@prodgator/report 3.5.0 → 3.19.1

package/dist/cli.js

@@ -634,7 +634,7 @@ var require_scan = __commonJS({
 var require_parse = __commonJS({
   "node_modules/picomatch/lib/parse.js"(exports2, module2) {
     "use strict";
-    var constants = require_constants();
+    var constants2 = require_constants();
     var utils = require_utils();
     var {
       MAX_LENGTH,
@@ -642,7 +642,7 @@ var require_parse = __commonJS({
       REGEX_NON_SPECIAL_CHARS,
       REGEX_SPECIAL_CHARS_BACKREF,
       REPLACEMENTS
-    } = constants;
+    } = constants2;
     var expandRange = (args, options) => {
       if (typeof options.expandRange === "function") {
         return options.expandRange(...args, options);
@@ -851,7 +851,7 @@ var require_parse = __commonJS({
       if (options.maxExtglobRecursion === false) {
         return { risky: false };
       }
-      const max = typeof options.maxExtglobRecursion === "number" ? options.maxExtglobRecursion : constants.DEFAULT_MAX_EXTGLOB_RECURSION;
+      const max = typeof options.maxExtglobRecursion === "number" ? options.maxExtglobRecursion : constants2.DEFAULT_MAX_EXTGLOB_RECURSION;
       const branches = splitTopLevel(body).map((branch) => branch.trim());
       if (branches.length > 1) {
         if (branches.some((branch) => branch === "") || branches.some((branch) => /^[*?]+$/.test(branch)) || hasRepeatedCharPrefixOverlap(branches)) {
@@ -897,8 +897,8 @@ var require_parse = __commonJS({
       const bos = { type: "bos", value: "", output: opts.prepend || "" };
       const tokens = [bos];
       const capture = opts.capture ? "" : "?:";
-      const PLATFORM_CHARS = constants.globChars(opts.windows);
-      const EXTGLOB_CHARS = constants.extglobChars(PLATFORM_CHARS);
+      const PLATFORM_CHARS = constants2.globChars(opts.windows);
+      const EXTGLOB_CHARS = constants2.extglobChars(PLATFORM_CHARS);
       const {
         DOT_LITERAL,
         PLUS_LITERAL,
@@ -1594,7 +1594,7 @@ var require_parse = __commonJS({
         NO_DOTS_SLASH,
         STAR,
         START_ANCHOR
-      } = constants.globChars(opts.windows);
+      } = constants2.globChars(opts.windows);
       const nodot = opts.dot ? NO_DOTS : NO_DOT;
       const slashDot = opts.dot ? NO_DOTS_SLASH : NO_DOT;
       const capture = opts.capture ? "" : "?:";
@@ -1652,7 +1652,7 @@ var require_picomatch = __commonJS({
     var scan = require_scan();
     var parse = require_parse();
     var utils = require_utils();
-    var constants = require_constants();
+    var constants2 = require_constants();
     var isObject = (val) => val && typeof val === "object" && !Array.isArray(val);
     var picomatch = (glob2, options, returnState = false) => {
       if (Array.isArray(glob2)) {
@@ -1780,7 +1780,7 @@ var require_picomatch = __commonJS({
         return /$^/;
       }
     };
-    picomatch.constants = constants;
+    picomatch.constants = constants2;
     module2.exports = picomatch;
   }
 });
@@ -1826,7 +1826,7 @@ var require_dist = __commonJS({
       enumerable: true
     }) : target, mod));
     var path = __toESM2(require("path"));
-    var fs5 = __toESM2(require("fs"));
+    var fs2 = __toESM2(require("fs"));
     function cleanPath(path$1) {
       let normalized = (0, path.normalize)(path$1);
       if (normalized.length > 1 && normalized[normalized.length - 1] === path.sep) normalized = normalized.substring(0, normalized.length - 1);
@@ -2123,7 +2123,7 @@ var require_dist = __commonJS({
           symlinks: /* @__PURE__ */ new Map(),
           visited: [""].slice(0, 0),
           controller: new Aborter(),
-          fs: options.fs || fs5
+          fs: options.fs || fs2
         };
         this.joinPath = build$7(this.root, options);
         this.pushDirectory = build$6(this.root, options);
@@ -2358,7 +2358,7 @@ var require_dist2 = __commonJS({
       value: mod,
       enumerable: true
     }) : target, mod));
-    var fs5 = require("fs");
+    var fs2 = require("fs");
     var path = require("path");
     var url = require("url");
     var fdir = require_dist();
@@ -2607,12 +2607,12 @@ var require_dist2 = __commonJS({
       opts.cwd = (opts.cwd instanceof URL ? (0, url.fileURLToPath)(opts.cwd) : (0, path.resolve)(opts.cwd || process.cwd())).replace(BACKSLASHES, "/");
       opts.ignore = ensureStringArray(opts.ignore);
       opts.fs && (opts.fs = {
-        readdir: opts.fs.readdir || fs5.readdir,
-        readdirSync: opts.fs.readdirSync || fs5.readdirSync,
-        realpath: opts.fs.realpath || fs5.realpath,
-        realpathSync: opts.fs.realpathSync || fs5.realpathSync,
-        stat: opts.fs.stat || fs5.stat,
-        statSync: opts.fs.statSync || fs5.statSync
+        readdir: opts.fs.readdir || fs2.readdir,
+        readdirSync: opts.fs.readdirSync || fs2.readdirSync,
+        realpath: opts.fs.realpath || fs2.realpath,
+        realpathSync: opts.fs.realpathSync || fs2.realpathSync,
+        stat: opts.fs.stat || fs2.stat,
+        statSync: opts.fs.statSync || fs2.statSync
       });
       if (opts.debug) log("globbing with options:", opts);
       return opts;
@@ -2626,12 +2626,12 @@ var require_dist2 = __commonJS({
       return patterns.length > 0 ? buildCrawler(options, patterns) : [];
     }
     async function glob2(globInput, options) {
-      const [crawler, relative4] = getCrawler(globInput, options);
-      return crawler ? formatPaths(await crawler.withPromise(), relative4) : [];
+      const [crawler, relative3] = getCrawler(globInput, options);
+      return crawler ? formatPaths(await crawler.withPromise(), relative3) : [];
     }
     function globSync(globInput, options) {
-      const [crawler, relative4] = getCrawler(globInput, options);
-      return crawler ? formatPaths(crawler.sync(), relative4) : [];
+      const [crawler, relative3] = getCrawler(globInput, options);
+      return crawler ? formatPaths(crawler.sync(), relative3) : [];
     }
     exports2.convertPathToPattern = convertPathToPattern;
     exports2.escapePath = escapePath;
@@ -2641,10 +2641,6 @@ var require_dist2 = __commonJS({
   }
 });
 
-// src/cli/main.ts
-var import_fs5 = require("fs");
-var import_path4 = require("path");
-
 // src/core/text.ts
 var MAX_SUMMARY_BYTES = 1024 * 1024;
 var MARKER = "\n\n\u2026(truncated by prodgator-report)";
@@ -2656,9 +2652,6 @@ function truncateUtf8(text, maxBytes) {
   return { text: bytes.subarray(0, end).toString("utf8") + MARKER, truncated: true };
 }
 
-// src/core/junit.ts
-var import_fs = require("fs");
-
 // node_modules/fast-xml-parser/src/util.js
 var nameStartChar = ":A-Za-z_\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD";
 var nameChar = nameStartChar + "\\-.\\d\\u00B7\\u0300-\\u036F\\u203F-\\u2040";
@@ -5087,21 +5080,21 @@ var Matcher = class {
    * @returns {string}
    */
   toString(separator, includeNamespace = true) {
-    const sep4 = separator || this.separator;
-    const isDefault = sep4 === this.separator && includeNamespace === true;
+    const sep3 = separator || this.separator;
+    const isDefault = sep3 === this.separator && includeNamespace === true;
     if (isDefault) {
       if (this._pathStringCache !== null) {
         return this._pathStringCache;
       }
       const result = this.path.map(
         (n) => n.namespace ? `${n.namespace}:${n.tag}` : n.tag
-      ).join(sep4);
+      ).join(sep3);
       this._pathStringCache = result;
       return result;
     }
     return this.path.map(
       (n) => includeNamespace && n.namespace ? `${n.namespace}:${n.tag}` : n.tag
-    ).join(sep4);
+    ).join(sep3);
   }
   /**
    * Get path as array of tag names.
@@ -6778,6 +6771,103 @@ var XMLParser = class {
   }
 };
 
+// src/core/safe-path.ts
+var import_crypto = require("crypto");
+var import_fs = require("fs");
+var import_path = require("path");
+var O_NOFOLLOW = import_fs.constants.O_NOFOLLOW ?? 0;
+var outside = (rel) => !rel || rel === ".." || rel.startsWith(`..${import_path.sep}`) || rel.startsWith("../") || (0, import_path.isAbsolute)(rel) || /^[A-Za-z]:/.test(rel);
+var underGit = (rel) => rel.split(/[\\/]/).includes(".git");
+var refuse = (reason, message) => ({ ok: false, reason, message });
+function displayName(root, file) {
+  const rel = (0, import_path.relative)((0, import_path.resolve)(root), (0, import_path.resolve)(root, file));
+  return outside(rel) ? file : rel.split(import_path.sep).join("/");
+}
+async function checkWorkspacePath(root, name, opts = {}) {
+  const display = opts.display ?? name;
+  const absolute = (0, import_path.resolve)(root, name);
+  const rel = (0, import_path.relative)((0, import_path.resolve)(root), absolute);
+  if (outside(rel)) return refuse("outside", `${display} is outside the workspace`);
+  const path = rel.split(import_path.sep).join("/");
+  if (underGit(path)) return refuse("git", `${display} is inside a .git directory`);
+  let real;
+  let realRoot;
+  try {
+    [real, realRoot] = await Promise.all([import_fs.promises.realpath(absolute), import_fs.promises.realpath(root)]);
+  } catch {
+    return refuse("missing", `${display} was not found`);
+  }
+  const realRel = (0, import_path.relative)(realRoot, real);
+  if (outside(realRel)) return refuse("symlink", `${display} resolves outside the workspace (symlink)`);
+  if (underGit(realRel)) return refuse("git", `${display} resolves into a .git directory (symlink)`);
+  if (opts.followLinks === false && realRel !== rel) return refuse("symlink", `${display} is a symlink`);
+  return { ok: true, file: { absolute, path, real } };
+}
+async function openWorkspaceFile(root, name, opts = {}) {
+  const display = opts.display ?? name;
+  const checked = await checkWorkspacePath(root, name, opts);
+  if (!checked.ok) return checked;
+  const { file } = checked;
+  let handle;
+  try {
+    handle = await import_fs.promises.open(file.real, import_fs.constants.O_RDONLY | O_NOFOLLOW);
+  } catch (e) {
+    const code = e.code;
+    return code === "ENOENT" ? refuse("missing", `${display} was not found`) : refuse("changed", `${display} could not be opened safely`);
+  }
+  try {
+    const st = await handle.stat();
+    if (!st.isFile()) {
+      await handle.close();
+      return refuse("not-file", `${display} is not a file`);
+    }
+    if (!await sameFile(handle, st, file.real, await import_fs.promises.realpath(root))) {
+      await handle.close();
+      return refuse("changed", `${display} changed before it could be read (symlink)`);
+    }
+    return { ok: true, file, size: st.size, handle };
+  } catch {
+    await handle.close().catch(() => {
+    });
+    return refuse("changed", `${display} changed before it could be read (symlink)`);
+  }
+}
+async function sameFile(handle, st, real, realRoot) {
+  const viaProc = await import_fs.promises.realpath(`/proc/self/fd/${handle.fd}`).catch(() => null);
+  if (viaProc !== null) {
+    const rel = (0, import_path.relative)(realRoot, viaProc);
+    return viaProc === real && !outside(rel) && !underGit(rel);
+  }
+  const again = await import_fs.promises.realpath(real).catch(() => null);
+  if (again !== real) return false;
+  const now = await import_fs.promises.stat(real).catch(() => null);
+  return !!now && now.dev === st.dev && now.ino === st.ino;
+}
+async function readWorkspaceText(root, name, opts = {}) {
+  const opened = await openWorkspaceFile(root, name, opts);
+  if (!opened.ok) return opened;
+  try {
+    if (opts.maxBytes !== void 0 && opened.size > opts.maxBytes) return { ok: true, file: opened.file, size: opened.size, text: null };
+    return { ok: true, file: opened.file, size: opened.size, text: await opened.handle.readFile("utf8") };
+  } finally {
+    await opened.handle.close();
+  }
+}
+async function sha256Handle(handle) {
+  const hash = (0, import_crypto.createHash)("sha256");
+  for await (const chunk of handle.createReadStream({ autoClose: false, start: 0 })) hash.update(chunk);
+  return hash.digest("hex");
+}
+async function hashWorkspaceFile(root, name, opts = {}) {
+  const opened = await openWorkspaceFile(root, name, opts);
+  if (!opened.ok) return opened;
+  try {
+    return { ok: true, file: opened.file, size: opened.size, sha256: await sha256Handle(opened.handle) };
+  } finally {
+    await opened.handle.close();
+  }
+}
+
 // src/core/junit.ts
 var MAX_FILE_BYTES = 50 * 1024 * 1024;
 var MAX_FILES = 500;
@@ -6822,12 +6912,17 @@ async function junitAttestation(patterns, opts) {
   if (!patterns.length) return null;
   const find = opts.glob;
   const files = (await find(patterns)).slice(0, MAX_FILES);
-  if (!files.length) return null;
   const total = empty();
+  let read = 0;
   for (const f of files) {
-    const stat = await import_fs.promises.stat(f);
-    if (stat.size > MAX_FILE_BYTES) continue;
-    const t = parseJUnitXml(await import_fs.promises.readFile(f, "utf8"));
+    const r = await readWorkspaceText(opts.workspace, f, { maxBytes: MAX_FILE_BYTES, display: displayName(opts.workspace, f) });
+    if (!r.ok) {
+      if (r.reason !== "missing") opts.warn(`${r.message} and was not read`);
+      continue;
+    }
+    read++;
+    if (r.text === null) continue;
+    const t = parseJUnitXml(r.text);
     total.passed += t.passed;
     total.failed += t.failed;
     total.skipped += t.skipped;
@@ -6835,87 +6930,22 @@ async function junitAttestation(patterns, opts) {
     total.durationSeconds = (total.durationSeconds ?? 0) + (t.durationSeconds ?? 0);
     total.failures.push(...t.failures.slice(0, 50 - total.failures.length));
   }
+  if (!read) return null;
   return { kind: "test-results", name: opts.name ?? "junit", data: { ...total } };
 }
 
 // src/core/attestations.ts
-var import_fs3 = require("fs");
+var import_crypto2 = require("crypto");
 var import_path2 = require("path");
-
-// src/core/artifacts.ts
-var import_crypto = require("crypto");
-var import_fs2 = require("fs");
-var import_path = require("path");
-var MAX_ARTIFACT_FILES = 50;
-var TYPES = {
-  ".zip": "application/zip",
-  ".gz": "application/gzip",
-  ".tgz": "application/gzip",
-  ".tar": "application/x-tar",
-  ".json": "application/json",
-  ".xml": "application/xml",
-  ".pdf": "application/pdf",
-  ".txt": "text/plain",
-  ".log": "text/plain",
-  ".info": "text/plain",
-  ".md": "text/markdown",
-  ".csv": "text/csv",
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".svg": "image/svg+xml"
-};
-var contentTypeFor = (path) => TYPES[(0, import_path.extname)(path).toLowerCase()] ?? "application/octet-stream";
-function sha256File(path) {
-  return new Promise((resolveHash, reject) => {
-    const hash = (0, import_crypto.createHash)("sha256");
-    (0, import_fs2.createReadStream)(path).on("error", reject).on("data", (c) => hash.update(c)).on("end", () => resolveHash(hash.digest("hex")));
-  });
-}
-var outside = (rel) => !rel || rel.startsWith("..") || (0, import_path.isAbsolute)(rel) || /^[A-Za-z]:/.test(rel);
-async function refusalFor(absolute, path, workspace) {
-  if (path.split("/").includes(".git")) return `${path} is inside a .git directory and was not uploaded`;
-  const [real, root] = await Promise.all([import_fs2.promises.realpath(absolute), import_fs2.promises.realpath(workspace)]);
-  if (outside((0, import_path.relative)(root, real))) return `${path} resolves outside the workspace (symlink) and was not uploaded`;
-  return null;
-}
-async function collectArtifacts(patterns, workspace, deps) {
-  const warnings = [];
-  if (!patterns.length) return { files: [], warnings };
-  const find = deps.glob;
-  const inside = [];
-  for (const absolute of [...new Set(await find(patterns))]) {
-    const rel = (0, import_path.relative)(workspace, absolute);
-    if (outside(rel)) {
-      warnings.push(`${absolute} is outside the workspace and was not uploaded`);
-      continue;
-    }
-    const path = rel.split(import_path.sep).join("/");
-    const refused = await refusalFor(absolute, path, workspace);
-    if (refused) {
-      warnings.push(refused);
-      continue;
-    }
-    inside.push({ absolute, path });
-  }
-  inside.sort((a, b) => a.path.localeCompare(b.path));
-  if (inside.length > MAX_ARTIFACT_FILES) warnings.push(`${inside.length} files matched; only the first ${MAX_ARTIFACT_FILES} are uploaded`);
-  const files = [];
-  for (const f of inside.slice(0, MAX_ARTIFACT_FILES)) {
-    const stat = await import_fs2.promises.stat(f.absolute);
-    if (!stat.isFile() || stat.size === 0) continue;
-    files.push({ path: f.path, absolute: f.absolute, size: stat.size, sha256: await sha256File(f.absolute), contentType: contentTypeFor(f.path) });
-  }
-  return { files, warnings };
-}
-
-// src/core/attestations.ts
 var KINDS = ["test-results", "coverage", "sbom", "scan", "custom", "provenance"];
-function parseAttestationsInput(value, workspace) {
+async function parseAttestationsInput(value, workspace) {
   if (!value) return [];
-  const text = /^\s*[[{]/.test(value) ? value : (0, import_fs3.readFileSync)((0, import_path2.resolve)(workspace, value.trim()), "utf8");
+  let text = value;
+  if (!/^\s*[[{]/.test(value)) {
+    const read = await readWorkspaceText(workspace, value.trim());
+    if (!read.ok) throw new Error(`attestations file ${read.message}; it was not read`);
+    text = read.text ?? "";
+  }
   let parsed;
   try {
     parsed = JSON.parse(text);
@@ -6931,6 +6961,7 @@ function parseAttestationsInput(value, workspace) {
   });
 }
 var SCAN_FILE_FORMATS = ["sarif", "cyclonedx", "spdx", "grype-json", "trivy-json", "other"];
+var SCAN_MODE_WARNING = 'data.mode must be "full" or "diff"; ignored';
 var MAX_SARIF_BYTES = 50 * 1024 * 1024;
 function contentTypeForScanFile(format, path) {
   if (format === "sarif") return "application/sarif+json";
@@ -6967,12 +6998,17 @@ function sarifCounts(json) {
   }
   return counts;
 }
-async function resolveAttestationFiles(attestations, workspace, deps = {}) {
-  const hash = deps.sha256File ?? sha256File;
+async function resolveAttestationFiles(attestations, workspace) {
   const files = [];
   const warnings = [];
   const out = [];
-  for (const a of attestations) {
+  for (const input of attestations) {
+    let a = input;
+    if (a.kind === "scan" && "mode" in a.data && a.data.mode !== "full" && a.data.mode !== "diff") {
+      const { mode: _ignored, ...rest } = a.data;
+      a = { ...a, data: rest };
+      warnings.push(SCAN_MODE_WARNING);
+    }
     const file = a.file;
     if (a.kind !== "scan" && a.kind !== "sbom" || typeof file !== "string" || !file.trim()) {
       out.push(a);
@@ -6980,41 +7016,96 @@ async function resolveAttestationFiles(attestations, workspace, deps = {}) {
     }
     const format = a.format;
     const scanFormat = typeof format === "string" && SCAN_FILE_FORMATS.includes(format) ? format : void 0;
-    const absolute = (0, import_path2.resolve)(workspace, file);
-    const rel = (0, import_path2.relative)(workspace, absolute);
-    if (!rel || rel.startsWith("..") || /^[A-Za-z]:/.test(rel)) {
-      warnings.push(`${file} is outside the workspace and was not attached to "${a.name}"`);
+    const wantCounts = a.kind === "scan" && scanFormat === "sarif" && a.data.critical === void 0 && a.data.high === void 0 && a.data.medium === void 0 && a.data.low === void 0;
+    const notAttached = `and was not attached to "${a.name}"`;
+    const opened = await openWorkspaceFile(workspace, file);
+    if (!opened.ok) {
+      const missing = opened.reason === "missing" || opened.reason === "not-file";
+      warnings.push(missing ? `${file} was not found (or is empty) ${notAttached}` : `${opened.message} ${notAttached}`);
       out.push(a);
       continue;
     }
-    const path = rel.split(import_path2.sep).join("/");
-    const stat = await import_fs3.promises.stat(absolute).catch(() => null);
-    if (!stat?.isFile() || stat.size === 0) {
-      warnings.push(`${file} was not found (or is empty) and was not attached to "${a.name}"`);
-      out.push(a);
-      continue;
-    }
-    const refused = await refusalFor(absolute, path, workspace);
-    if (refused) {
-      warnings.push(refused);
-      out.push(a);
-      continue;
-    }
-    files.push({ path, absolute, size: stat.size, sha256: await hash(absolute), contentType: contentTypeForScanFile(scanFormat, path) });
-    const data = { ...a.data, artifact: path };
-    if (a.kind === "scan" && scanFormat) data.format = scanFormat;
-    if (a.kind === "scan" && scanFormat === "sarif" && data.critical === void 0 && data.high === void 0 && data.medium === void 0 && data.low === void 0) {
-      if (stat.size <= MAX_SARIF_BYTES) {
-        Object.assign(data, sarifCounts((0, import_fs3.readFileSync)(absolute, "utf8")));
+    let sha256;
+    let counts = null;
+    try {
+      if (opened.size === 0) {
+        warnings.push(`${file} was not found (or is empty) ${notAttached}`);
+        out.push(a);
+        continue;
+      }
+      if (wantCounts && opened.size <= MAX_SARIF_BYTES) {
+        const bytes = await opened.handle.readFile();
+        sha256 = (0, import_crypto2.createHash)("sha256").update(bytes).digest("hex");
+        counts = sarifCounts(bytes.toString("utf8"));
       } else {
-        warnings.push(`${file} is too large to compute SARIF counts from (over ${MAX_SARIF_BYTES} bytes); skipping`);
+        sha256 = await sha256Handle(opened.handle);
       }
+    } finally {
+      await opened.handle.close();
     }
+    const { path, absolute } = opened.file;
+    files.push({ path, absolute, workspace, size: opened.size, sha256, contentType: contentTypeForScanFile(scanFormat, path) });
+    const data = { ...a.data, artifact: path };
+    if (a.kind === "scan" && scanFormat) data.format = scanFormat;
+    if (counts) Object.assign(data, counts);
+    else if (wantCounts) warnings.push(`${file} is too large to compute SARIF counts from (over ${MAX_SARIF_BYTES} bytes); skipping`);
     out.push({ kind: a.kind, name: a.name, status: a.status, data });
   }
   return { attestations: out, files, warnings };
 }
 
+// src/core/artifacts.ts
+var import_path3 = require("path");
+var MAX_ARTIFACT_FILES = 50;
+var TYPES = {
+  ".zip": "application/zip",
+  ".gz": "application/gzip",
+  ".tgz": "application/gzip",
+  ".tar": "application/x-tar",
+  ".json": "application/json",
+  ".xml": "application/xml",
+  ".pdf": "application/pdf",
+  ".txt": "text/plain",
+  ".log": "text/plain",
+  ".info": "text/plain",
+  ".md": "text/markdown",
+  ".csv": "text/csv",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".svg": "image/svg+xml"
+};
+var contentTypeFor = (path) => TYPES[(0, import_path3.extname)(path).toLowerCase()] ?? "application/octet-stream";
+async function collectArtifacts(patterns, workspace, deps) {
+  const warnings = [];
+  if (!patterns.length) return { files: [], warnings };
+  const find = deps.glob;
+  const inside = [];
+  for (const absolute of [...new Set(await find(patterns))]) {
+    const checked = await checkWorkspacePath(workspace, absolute, { display: displayName(workspace, absolute) });
+    if (!checked.ok) {
+      if (checked.reason !== "missing") warnings.push(`${checked.message} and was not uploaded`);
+      continue;
+    }
+    inside.push({ absolute: checked.file.absolute, path: checked.file.path });
+  }
+  inside.sort((a, b) => a.path.localeCompare(b.path));
+  if (inside.length > MAX_ARTIFACT_FILES) warnings.push(`${inside.length} files matched; only the first ${MAX_ARTIFACT_FILES} are uploaded`);
+  const files = [];
+  for (const f of inside.slice(0, MAX_ARTIFACT_FILES)) {
+    const hashed = await hashWorkspaceFile(workspace, f.path);
+    if (!hashed.ok) {
+      if (hashed.reason !== "missing" && hashed.reason !== "not-file") warnings.push(`${hashed.message} and was not uploaded`);
+      continue;
+    }
+    if (hashed.size === 0) continue;
+    files.push({ path: f.path, absolute: f.absolute, workspace, size: hashed.size, sha256: hashed.sha256, contentType: contentTypeFor(f.path) });
+  }
+  return { files, warnings };
+}
+
 // src/core/request.ts
 function buildIngestRequest(p) {
   return {
@@ -7085,23 +7176,34 @@ var sendReport = (baseUrl, provider, req, audience, deps, azure) => postJson(`${
 var completeReport = (baseUrl, provider, reportId, artifactIds, audience, deps, azure) => postJson(`${baseUrl}/api/ingest/${provider}/reports/${encodeURIComponent(reportId)}/complete`, azure ? { artifactIds, azure } : { artifactIds }, audience, deps);
 
 // src/core/upload.ts
-var import_fs4 = require("fs");
 var http = __toESM(require("http"));
 var https = __toESM(require("https"));
-function putOnce(slot, file) {
+var refused = (message) => Object.assign(new Error(message), { retryable: false });
+async function openForUpload(file) {
+  const opened = await openWorkspaceFile(file.workspace, file.path);
+  if (!opened.ok) throw refused(`${opened.message} and was not uploaded`);
+  if (opened.size !== file.size) {
+    await opened.handle.close();
+    throw refused(`${file.path} changed since it was hashed and was not uploaded`);
+  }
+  return opened.handle;
+}
+async function putOnce(slot, file) {
+  const handle = await openForUpload(file);
+  const body = handle.createReadStream({ start: 0 });
   return new Promise((resolve3, reject) => {
     const url = new URL(slot.url);
     const mod = url.protocol === "http:" ? http : https;
     const headers = Object.fromEntries(Object.entries(slot.headers).filter(([k]) => !/^(proxy-)?authorization$|^cookie$/i.test(k)));
     const req = mod.request(url, { method: "PUT", headers, timeout: 10 * 6e4 }, (res) => {
-      let body = "";
+      let body2 = "";
       res.setEncoding("utf8");
       res.on("data", (c) => {
-        if (body.length < 4e3) body += c;
+        if (body2.length < 4e3) body2 += c;
       });
       res.on("end", () => {
         if (res.statusCode && res.statusCode < 300) return resolve3();
-        const code = /<Code>([^<]+)<\/Code>/.exec(body)?.[1] ?? `HTTP ${res.statusCode}`;
+        const code = /<Code>([^<]+)<\/Code>/.exec(body2)?.[1] ?? `HTTP ${res.statusCode}`;
         const err = new Error(`${file.path}: upload refused (${code})`);
         err.retryable = (res.statusCode ?? 0) >= 500;
         reject(err);
@@ -7116,8 +7218,8 @@ function putOnce(slot, file) {
       if (e.retryable === void 0) e.retryable = true;
       reject(e);
     });
-    (0, import_fs4.createReadStream)(file.absolute).on("error", reject).pipe(req);
-  });
+    body.on("error", reject).pipe(req);
+  }).finally(() => body.destroy());
 }
 async function uploadFile(slot, file, attempts = 2) {
   for (let i = 1; ; i++) {
@@ -7413,7 +7515,7 @@ function redactDeep(value, values) {
 }
 
 // src/cli/glob.ts
-var import_path3 = require("path");
+var import_path4 = require("path");
 var { glob } = require_dist2();
 function workspaceGlob(workspace, warn) {
   return async (patterns) => {
@@ -7422,9 +7524,9 @@ function workspaceGlob(workspace, warn) {
     for (const raw of patterns) {
       const neg = raw.startsWith("!");
       let p = neg ? raw.slice(1) : raw;
-      if ((0, import_path3.isAbsolute)(p)) {
-        const rel = (0, import_path3.relative)(workspace, p);
-        if (!rel || rel.startsWith("..") || (0, import_path3.isAbsolute)(rel)) {
+      if ((0, import_path4.isAbsolute)(p)) {
+        const rel = (0, import_path4.relative)(workspace, p);
+        if (!rel || rel.startsWith("..") || (0, import_path4.isAbsolute)(rel)) {
           warn(`${raw} is outside the workspace and was skipped`);
           continue;
         }
@@ -7434,7 +7536,7 @@ function workspaceGlob(workspace, warn) {
     }
     if (!include.length) return [];
     const found = await glob(include, { cwd: workspace, ignore, absolute: true, onlyFiles: true, dot: true, followSymbolicLinks: true });
-    return found.map((f) => (0, import_path3.resolve)(f)).sort();
+    return found.map((f) => (0, import_path4.resolve)(f)).sort();
   };
 }
 
@@ -7497,16 +7599,17 @@ var SKIPPED = {
   monthly_quota: "your organization's monthly upload allowance is used up"
 };
 var DEFAULT_SUMMARY_FILE = "prodgator-summary.md";
-async function readSummary(workspace, summary, file, info) {
+async function readSummary(workspace, summary, file, log) {
   if (summary) return summary;
   const path = file ?? DEFAULT_SUMMARY_FILE;
-  const absolute = (0, import_path4.isAbsolute)(path) ? path : (0, import_path4.join)(workspace, path);
-  try {
-    return await import_fs5.promises.readFile(absolute, "utf8");
-  } catch {
-    if (file) info(`No summary file at ${path}; sending the report without a summary.`);
-    return null;
+  const read = await readWorkspaceText(workspace, path);
+  if (read.ok) return read.text;
+  if (read.reason === "missing") {
+    if (file) log.info(`No summary file at ${path}; sending the report without a summary.`);
+  } else {
+    log.warn(`${read.message}; sending the report without a summary.`);
   }
+  return null;
 }
 function mergeFiles(first, rest, warn) {
   const byPath = /* @__PURE__ */ new Map();
@@ -7520,7 +7623,7 @@ async function run(deps = {}) {
   const argv = deps.argv ?? process.argv.slice(2);
   const log = deps.log ?? { info: (m) => console.log(m), warn: (m) => console.log(`Warning: ${m}`), error: (m) => console.error(m) };
   if (argv.includes("--version")) {
-    log.info("3.5.0");
+    log.info("3.19.1");
     return 0;
   }
   let failOnError = false;
@@ -7538,7 +7641,7 @@ async function run(deps = {}) {
     const problem = tokenProblem(token, opts.audience, ci.provider, variable, (deps.nowMs ?? Date.now)());
     if (problem) throw new CliError(problem);
     if (opts.gate) {
-      const client2 = { getToken: async () => token, fetch: deps.fetch, sleep: deps.sleep, fixedToken: true, userAgent: `prodgator-report/${"3.5.0"} (${ci.provider}; gate)` };
+      const client2 = { getToken: async () => token, fetch: deps.fetch, sleep: deps.sleep, fixedToken: true, userAgent: `prodgator-report/${"3.19.1"} (${ci.provider}; gate)` };
       return await runGate(ci, { prodgatorUrl: opts.prodgatorUrl, audience: opts.audience, timeoutMinutes: opts.gateTimeoutMinutes }, client2, {
         sleep: deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
         nowMs: deps.nowMs ?? Date.now,
@@ -7547,11 +7650,11 @@ async function run(deps = {}) {
     }
     const secrets = secretValues(env, [variable, ...opts.redactVariables]);
     const glob2 = workspaceGlob(ci.workspace, (w) => log.warn(w));
-    const rawSummary = await readSummary(ci.workspace, opts.summary, opts.summaryFile, (m) => log.info(m));
+    const rawSummary = await readSummary(ci.workspace, opts.summary, opts.summaryFile, log);
     const summary = rawSummary ? truncateUtf8(redactText(rawSummary, secrets), MAX_SUMMARY_BYTES).text : null;
-    const scanned = await resolveAttestationFiles(parseAttestationsInput(opts.attestations, ci.workspace), ci.workspace);
+    const scanned = await resolveAttestationFiles(await parseAttestationsInput(opts.attestations, ci.workspace), ci.workspace);
     const attestations = redactDeep(scanned.attestations, secrets);
-    const junit = await junitAttestation(opts.junit, { glob: glob2 });
+    const junit = await junitAttestation(opts.junit, { glob: glob2, workspace: ci.workspace, warn: (w) => log.warn(w) });
     if (junit) attestations.push(junit);
     const globbed = await collectArtifacts(opts.artifacts, ci.workspace, { glob: glob2 });
     [...scanned.warnings, ...globbed.warnings].forEach((w) => log.warn(w));
@@ -7561,7 +7664,7 @@ async function run(deps = {}) {
       fetch: deps.fetch,
       sleep: deps.sleep,
       fixedToken: true,
-      userAgent: `prodgator-report/${"3.5.0"} (${ci.provider})`
+      userAgent: `prodgator-report/${"3.19.1"} (${ci.provider})`
     };
     const request = buildIngestRequest({ job: { name: opts.jobName ?? ci.jobName, matrix: opts.matrix, runner: ci.runner }, name: opts.name, summary, attestations, files });
     const res = await sendReport(opts.prodgatorUrl, ci.provider, request, opts.audience, client, ci.azure);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prodgator/report",
-  "version": "3.5.0",
+  "version": "3.19.1",
   "description": "Send CI job summaries, test results, attestations and artifacts to Prodgator, authenticated with the CI system's OIDC token",
   "license": "MIT",
   "homepage": "https://docs.prodgator.io/pipelines/run-reports",