 -0
- package/src/cli/copy.ts +4 -0
- package/src/cli/io.ts +1 -0
- package/src/cli/run.ts +4 -0
- package/src/cli/theme.ts +2 -0
- package/src/config/baseline.ts +5 -0
- package/src/config/config.ts +5 -0
- package/src/core/errors.ts +6 -0
- package/src/core/fs.ts +2 -0
- package/src/core/version.ts +2 -1
- package/src/report/human.ts +1 -0
- package/src/report/sarif.ts +1 -0
- package/src/report/types.ts +14 -2
- package/src/rules/install/lifecycle-scripts.ts +2 -0
- package/src/rules/install/lockfile-presence.ts +1 -0
- package/src/rules/install/native-addon.ts +3 -1
- package/src/rules/run/index.ts +1 -0
- package/src/rules/runtime/builtins.ts +5 -1
- package/src/rules/severity.ts +3 -0
- package/src/scanner/execute.ts +14 -0
- package/src/scanner/graph.ts +1 -0
- package/src/scanner/lockfile.ts +5 -0
- package/src/scanner/manifest.ts +1 -0
- package/src/scanner/scan.ts +35 -11
- package/src/scanner/semver.ts +4 -0
- package/src/scanner/sources.ts +117 -34
- package/src/scanner/target.ts +4 -0
- package/src/scanner/workspaces.ts +4 -0
package/src/scanner/target.ts
CHANGED
|
@@ -25,18 +25,21 @@ export interface PackageEvidence {
|
|
|
25
25
|
readonly installScripts: readonly string[];
|
|
26
26
|
}
|
|
27
27
|
|
|
28
|
+
/** A lockfile that was found and parsed. */
|
|
28
29
|
export interface LoadedLockfile {
|
|
29
30
|
readonly kind: LockfileKind;
|
|
30
31
|
readonly path: string;
|
|
31
32
|
readonly parsed: ParsedLockfile;
|
|
32
33
|
}
|
|
33
34
|
|
|
35
|
+
/** A lockfile that was found but could not be parsed. */
|
|
34
36
|
export interface UnparsedLockfile {
|
|
35
37
|
readonly kind: LockfileKind;
|
|
36
38
|
readonly path: string;
|
|
37
39
|
readonly message: string;
|
|
38
40
|
}
|
|
39
41
|
|
|
42
|
+
/** Everything read from one target directory: manifest, lockfiles, sources and config. */
|
|
40
43
|
export interface TargetSnapshot {
|
|
41
44
|
readonly dir: string;
|
|
42
45
|
readonly manifestPath: string;
|
|
@@ -116,6 +119,7 @@ async function probeInstalledPackage(
|
|
|
116
119
|
};
|
|
117
120
|
}
|
|
118
121
|
|
|
122
|
+
/** Reads a directory's manifest, lockfiles, sources and configuration. */
|
|
119
123
|
export async function readTarget(
|
|
120
124
|
dir: string,
|
|
121
125
|
fs: FileSystem = nodeFileSystem(),
|
|
@@ -23,11 +23,13 @@ export const WORKSPACE_EXCLUDES = [
|
|
|
23
23
|
|
|
24
24
|
const MAX_DEPTH = 3;
|
|
25
25
|
|
|
26
|
+
/** A workspace package: its directory and its manifest. */
|
|
26
27
|
export interface WorkspacePackage {
|
|
27
28
|
/** Directory relative to the workspace root, using forward slashes. */
|
|
28
29
|
readonly relative: string;
|
|
29
30
|
}
|
|
30
31
|
|
|
32
|
+
/** Reads the workspace globs from package.json or pnpm-workspace.yaml. */
|
|
31
33
|
export function workspacePatterns(manifest: Manifest, pnpmWorkspace: string | undefined): string[] {
|
|
32
34
|
if (manifest.workspaces.length > 0) {
|
|
33
35
|
return [...manifest.workspaces]
|
|
@@ -145,6 +147,7 @@ function stripTrailingSlashes(value: string): string {
|
|
|
145
147
|
return value.slice(0, end);
|
|
146
148
|
}
|
|
147
149
|
|
|
150
|
+
/** Resolves workspace patterns to the packages they match. */
|
|
148
151
|
export async function findWorkspacePackages(
|
|
149
152
|
root: string,
|
|
150
153
|
patterns: readonly string[],
|
|
@@ -177,6 +180,7 @@ export async function findWorkspacePackages(
|
|
|
177
180
|
return [...found.values()].sort((a, b) => a.relative.localeCompare(b.relative));
|
|
178
181
|
}
|
|
179
182
|
|
|
183
|
+
/** Filename of the pnpm workspace file. */
|
|
180
184
|
export const PNPM_WORKSPACE_FILENAME = "pnpm-workspace.yaml";
|
|
181
185
|
|
|
182
186
|
/** Read and parse `pnpm-workspace.yaml`, if it is there. */
|