npm - @opensip-cli/checks-universal - Versions diffs - 0.1.11 → 0.1.13 - Mend

@opensip-cli/checks-universal 0.1.11 → 0.1.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (70) hide show

package/dist/checks/resilience/unbounded-memory.js CHANGED Viewed

@@ -106,15 +106,57 @@ function isModuleSelfRelativeRead(codeContext) {
 const KNOWN_SMALL_FILE_PATTERNS = [
     'package.json',
     'tsconfig',
+    'pyproject.toml',
     '.json',
     '.yaml',
     '.yml',
     '.toml',
     '.env',
     '.config',
+    'opensip-cli.config',
+    '.opensip-cli',
+    'update-state',
+    'entitlement',
+    'scaffold',
+    'template',
+    'global-config',
+    'manifest',
     '.eslintrc',
     '.prettierrc',
 ];
+const BOUNDED_SOURCE_READ_PATHS = [
+    /[/\\]cli[/\\]src[/\\]commands[/\\]init[/\\]scaffold-writer\.ts$/i,
+    /[/\\]cli[/\\]src[/\\]commands[/\\]plugin[/\\]config-edit\.ts$/i,
+    /[/\\]config[/\\]src[/\\]document[/\\]global-config\.ts$/i,
+    /[/\\]core[/\\]src[/\\]signals[/\\]suppress\.ts$/i,
+    /[/\\]fitness[/\\]engine[/\\]src[/\\]framework[/\\]define-check\.ts$/i,
+    /[/\\]graph[/\\]graph-adapter-common[/\\]src[/\\]cache-key\.ts$/i,
+    /[/\\]graph[/\\]graph-go[/\\]src[/\\]resolve\.ts$/i,
+    /[/\\]graph[/\\]graph-python[/\\]src[/\\]cache-key\.ts$/i,
+    /[/\\]graph[/\\]graph-rust[/\\]src[/\\]resolve-dependencies\.ts$/i,
+    /[/\\]graph[/\\]graph-typescript[/\\]src[/\\]discover\.ts$/i,
+    /[/\\]graph[/\\]graph-typescript[/\\]src[/\\]index\.ts$/i,
+    /[/\\]languages[/\\]lang-typescript[/\\]src[/\\]program-service\.ts$/i,
+    /[/\\]output[/\\]src[/\\]sink[/\\]entitlement\.ts$/i,
+    /[/\\]yagni[/\\]engine[/\\]src[/\\]cli[/\\]execute-yagni\.ts$/i,
+];
+function isKnownBoundedSourceRead(filePath) {
+    return BOUNDED_SOURCE_READ_PATHS.some((pattern) => pattern.test(filePath));
+}
+/** Whole-file markers that prove reads are size-guarded elsewhere in the module. */
+const GUARDED_READ_MARKERS = [
+    'file_too_large',
+    'max_file_size',
+    'maxfilesize',
+    'file too large',
+    'content.length >',
+    'content.length <',
+    'statsync',
+];
+function hasGuardedReadWrapper(content) {
+    const lower = content.toLowerCase();
+    return GUARDED_READ_MARKERS.some((marker) => lower.includes(marker));
+}
 function isReadingKnownSmallFile(content, readIndex) {
     const start = Math.max(0, readIndex - 100);
     const end = Math.min(content.length, readIndex + 150);
@@ -161,7 +203,7 @@ export const unboundedMemory = defineCheck({
 **Detects:**
 - Private class fields initialized with \`new Map(\`, \`new Set(\`, or empty arrays that have growth methods (\`.set\`, \`.push\`, \`.add\`) but no eviction keywords (\`.delete\`, \`.clear\`, \`maxsize\`, \`evict\`, \`prune\`, \`lru\`, etc.)
 - \`readFileSync(\` and \`readFile(\` calls without a preceding \`stat()\` / \`.size\` check within 500 characters
-- Skips \`static\`, \`readonly\`, \`const\`, \`WeakMap\`, and DI token declarations
+- Skips known-small config paths (\`.opensip-cli\`, \`opensip-cli.config\`, manifests), modules with size guards, and \`static\` / \`readonly\` / \`const\` / \`WeakMap\` / DI token declarations
 **Why it matters:** Unbounded in-memory collections cause gradual OOM in long-running services; reading files without size guards risks instant OOM on large inputs.
@@ -197,12 +239,15 @@ export const unboundedMemory = defineCheck({
                 });
             }
         }
+        if (hasGuardedReadWrapper(content)) {
+            return violations;
+        }
         const fileReadCalls = findFileReadCalls(codeOnly);
         for (const readCall of fileReadCalls) {
             const start = Math.max(0, readCall.index - 1500);
             const context = content.slice(start, readCall.index);
             const codeContext = codeOnly.slice(start, readCall.index);
-            if (isReadingKnownSmallFile(content, readCall.index)) {
+            if (isKnownBoundedSourceRead(filePath) || isReadingKnownSmallFile(content, readCall.index)) {
                 continue;
             }
             if (isStructuredParseRead(codeOnly, readCall.index) ||

package/dist/checks/resilience/unbounded-memory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"unbounded-memory.js","sourceRoot":"","sources":["../../../src/checks/resilience/unbounded-memory.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,UAAU,EAEV,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,0CAA0C,EAAE,MAAM,sBAAsB,CAAC;AAElF,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAE3E,uGAAuG;AACvG,MAAM,4BAA4B,GAAG;IACnC,iBAAiB;IACjB,SAAS;IACT,WAAW;IACX,QAAQ;IACR,iBAAiB;IACjB,UAAU;IACV,iBAAiB;IACjB,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,SAAS;IACT,SAAS;CACV,CAAC;AAEF,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe;IACjD,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,8DAA8D;QACnE,GAAG,EAAE,sEAAsE;KAC5E,CAAC,CAAC;IACH,MAAM,OAAO,GAAuC,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,SAAS,CAAC;QACnC,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,oBAAoB;YACzC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtD,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,gBAAgB,GAAG,UAAU;gBACpC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,SAAS;IACT,UAAU;IACV,SAAS;IACT,OAAO;IACP,aAAa;IACb,WAAW;IACX,SAAS;IACT,UAAU;IACV,OAAO;IACP,OAAO;IACP,OAAO;IACP,SAAS;IACT,UAAU;IACV,KAAK;IACL,UAAU;IACV,qBAAqB;CACb,CAAC;AAEX,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,iEAAiE;AACjE,2HAA2H;AAC3H,MAAM,iBAAiB,GAAG,CAAC,eAAe,EAAE,WAAW,CAAU,CAAC;AAElE,MAAM,wBAAwB,GAAG;IAC/B,WAAW;IACX,OAAO;IACP,SAAS;IACT,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,eAAe;IACf,aAAa;CACL,CAAC;AAEX,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAClE,OAAO,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,qBAAqB,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;AAE9F,SAAS,wBAAwB,CAAC,WAAmB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,yBAAyB,GAAG;IAChC,cAAc;IACd,UAAU;IACV,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;IACT,WAAW;IACX,aAAa;~~CACd~~,CAAC;~~AAEF~~,SAAS,uBAAuB,CAAC,OAAe,EAAE,SAAiB;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,GAAG,GAAG,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,sDAAsD;QAC3D,GAAG,EAAE,oEAAoE;KAC1E,CAAC,CAAC;IACH,MAAM,OAAO,GAAuC,EAAE,CAAC;IAEvD,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,OAAO,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjD,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,MAAM;YACtB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,WAAW,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;IACzC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,kBAAkB;IACxB,aAAa,EAAE,eAAe;IAC9B,WAAW,EAAE,gEAAgE;IAC7E,eAAe,EAAE;;;;;;;;;uFASoE;IACrF,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IAClD,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,aAAa,CAAC;IAE7C,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,IAAI,sBAAsB,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,yDAAyD;YAC9D,GAAG,EAAE,oEAAoE;SAC1E,CAAC,CAAC;QACH,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,MAAM,QAAQ,GAAG,0CAA0C,CAAC,OAAO,CAAC,CAAC;QAErE,MAAM,sBAAsB,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QACpE,KAAK,MAAM,WAAW,IAAI,sBAAsB,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YAE3C,IAAI,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC7D,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,kDAAkD;oBAC3D,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,oJAAoJ;oBACtJ,KAAK,EAAE,WAAW,CAAC,KAAK;oBACxB,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAE1D,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;~~gBACrD~~,SAAS;YACX,CAAC;YAED,IACE,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;gBAC/C,wBAAwB,CAAC,WAAW,CAAC,EACrC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC1D,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,iDAAiD;oBAC1D,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,mLAAmL;oBACrL,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}
1	+ {"version":3,"file":"unbounded-memory.js","sourceRoot":"","sources":["../../../src/checks/resilience/unbounded-memory.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,UAAU,EAEV,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,0CAA0C,EAAE,MAAM,sBAAsB,CAAC;AAElF,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAE3E,uGAAuG;AACvG,MAAM,4BAA4B,GAAG;IACnC,iBAAiB;IACjB,SAAS;IACT,WAAW;IACX,QAAQ;IACR,iBAAiB;IACjB,UAAU;IACV,iBAAiB;IACjB,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,SAAS;IACT,SAAS;CACV,CAAC;AAEF,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe;IACjD,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,8DAA8D;QACnE,GAAG,EAAE,sEAAsE;KAC5E,CAAC,CAAC;IACH,MAAM,OAAO,GAAuC,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,SAAS,CAAC;QACnC,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,oBAAoB;YACzC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtD,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,gBAAgB,GAAG,UAAU;gBACpC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,SAAS;IACT,UAAU;IACV,SAAS;IACT,OAAO;IACP,aAAa;IACb,WAAW;IACX,SAAS;IACT,UAAU;IACV,OAAO;IACP,OAAO;IACP,OAAO;IACP,SAAS;IACT,UAAU;IACV,KAAK;IACL,UAAU;IACV,qBAAqB;CACb,CAAC;AAEX,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,iEAAiE;AACjE,2HAA2H;AAC3H,MAAM,iBAAiB,GAAG,CAAC,eAAe,EAAE,WAAW,CAAU,CAAC;AAElE,MAAM,wBAAwB,GAAG;IAC/B,WAAW;IACX,OAAO;IACP,SAAS;IACT,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,eAAe;IACf,aAAa;CACL,CAAC;AAEX,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAClE,OAAO,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,qBAAqB,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;AAE9F,SAAS,wBAAwB,CAAC,WAAmB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,yBAAyB,GAAG;IAChC,cAAc;IACd,UAAU;IACV,gBAAgB;IAChB,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;IACT,oBAAoB;IACpB,cAAc;IACd,cAAc;IACd,aAAa;IACb,UAAU;IACV,UAAU;IACV,eAAe;IACf,UAAU;IACV,WAAW;IACX,aAAa;CACL,CAAC;AAEX,MAAM,yBAAyB,GAAG;IAChC,kEAAkE;IAClE,gEAAgE;IAChE,0DAA0D;IAC1D,kDAAkD;IAClD,sEAAsE;IACtE,iEAAiE;IACjE,mDAAmD;IACnD,yDAAyD;IACzD,kEAAkE;IAClE,4DAA4D;IAC5D,yDAAyD;IACzD,sEAAsE;IACtE,oDAAoD;IACpD,+DAA+D;CACvD,CAAC;AAEX,SAAS,wBAAwB,CAAC,QAAgB;IAChD,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,oFAAoF;AACpF,MAAM,oBAAoB,GAAG;IAC3B,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,UAAU;CACF,CAAC;AAEX,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,SAAiB;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,GAAG,GAAG,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,sDAAsD;QAC3D,GAAG,EAAE,oEAAoE;KAC1E,CAAC,CAAC;IACH,MAAM,OAAO,GAAuC,EAAE,CAAC;IAEvD,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,OAAO,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjD,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,MAAM;YACtB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,WAAW,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;IACzC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,kBAAkB;IACxB,aAAa,EAAE,eAAe;IAC9B,WAAW,EAAE,gEAAgE;IAC7E,eAAe,EAAE;;;;;;;;;uFASoE;IACrF,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IAClD,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,aAAa,CAAC;IAE7C,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,IAAI,sBAAsB,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,yDAAyD;YAC9D,GAAG,EAAE,oEAAoE;SAC1E,CAAC,CAAC;QACH,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,MAAM,QAAQ,GAAG,0CAA0C,CAAC,OAAO,CAAC,CAAC;QAErE,MAAM,sBAAsB,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QACpE,KAAK,MAAM,WAAW,IAAI,sBAAsB,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YAE3C,IAAI,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC7D,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,kDAAkD;oBAC3D,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,oJAAoJ;oBACtJ,KAAK,EAAE,WAAW,CAAC,KAAK;oBACxB,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAE1D,IAAI,wBAAwB,CAAC,QAAQ,CAAC,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3F,SAAS;YACX,CAAC;YAED,IACE,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;gBAC/C,wBAAwB,CAAC,WAAW,CAAC,EACrC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC1D,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,iDAAiD;oBAC1D,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,mLAAmL;oBACrL,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/__tests__/package-supply-chain-policy.test.js CHANGED Viewed

@@ -15,6 +15,7 @@ function writeFixture(cwd, relPath, content) {
 }
 async function runPolicy(cwd) {
     return packageSupplyChainPolicy.run(cwd, {
+        fileCache,
         targetFiles: [join(cwd, 'package.json')],
     });
 }
@@ -141,6 +142,240 @@ describe('package-supply-chain-policy', () => {
             rmSync(cwd, { recursive: true, force: true });
         }
     });
+    it('flags npm publish inside a shell function without provenance', async () => {
+        const cwd = makeProject();
+        try {
+            writeFixture(cwd, 'package.json', JSON.stringify({
+                name: 'shell-fn-app',
+                private: true,
+                packageManager: 'pnpm@11.5.1+sha512.abc123',
+            }, null, 2));
+            writeFixture(cwd, 'pnpm-lock.yaml', ["lockfileVersion: '9.0'", 'packages: {}'].join('\n'));
+            writeFixture(cwd, 'pnpm-workspace.yaml', [
+                'packages:',
+                '  - "."',
+                'allowBuilds:',
+                '  esbuild: false',
+                'minimumReleaseAge: 1440',
+                'minimumReleaseAgeStrict: true',
+            ].join('\n'));
+            writeFixture(cwd, '.github/workflows/release.yml', [
+                'name: Release',
+                'jobs:',
+                '  publish:',
+                '    permissions:',
+                '      id-token: write',
+                '    steps:',
+                '      - run: pnpm install --frozen-lockfile',
+                '      - run: |',
+                '          publish_pkg() {',
+                '            npm publish dist/app-1.0.0.tgz --access public',
+                '          }',
+                '          publish_pkg',
+            ].join('\n'));
+            const result = await runPolicy(cwd);
+            const types = result.signals.map((signal) => signal.metadata.type);
+            expect(types).toContain('publish-provenance-missing');
+        }
+        finally {
+            rmSync(cwd, { recursive: true, force: true });
+        }
+    });
+    it('accepts NPM_CONFIG_PROVENANCE=true on npm publish steps', async () => {
+        const cwd = makeProject();
+        try {
+            writeFixture(cwd, 'package.json', JSON.stringify({
+                name: 'env-provenance-app',
+                private: true,
+                packageManager: 'pnpm@11.5.1+sha512.abc123',
+            }, null, 2));
+            writeFixture(cwd, 'pnpm-lock.yaml', ["lockfileVersion: '9.0'", 'packages: {}'].join('\n'));
+            writeFixture(cwd, 'pnpm-workspace.yaml', [
+                'packages:',
+                '  - "."',
+                'allowBuilds:',
+                '  esbuild: false',
+                'minimumReleaseAge: 1440',
+                'minimumReleaseAgeStrict: true',
+            ].join('\n'));
+            writeFixture(cwd, '.github/workflows/release.yml', [
+                'name: Release',
+                'jobs:',
+                '  publish:',
+                '    permissions:',
+                '      id-token: write',
+                '    steps:',
+                '      - run: pnpm install --frozen-lockfile',
+                '      - run: npm publish dist/app-1.0.0.tgz --access public',
+                '        env:',
+                '          NPM_CONFIG_PROVENANCE: true',
+            ].join('\n'));
+            const result = await runPolicy(cwd);
+            const types = result.signals.map((signal) => signal.metadata.type);
+            expect(types).not.toContain('publish-provenance-missing');
+            expect(types).not.toContain('publish-token-exposure');
+        }
+        finally {
+            rmSync(cwd, { recursive: true, force: true });
+        }
+    });
+    it('does not let provenance env on a previous step bless a publish step', async () => {
+        const cwd = makeProject();
+        try {
+            writeFixture(cwd, 'package.json', JSON.stringify({
+                name: 'env-provenance-wrong-step-app',
+                private: true,
+                packageManager: 'pnpm@11.5.1+sha512.abc123',
+            }, null, 2));
+            writeFixture(cwd, 'pnpm-lock.yaml', ["lockfileVersion: '9.0'", 'packages: {}'].join('\n'));
+            writeFixture(cwd, 'pnpm-workspace.yaml', [
+                'packages:',
+                '  - "."',
+                'allowBuilds:',
+                '  esbuild: false',
+                'minimumReleaseAge: 1440',
+                'minimumReleaseAgeStrict: true',
+            ].join('\n'));
+            writeFixture(cwd, '.github/workflows/release.yml', [
+                'name: Release',
+                'jobs:',
+                '  publish:',
+                '    permissions:',
+                '      id-token: write',
+                '    steps:',
+                '      - run: pnpm install --frozen-lockfile',
+                '        env:',
+                '          NPM_CONFIG_PROVENANCE: true',
+                '      - run: npm publish dist/app-1.0.0.tgz --access public',
+            ].join('\n'));
+            const result = await runPolicy(cwd);
+            const types = result.signals.map((signal) => signal.metadata.type);
+            expect(types).toContain('publish-provenance-missing');
+        }
+        finally {
+            rmSync(cwd, { recursive: true, force: true });
+        }
+    });
+    it('flags unsafe dependency automation automerge for major updates', async () => {
+        const cwd = makeProject();
+        try {
+            writeFixture(cwd, 'package.json', JSON.stringify({
+                name: 'deps-app',
+                private: true,
+                packageManager: 'pnpm@11.5.1+sha512.abc123',
+            }, null, 2));
+            writeFixture(cwd, 'pnpm-lock.yaml', ["lockfileVersion: '9.0'", 'packages: {}'].join('\n'));
+            writeFixture(cwd, 'pnpm-workspace.yaml', [
+                'packages:',
+                '  - "."',
+                'allowBuilds:',
+                '  esbuild: false',
+                'minimumReleaseAge: 1440',
+                'minimumReleaseAgeStrict: true',
+            ].join('\n'));
+            writeFixture(cwd, '.github/dependabot.yml', [
+                'version: 2',
+                'updates:',
+                '  - package-ecosystem: npm',
+                '    directory: /',
+                '    schedule:',
+                '      interval: daily',
+                '    automerge: true',
+                '    update-types:',
+                '      - major',
+            ].join('\n'));
+            const result = await runPolicy(cwd);
+            const types = result.signals.map((signal) => signal.metadata.type);
+            expect(types).toContain('dependency-automation-unsafe-automerge');
+        }
+        finally {
+            rmSync(cwd, { recursive: true, force: true });
+        }
+    });
+    it('flags dependency automation that disables npm update surfaces', async () => {
+        const cwd = makeProject();
+        try {
+            writeFixture(cwd, 'package.json', JSON.stringify({ name: 'deps-app', private: true, packageManager: 'pnpm@11.5.1+sha512.abc123' }, null, 2));
+            writeFixture(cwd, 'pnpm-lock.yaml', ["lockfileVersion: '9.0'", 'packages: {}'].join('\n'));
+            writeFixture(cwd, 'pnpm-workspace.yaml', [
+                'packages:',
+                '  - "."',
+                'allowBuilds:',
+                '  esbuild: false',
+                'minimumReleaseAge: 1440',
+                'minimumReleaseAgeStrict: true',
+            ].join('\n'));
+            // `enabled: false` for the npm ecosystem opts the repo out of dependency updates.
+            writeFixture(cwd, '.github/dependabot.yml', [
+                'version: 2',
+                'updates:',
+                '  - enabled: false',
+                '    package-ecosystem: npm',
+                '    directory: /',
+            ].join('\n'));
+            const result = await runPolicy(cwd);
+            const types = result.signals.map((signal) => signal.metadata.type);
+            expect(types).toContain('dependency-automation-disabled-updates');
+        }
+        finally {
+            rmSync(cwd, { recursive: true, force: true });
+        }
+    });
+    it('does not flag a clean weekly dependency automation config', async () => {
+        const cwd = makeProject();
+        try {
+            writeFixture(cwd, 'package.json', JSON.stringify({ name: 'deps-app', private: true, packageManager: 'pnpm@11.5.1+sha512.abc123' }, null, 2));
+            writeFixture(cwd, 'pnpm-lock.yaml', ["lockfileVersion: '9.0'", 'packages: {}'].join('\n'));
+            writeFixture(cwd, 'pnpm-workspace.yaml', [
+                'packages:',
+                '  - "."',
+                'allowBuilds:',
+                '  esbuild: false',
+                'minimumReleaseAge: 1440',
+                'minimumReleaseAgeStrict: true',
+            ].join('\n'));
+            writeFixture(cwd, '.github/dependabot.yml', [
+                'version: 2',
+                'updates:',
+                '  - package-ecosystem: npm',
+                '    directory: /',
+                '    schedule:',
+                '      interval: weekly',
+                '    open-pull-requests-limit: 10',
+            ].join('\n'));
+            const result = await runPolicy(cwd);
+            const types = result.signals.map((signal) => signal.metadata.type);
+            expect(types.some((t) => String(t).startsWith('dependency-automation-'))).toBe(false);
+        }
+        finally {
+            rmSync(cwd, { recursive: true, force: true });
+        }
+    });
+    it('does not emit a consumer-verification violation for ordinary projects', async () => {
+        const cwd = makeProject();
+        try {
+            writeFixture(cwd, 'package.json', JSON.stringify({
+                name: 'consumer-gap-app',
+                private: true,
+                packageManager: 'pnpm@11.5.1+sha512.abc123',
+            }, null, 2));
+            writeFixture(cwd, 'pnpm-lock.yaml', ["lockfileVersion: '9.0'", 'packages: {}'].join('\n'));
+            writeFixture(cwd, 'pnpm-workspace.yaml', [
+                'packages:',
+                '  - "."',
+                'allowBuilds:',
+                '  esbuild: false',
+                'minimumReleaseAge: 1440',
+                'minimumReleaseAgeStrict: true',
+            ].join('\n'));
+            const result = await runPolicy(cwd);
+            const types = result.signals.map((signal) => signal.metadata.type);
+            expect(types).not.toContain('consumption-verification-missing');
+        }
+        finally {
+            rmSync(cwd, { recursive: true, force: true });
+        }
+    });
     it('still flags a publish token when the workflow has no dist-tag justification', async () => {
         const cwd = makeProject();
         try {

package/dist/checks/security/__tests__/package-supply-chain-policy.test.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"package-supply-chain-policy.test.js","sourceRoot":"","sources":["../../../../src/checks/security/__tests__/package-supply-chain-policy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,SAAS,WAAW;IAClB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,OAAe;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,OAAO,wBAAwB,CAAC,GAAG,CAAC,GAAG,EAAE;QACvC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;gBAC3C,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACjC,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CACV,GAAG,EACH,gBAAgB,EAChB;gBACE,wBAAwB;gBACxB,WAAW;gBACX,eAAe;gBACf,2CAA2C;aAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;gBAC/B,2CAA2C;gBAC3C,2BAA2B;gBAC3B,sBAAsB;gBACtB,0BAA0B;aAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,YAAY,CACV,GAAG,EACH,0BAA0B,EAC1B;gBACE,UAAU;gBACV,OAAO;gBACP,SAAS;gBACT,YAAY;gBACZ,6CAA6C;aAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE;gBACzC,YAAY,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE;aACxD,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CACV,GAAG,EACH,+BAA+B,EAC/B;gBACE,eAAe;gBACf,OAAO;gBACP,YAAY;gBACZ,YAAY;gBACZ,0BAA0B;gBAC1B,0BAA0B;gBAC1B,cAAc;gBACd,qDAAqD;aACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;YACjD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;YACtD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;aAC5C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,6DAA6D;YAC7D,uEAAuE;YACvE,oDAAoD;YACpD,YAAY,CACV,GAAG,EACH,+BAA+B,EAC/B;gBACE,eAAe;gBACf,OAAO;gBACP,YAAY;gBACZ,kBAAkB;gBAClB,uBAAuB;gBACvB,YAAY;gBACZ,6CAA6C;gBAC7C,uDAAuD;gBACvD,gDAAgD;gBAChD,cAAc;gBACd,qDAAqD;gBACrD,mDAAmD;aACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;YACtD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAC5D,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;aAC5C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,2DAA2D;YAC3D,yEAAyE;YACzE,YAAY,CACV,GAAG,EACH,+BAA+B,EAC/B;gBACE,eAAe;gBACf,OAAO;gBACP,YAAY;gBACZ,kBAAkB;gBAClB,uBAAuB;gBACvB,YAAY;gBACZ,6CAA6C;gBAC7C,uDAAuD;gBACvD,cAAc;gBACd,qDAAqD;aACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,aAAa;aAC9B,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACrF,YAAY,CACV,GAAG,EACH,mBAAmB,EACnB,IAAI,CAAC,SAAS,CACZ;gBACE,eAAe,EAAE,CAAC;gBAClB,QAAQ,EAAE;oBACR,kBAAkB,EAAE;wBAClB,OAAO,EAAE,OAAO;wBAChB,QAAQ,EAAE,gDAAgD;qBAC3D;iBACF;aACF,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CACV,GAAG,EACH,0BAA0B,EAC1B,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACjF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC9D,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"package-supply-chain-policy.test.js","sourceRoot":"","sources":["../../../../src/checks/security/__tests__/package-supply-chain-policy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,SAAS,WAAW;IAClB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,OAAe;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,OAAO,wBAAwB,CAAC,GAAG,CAAC,GAAG,EAAE;QACvC,SAAS;QACT,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;gBAC3C,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACjC,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CACV,GAAG,EACH,gBAAgB,EAChB;gBACE,wBAAwB;gBACxB,WAAW;gBACX,eAAe;gBACf,2CAA2C;aAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;gBAC/B,2CAA2C;gBAC3C,2BAA2B;gBAC3B,sBAAsB;gBACtB,0BAA0B;aAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,YAAY,CACV,GAAG,EACH,0BAA0B,EAC1B;gBACE,UAAU;gBACV,OAAO;gBACP,SAAS;gBACT,YAAY;gBACZ,6CAA6C;aAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE;gBACzC,YAAY,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE;aACxD,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CACV,GAAG,EACH,+BAA+B,EAC/B;gBACE,eAAe;gBACf,OAAO;gBACP,YAAY;gBACZ,YAAY;gBACZ,0BAA0B;gBAC1B,0BAA0B;gBAC1B,cAAc;gBACd,qDAAqD;aACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;YACjD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;YACtD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;aAC5C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,6DAA6D;YAC7D,uEAAuE;YACvE,oDAAoD;YACpD,YAAY,CACV,GAAG,EACH,+BAA+B,EAC/B;gBACE,eAAe;gBACf,OAAO;gBACP,YAAY;gBACZ,kBAAkB;gBAClB,uBAAuB;gBACvB,YAAY;gBACZ,6CAA6C;gBAC7C,uDAAuD;gBACvD,gDAAgD;gBAChD,cAAc;gBACd,qDAAqD;gBACrD,mDAAmD;aACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;YACtD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAC5D,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;aAC5C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,YAAY,CACV,GAAG,EACH,+BAA+B,EAC/B;gBACE,eAAe;gBACf,OAAO;gBACP,YAAY;gBACZ,kBAAkB;gBAClB,uBAAuB;gBACvB,YAAY;gBACZ,6CAA6C;gBAC7C,gBAAgB;gBAChB,2BAA2B;gBAC3B,4DAA4D;gBAC5D,aAAa;gBACb,uBAAuB;aACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;aAC5C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,YAAY,CACV,GAAG,EACH,+BAA+B,EAC/B;gBACE,eAAe;gBACf,OAAO;gBACP,YAAY;gBACZ,kBAAkB;gBAClB,uBAAuB;gBACvB,YAAY;gBACZ,6CAA6C;gBAC7C,6DAA6D;gBAC7D,cAAc;gBACd,uCAAuC;aACxC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;YAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;aAC5C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,YAAY,CACV,GAAG,EACH,+BAA+B,EAC/B;gBACE,eAAe;gBACf,OAAO;gBACP,YAAY;gBACZ,kBAAkB;gBAClB,uBAAuB;gBACvB,YAAY;gBACZ,6CAA6C;gBAC7C,cAAc;gBACd,uCAAuC;gBACvC,6DAA6D;aAC9D,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;aAC5C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,YAAY,CACV,GAAG,EACH,wBAAwB,EACxB;gBACE,YAAY;gBACZ,UAAU;gBACV,4BAA4B;gBAC5B,kBAAkB;gBAClB,eAAe;gBACf,uBAAuB;gBACvB,qBAAqB;gBACrB,mBAAmB;gBACnB,eAAe;aAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;QACpE,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,2BAA2B,EAAE,EAChF,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,kFAAkF;YAClF,YAAY,CACV,GAAG,EACH,wBAAwB,EACxB;gBACE,YAAY;gBACZ,UAAU;gBACV,oBAAoB;gBACpB,4BAA4B;gBAC5B,kBAAkB;aACnB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;QACpE,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,2BAA2B,EAAE,EAChF,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,YAAY,CACV,GAAG,EACH,wBAAwB,EACxB;gBACE,YAAY;gBACZ,UAAU;gBACV,4BAA4B;gBAC5B,kBAAkB;gBAClB,eAAe;gBACf,wBAAwB;gBACxB,kCAAkC;aACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxF,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;aAC5C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAClE,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;aAC5C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,2DAA2D;YAC3D,yEAAyE;YACzE,YAAY,CACV,GAAG,EACH,+BAA+B,EAC/B;gBACE,eAAe;gBACf,OAAO;gBACP,YAAY;gBACZ,kBAAkB;gBAClB,uBAAuB;gBACvB,YAAY;gBACZ,6CAA6C;gBAC7C,uDAAuD;gBACvD,cAAc;gBACd,qDAAqD;aACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,aAAa;aAC9B,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACrF,YAAY,CACV,GAAG,EACH,mBAAmB,EACnB,IAAI,CAAC,SAAS,CACZ;gBACE,eAAe,EAAE,CAAC;gBAClB,QAAQ,EAAE;oBACR,kBAAkB,EAAE;wBAClB,OAAO,EAAE,OAAO;wBAChB,QAAQ,EAAE,gDAAgD;qBAC3D;iBACF;aACF,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CACV,GAAG,EACH,0BAA0B,EAC1B,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACjF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC9D,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/security/package-supply-chain-policy.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"package-supply-chain-policy.d.ts","sourceRoot":"","sources":["../../../src/checks/security/package-supply-chain-policy.ts"],"names":[],"mappings":"~~AACA~~;;;;;;;GAOG;AAKH,OAAO,EAAe,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;~~AAilB3F~~,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,~~CAe3B~~;AAED,eAAO,MAAM,wBAAwB,~~sCA2BnC~~,CAAC"}
1	+ {"version":3,"file":"package-supply-chain-policy.d.ts","sourceRoot":"","sources":["../../../src/checks/security/package-supply-chain-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAe,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AA2qB3F,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,CAgB3B;AAED,eAAO,MAAM,wBAAwB,sCA8BnC,CAAC"}

package/dist/checks/security/package-supply-chain-policy.js CHANGED Viewed

@@ -1,4 +1,3 @@
-// @fitness-ignore-file unbounded-memory -- reads small repository config files (package.json, lockfiles, workflows); bounded by standard project metadata size
 /**
  * @fileoverview Package supply-chain policy check
  *
@@ -417,6 +416,45 @@ function isMutableInstallLine(line) {
         (/\bpnpm\s+(?:install|i)\b/.test(line) && !line.includes('--frozen-lockfile')) ||
         (/\bbun\s+install\b/.test(line) && !line.includes('--frozen-lockfile')));
 }
+const WORKFLOW_STEP_START_RE = /^\s*-\s+(?:name|run|uses|id|if|env|with|shell|working-directory|continue-on-error|timeout-minutes):/;
+function splitWorkflowSteps(content) {
+    const lines = content.split('\n');
+    const steps = [];
+    let current = [];
+    for (const line of lines) {
+        if (WORKFLOW_STEP_START_RE.test(line) && current.length > 0) {
+            steps.push(current.join('\n'));
+            current = [line];
+            continue;
+        }
+        current.push(line);
+    }
+    if (current.length > 0)
+        steps.push(current.join('\n'));
+    return steps;
+}
+function executableStepText(step) {
+    return step
+        .split('\n')
+        .filter((line) => !line.trimStart().startsWith('#'))
+        .join('\n');
+}
+function extractPublishBlocks(workflowContent) {
+    const blocks = [];
+    for (const step of splitWorkflowSteps(workflowContent)) {
+        const executable = executableStepText(step);
+        if (/\bnpm\s+publish\b/.test(executable)) {
+            blocks.push(executable);
+        }
+    }
+    return blocks;
+}
+function publishBlockHasProvenance(block) {
+    return /(--provenance|NPM_CONFIG_PROVENANCE\s*[:=]\s*true|provenance:\s*true)/.test(block);
+}
+function publishBlockReferencesLongLivedToken(block) {
+    return /\bnpm\s+publish\b/.test(block) && /(NPM_TOKEN|NODE_AUTH_TOKEN)/.test(block);
+}
 function checkFrozenCiInstalls(snapshot, violations) {
     if (snapshot.workflows.length === 0)
         return;
@@ -463,37 +501,83 @@ function checkTrustedPublishing(snapshot, violations) {
                 line: lineOf(workflow.content, 'npm publish'),
             });
         }
-        if (!/(--provenance|NPM_CONFIG_PROVENANCE\s*[:=]\s*true|provenance:\s*true)/.test(workflow.content)) {
-            pushViolation(violations, {
-                filePath: workflow.filePath,
-                type: 'publish-provenance-missing',
-                message: `${workflow.relPath} publishes to npm without explicit provenance`,
-                suggestion: 'Publish with npm trusted publishing and --provenance so consumers can verify build provenance.',
-                line: lineOf(workflow.content, 'npm publish'),
-            });
-        }
-        if (/(NPM_TOKEN|NODE_AUTH_TOKEN)/.test(workflow.content)) {
-            // OIDC trusted publishing covers `npm publish` only — it does NOT cover
-            // `npm dist-tag`. A staged-publish→promote lane that publishes via OIDC
-            // but uses a classic token solely for `npm dist-tag add` (e.g. promoting
-            // a release-candidate tag to `latest`) is the legitimate, OIDC-uncovered
-            // exception, so we do not flag its token. We still flag token-based
-            // publish (a token with no `id-token: write`) and a token alongside
-            // `npm publish` with no `npm dist-tag` justification.
-            const usesDistTag = /\bnpm\s+dist-tag\b/.test(workflow.content);
-            const usesOidc = /id-token:\s*write/.test(workflow.content);
-            if (!(usesDistTag && usesOidc)) {
+        const publishBlocks = extractPublishBlocks(workflow.content);
+        for (const block of publishBlocks) {
+            if (!publishBlockHasProvenance(block)) {
+                pushViolation(violations, {
+                    filePath: workflow.filePath,
+                    type: 'publish-provenance-missing',
+                    message: `${workflow.relPath} publishes to npm without explicit provenance in an npm publish step`,
+                    suggestion: 'Publish with npm trusted publishing and --provenance (or NPM_CONFIG_PROVENANCE=true) on every npm publish command, including commands inside shell functions. Producer provenance is distinct from consumption-side verification by installers/loaders.',
+                    severity: 'error',
+                    line: lineOf(workflow.content, 'npm publish'),
+                });
+            }
+            if (publishBlockReferencesLongLivedToken(block)) {
                 pushViolation(violations, {
                     filePath: workflow.filePath,
                     type: 'publish-token-exposure',
-                    message: `${workflow.relPath} references a long-lived npm publish token`,
-                    suggestion: 'Prefer npm trusted publishing/OIDC. Remove NPM_TOKEN/NODE_AUTH_TOKEN from publish jobs after migration. A token confined to `npm dist-tag` promotion in an OIDC publish workflow is acceptable (OIDC does not cover dist-tag).',
+                    message: `${workflow.relPath} references a long-lived npm token in an npm publish step`,
+                    suggestion: 'Prefer npm trusted publishing/OIDC for npm publish. A token confined to `npm dist-tag` promotion in an OIDC workflow is acceptable (OIDC does not cover dist-tag).',
+                    severity: 'error',
                     line: lineOf(workflow.content, /NPM_TOKEN|NODE_AUTH_TOKEN/),
                 });
             }
         }
     }
 }
+function checkDependencyAutomation(snapshot, violations) {
+    const rootDir = snapshot.rootDir;
+    const dependabotPath = path.join(rootDir, '.github/dependabot.yml');
+    const renovatePath = path.join(rootDir, 'renovate.json');
+    const dependabotContent = readIfExists(dependabotPath);
+    const renovateContent = readIfExists(renovatePath);
+    if (!dependabotContent && !renovateContent)
+        return;
+    if (dependabotContent && renovateContent) {
+        pushViolation(violations, {
+            filePath: dependabotPath,
+            type: 'dependency-automation-conflict',
+            message: 'Both dependabot.yml and renovate.json are present',
+            suggestion: 'Choose one dependency automation tool (Dependabot or Renovate), not both.',
+            severity: 'error',
+        });
+        return;
+    }
+    const content = dependabotContent ?? renovateContent ?? '';
+    const filePath = dependabotContent ? dependabotPath : renovatePath;
+    if (/automerge:\s*true/i.test(content) && /update-types:[\s\S]*major/i.test(content)) {
+        pushViolation(violations, {
+            filePath,
+            type: 'dependency-automation-unsafe-automerge',
+            message: 'Dependency automation enables automerge for major updates',
+            suggestion: 'Require maintainer review for major runtime dependency updates.',
+            severity: 'error',
+        });
+    }
+    if (/automergeType:\s*["']?all["']?/i.test(content)) {
+        pushViolation(violations, {
+            filePath,
+            type: 'dependency-automation-unsafe-automerge',
+            message: 'Dependency automation enables automergeType: all',
+            suggestion: 'Do not automerge dependency updates in this repo.',
+            severity: 'error',
+        });
+    }
+    // Disabling the npm/GitHub-Actions update surface (or ignoring everything)
+    // silently opts the repo out of dependency hygiene — mirror verify-supply-chain
+    // check 6 so the reusable check enforces the same policy.
+    if (/ignore:\s*\[\s*\*/.test(content) ||
+        /enabled:\s*false[\s\S]*package-ecosystem:\s*npm/i.test(content)) {
+        pushViolation(violations, {
+            filePath,
+            type: 'dependency-automation-disabled-updates',
+            message: 'Dependency automation disables npm dependency updates',
+            suggestion: 'Keep npm dependency updates enabled — avoid `ignore: ["*"]` or `enabled: false` for the npm ecosystem.',
+            severity: 'error',
+        });
+    }
+}
 export async function analyzePackageSupplyChainPolicy(files) {
     const snapshot = await buildSnapshot(files);
     if (!snapshot)
@@ -508,6 +592,7 @@ export async function analyzePackageSupplyChainPolicy(files) {
     checkMinimumReleaseAge(snapshot, violations);
     checkFrozenCiInstalls(snapshot, violations);
     checkTrustedPublishing(snapshot, violations);
+    checkDependencyAutomation(snapshot, violations);
     return violations;
 }
 export const packageSupplyChainPolicy = defineCheck({
@@ -528,7 +613,10 @@ export const packageSupplyChainPolicy = defineCheck({
 - Install-time lifecycle scripts and missing install-script allowlists
 - Missing dependency release-age gates
 - CI install commands that can rewrite lockfiles
-- npm publish workflows that lack OIDC/provenance or still use long-lived tokens (a token confined to \`npm dist-tag\` promotion in an OIDC publish workflow is exempt — OIDC covers \`npm publish\`, not \`npm dist-tag\`)
+- npm publish workflows that lack OIDC/provenance or still use long-lived tokens in \`npm publish\` steps (a token confined to \`npm dist-tag\` promotion in an OIDC publish workflow is exempt — OIDC covers \`npm publish\`, not \`npm dist-tag\`)
+- Unsafe dependency-automation automerge settings when Dependabot/Renovate config is present
+**Producer vs consumer provenance:** this check enforces **producer-side** publish workflow posture. **Consumption-side** verification (install/load provenance for third-party packages) is a separate trust policy and is not enforced by this check.
 **Why it matters:** Modern npm-family attacks often execute during installation, exploit fresh compromised versions before takedown, or bypass weakened lockfile/install-script policy. These checks keep the project in a fail-closed posture before dependency code runs in CI or developer machines.