@npmcli/template-oss 4.7.1 → 4.9.0

package/lib/check/check-engines.js

@@ -0,0 +1,48 @@
+const semver = require('semver')
+const { relative, join } = require('path')
+const Arborist = require('@npmcli/arborist')
+
+const run = async ({ root, path, pkg, config: { omitEngines = [] } }) => {
+  const pkgPath = join(relative(root, path), 'package.json')
+  const arb = new Arborist({ path })
+  const tree = await arb.loadActual({ forceActual: true })
+
+  const engines = pkg.engines.node
+  const deps = await tree.querySelectorAll(`#${pkg.name} > .prod:attr(engines, [node])`)
+
+  const invalid = []
+  for (const dep of deps) {
+    if (omitEngines.includes(dep.name)) {
+      continue
+    }
+
+    const depEngines = dep.target.package.engines.node
+    if (!semver.subset(engines, depEngines)) {
+      invalid.push({
+        name: `${dep.name}@${dep.version}`,
+        location: dep.location,
+        engines: depEngines,
+      })
+    }
+  }
+
+  if (invalid.length) {
+    const title = `The following production dependencies are not compatible with ` +
+      `\`engines.node: ${engines}\` found in \`${pkgPath}\`:`
+    return {
+      title,
+      body: invalid.map((dep) => [
+        `${dep.name}:`,
+        `  engines.node: ${dep.engines}`,
+        `  location: ${dep.location}`,
+      ].join('\n')).join('\n'),
+      solution: 'Remove them or move them to devDependencies.',
+    }
+  }
+}
+
+module.exports = {
+  run,
+  when: ({ pkg, config: c }) => c.applyModule && pkg.engines?.node,
+  name: 'check-engines',
+}

package/lib/check/index.js

@@ -6,4 +6,5 @@ module.exports = (root) => run(root, [
   require('./check-unwanted.js'),
   require('./check-gitignore.js'),
   require('./check-changelog.js'),
+  require('./check-engines.js'),
 ])

package/lib/content/SECURITY.md

@@ -1 +1,12 @@
-Please send vulnerability reports through [hackerone](https://hackerone.com/github).
+GitHub takes the security of our software products and services seriously, including the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub).
+
+If you believe you have found a security vulnerability in this GitHub-owned open source repository, you can report it to us in one of two ways. 
+
+If the vulnerability you have found is *not* [in scope for the GitHub Bug Bounty Program](https://bounty.github.com/#scope) or if you do not wish to be considered for a bounty reward, please report the issue to us directly using [private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).
+
+If the vulnerability you have found is [in scope for the GitHub Bug Bounty Program](https://bounty.github.com/#scope) and you would like for your finding to be considered for a bounty reward, please submit the vulnerability to us through [HackerOne](https://hackerone.com/github) in order to be eligible to receive a bounty award.
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+Thanks for helping make GitHub safe for everyone.
+

package/lib/content/_step-audit.yml

@@ -1,2 +1,4 @@
-- name: Run Audit
-  run: {{ rootNpmPath }} audit
+- name: Run Production Audit
+  run: {{ rootNpmPath }} audit --omit=dev
+- name: Run Full Audit
+  run: {{ rootNpmPath }} audit --audit-level=none

package/lib/content/ci.yml

@@ -4,15 +4,6 @@ on:
   {{> onCi }}
 
 jobs:
-  engines:
-    {{> jobMatrix
-      jobName="Engines"
-      jobDepFlags="--engines-strict"
-      macCI=false
-      windowsCI=false
-      ciVersions=baseCiVersions
-    }}
-
   lint:
     {{> job jobName="Lint" }}
       {{> stepLint jobRunFlags=pkgFlags }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/template-oss",
-  "version": "4.7.1",
+  "version": "4.9.0",
   "description": "templated files used in npm CLI team oss projects",
   "main": "lib/content/index.js",
   "bin": {
@@ -36,6 +36,7 @@
     "@commitlint/cli": "^17.1.1",
     "@commitlint/config-conventional": "^17.1.0",
     "@isaacs/string-locale-compare": "^1.1.0",
+    "@npmcli/arborist": "^6.0.0",
     "@npmcli/git": "^4.0.0",
     "@npmcli/map-workspaces": "^3.0.0",
     "@npmcli/package-json": "^3.0.0",