@openreachtech/mentsu-npm-audit-gate 0.0.0-stage → 0.1.0

package/lib/ProcessLogger.js

@@ -0,0 +1,97 @@
+/**
+ * Write texts to the standard output and the standard error of the process.
+ */
+export default class ProcessLogger {
+  /**
+   * @param {{
+   *   processClient: typeof process
+   * }} params - Parameters of this constructor.
+   */
+  constructor ({
+    processClient,
+  }) {
+    this.processClient = processClient
+  }
+
+  /**
+   * Factory method.
+   *
+   * @template {X extends typeof ProcessLogger ? X : never} T, X
+   * @param {{
+   *   processClient?: typeof process
+   * }} [params] - Parameters for the factory method.
+   * @returns {InstanceType<T>} Instance of this class.
+   * @this {T}
+   * @public
+   */
+  static create ({
+    processClient = this.processClient,
+  } = {}) {
+    return /** @type {InstanceType<T>} */ (
+      new this({
+        processClient,
+      })
+    )
+  }
+
+  /**
+   * get: Current process.
+   *
+   * @returns {typeof process} Current process.
+   */
+  static get processClient () {
+    return process
+  }
+
+  /**
+   * get: Standard output stream.
+   *
+   * @returns {typeof process.stdout} Standard output stream.
+   */
+  get stdout () {
+    return this.processClient.stdout
+  }
+
+  /**
+   * get: Standard error stream.
+   *
+   * @returns {typeof process.stderr} Standard error stream.
+   */
+  get stderr () {
+    return this.processClient.stderr
+  }
+
+  /**
+   * Write a text to the standard output stream.
+   *
+   * @param {{
+   *   text: string
+   * }} params - Parameters.
+   * @returns {BooleanLike} Whether the stream accepted the text.
+   * @public
+   */
+  logMessage ({
+    text,
+  }) {
+    return this.stdout.write(text)
+  }
+
+  /**
+   * Write a text to the standard error stream.
+   *
+   * @param {{
+   *   text: string
+   * }} params - Parameters.
+   * @returns {BooleanLike} Whether the stream accepted the text.
+   * @public
+   */
+  logError ({
+    text,
+  }) {
+    return this.stderr.write(text)
+  }
+}
+
+/**
+ * @typedef {*} BooleanLike
+ */

package/lib/globals/root-path.js

@@ -0,0 +1,7 @@
+import {
+  RootPath,
+} from '@openreachtech/mentsu-rootpath'
+
+const rootPath = RootPath.create()
+
+export default rootPath

package/lib/index.js

@@ -0,0 +1,8 @@
+export { default as AuditFetcher } from './AuditFetcher.js'
+export { default as AuditReportResponse } from './AuditReportResponse.js'
+export { default as IgnoredAdvisoriesLoader } from './IgnoredAdvisoriesLoader.js'
+export { default as NpmAuditGate } from './NpmAuditGate.js'
+export { default as ProcessArgumentsResolver } from './ProcessArgumentsResolver.js'
+export { default as ProcessLogger } from './ProcessLogger.js'
+
+export { default as EXIT_CODE } from './EXIT_CODE.js'

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@openreachtech/mentsu-npm-audit-gate",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Gate that checks the result of npm audit",
+  "type": "module",
+  "main": "lib/index.js",
+  "files": [
+    "lib/",
+    "scripts/",
+    "!scripts/stopgap-audit/IGNORED_ADVISORIES.js",
+    "types/",
+    "!types/env/**"
+  ],
+  "types": "./types/index.d.ts",
+  "scripts": {
+    "audit:npm": "node scripts/npm-audit-gate.js scripts/stopgap-audit/IGNORED_ADVISORIES.js",
+    "l": "npm run lint",
+    "lint": "eslint .",
+    "test": "export NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules\"; export NODE_ENV=development; jest"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openreachtech/mentsu-npm-audit-gate.git"
+  },
+  "author": "Open Reach Tech Inc.",
+  "license": "Apache-2.0",
+  "bugs": {
+    "url": "https://github.com/openreachtech/mentsu-npm-audit-gate/issues"
+  },
+  "homepage": "https://github.com/openreachtech/mentsu-npm-audit-gate#readme",
+  "engines": {
+    "node": ">=24.19.0",
+    "npm": ">=11.17.0"
+  },
+  "dependencies": {
+    "@openreachtech/mentsu-rootpath": "^1.1.3"
+  },
+  "devDependencies": {
+    "@openreachtech/eslint-config": "^4.5.0",
+    "@openreachtech/jest-constructor-spy": "^1.1.2",
+    "@openreachtech/jest-deep-containing": "^1.0.2",
+    "@openreachtech/jest-expect-each": "^1.0.3",
+    "@openreachtech/renchan-env": "^1.1.0",
+    "@types/jest": "^30.0.0",
+    "eslint": "^9.39.5",
+    "jest": "^30.5.2"
+  },
+  "overrides": {
+    "brace-expansion@5": "^5.0.12",
+    "glob": "^14.0.2",
+    "minimatch": "^11.0.4"
+  },
+  "allowScripts": {
+    "@parcel/watcher": false,
+    "unrs-resolver": false
+  }
+}

package/scripts/npm-audit-gate.js

@@ -0,0 +1,31 @@
+import rootPath from '../lib/globals/root-path.js'
+
+import IgnoredAdvisoriesLoader from '../lib/IgnoredAdvisoriesLoader.js'
+import NpmAuditGate from '../lib/NpmAuditGate.js'
+import ProcessArgumentsResolver from '../lib/ProcessArgumentsResolver.js'
+
+const argumentsResolver = ProcessArgumentsResolver.create({
+  rawArguments: process.argv,
+})
+
+const ignoredAdvisoriesPath = argumentsResolver.extractIgnoredAdvisoriesFilePathArgument()
+
+if (ignoredAdvisoriesPath === null) {
+  throw new Error('An argument that specifies the ignored advisories is required')
+}
+
+const loader = IgnoredAdvisoriesLoader.create({
+  ignoredAdvisoriesFilePath: rootPath.to(ignoredAdvisoriesPath),
+})
+
+const ignoredAdvisories = await loader.loadAdvisories()
+
+if (ignoredAdvisories === null) {
+  throw new Error(`Failed to load the ignored advisories: ${ignoredAdvisoriesPath}`)
+}
+
+const gate = NpmAuditGate.create({
+  ignoredAdvisories,
+})
+
+process.exitCode = gate.auditAdvisories()

package/types/index.d.ts

@@ -0,0 +1,49 @@
+import type AuditFetcherActual from '../lib/AuditFetcher.js'
+import type AuditReportResponseActual from '../lib/AuditReportResponse.js'
+import type IgnoredAdvisoriesLoaderActual from '../lib/IgnoredAdvisoriesLoader.js'
+import type NpmAuditGateActual from '../lib/NpmAuditGate.js'
+import type ProcessArgumentsResolverActual from '../lib/ProcessArgumentsResolver.js'
+import type ProcessLoggerActual from '../lib/ProcessLogger.js'
+
+import type EXIT_CODE_ACTUAL from '../lib/EXIT_CODE.js'
+
+export { default as AuditFetcher } from '../lib/AuditFetcher.js'
+export { default as AuditReportResponse } from '../lib/AuditReportResponse.js'
+export { default as IgnoredAdvisoriesLoader } from '../lib/IgnoredAdvisoriesLoader.js'
+export { default as NpmAuditGate } from '../lib/NpmAuditGate.js'
+export { default as ProcessArgumentsResolver } from '../lib/ProcessArgumentsResolver.js'
+export { default as ProcessLogger } from '../lib/ProcessLogger.js'
+
+export { default as EXIT_CODE } from '../lib/EXIT_CODE.js'
+
+declare global {
+  namespace NpmAuditType {
+    type AuditFetcher = AuditFetcherActual
+    type AuditFetcherCtor = typeof AuditFetcherActual
+
+    type AuditReportResponse = AuditReportResponseActual
+    type AuditReportResponseCtor = typeof AuditReportResponseActual
+
+    type IgnoredAdvisoriesLoader = IgnoredAdvisoriesLoaderActual
+    type IgnoredAdvisoriesLoaderCtor = typeof IgnoredAdvisoriesLoaderActual
+
+    type NpmAuditGate = NpmAuditGateActual
+    type NpmAuditGateCtor = typeof NpmAuditGateActual
+
+    type ProcessArgumentsResolver = ProcessArgumentsResolverActual
+    type ProcessArgumentsResolverCtor = typeof ProcessArgumentsResolverActual
+
+    type ProcessLogger = ProcessLoggerActual
+    type ProcessLoggerCtor = typeof ProcessLoggerActual
+
+    type EXIT_CODE = typeof EXIT_CODE_ACTUAL
+
+    type IgnoredAdvisory = {
+      id: string
+      package: string
+      path: string
+      reason: string
+      removeWhen: string
+    }
+  }
+}