@sasjs/lint 4.1.3 → 4.1.4

package/.github/workflows/audit-watch.yml

@@ -0,0 +1,68 @@
+name: Audit Watch
+
+# The build gate runs `npm audit --omit=dev`, because the dev tree carries one
+# advisory that cannot be fixed from here (GHSA-hp3w-g68c-fv3c, sprintf-js - see
+# the Security Audit step in build.yml). Nothing in build.yml re-checks the dev
+# tree, so that exemption would otherwise be open-ended. This runs the full audit
+# weekly and fails when the exemption stops matching reality: a new dev-tree
+# advisory appears, an exempted one disappears, or a package named in the
+# exemption publishes a newer release. Any of those files an issue - and only
+# those, because a scheduled job that is red every week trains people to ignore
+# red.
+
+on:
+  schedule:
+    - cron: '0 8 * * 1' # Mondays, 08:00 UTC
+  workflow_dispatch:
+
+jobs:
+  watch:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Re-check the dev-tree audit exemption
+        id: watch
+        env:
+          AUDIT_WATCH_REPORT: ${{ runner.temp }}/audit-watch-report.md
+        run: node scripts/audit-watch.mjs
+
+      - name: File an issue
+        # `always()` because the watched step has already failed, which would
+        # otherwise skip this one.
+        if: always() && steps.watch.outcome == 'failure'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPORT: ${{ runner.temp }}/audit-watch-report.md
+        run: |
+          title='Audit watch: the dev-tree exemption needs re-evaluating'
+          existing=$(gh issue list --state open --search "\"$title\" in:title" \
+            --json number --jq '.[0].number // empty')
+
+          if [ -n "$existing" ]; then
+            echo "already tracked in #$existing"
+            exit 0
+          fi
+
+          if [ -f "$REPORT" ]; then
+            gh issue create --title "$title" --body-file "$REPORT"
+          else
+            # The script writes a report even when the watch itself breaks, so
+            # this means it never started. File the issue anyway rather than
+            # failing on a missing path and filing nothing.
+            gh issue create --title "$title" --body \
+              "The audit watch step failed before producing a report. Check the run:
+          $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
+          fi

package/.github/workflows/build.yml

@@ -36,11 +36,26 @@ jobs:
         # gitleaks-action requires a license key for organization repos.
         run: node_modules/.bin/gitleaks detect --source . --redact --no-banner -v
       - name: Security Audit
-        # The release toolchain is not a project dependency (see publish.yml),
-        # so the `npm` package bundled by @semantic-release/npm never reaches
-        # this tree - which is what made the old exemption-based audit script
-        # necessary. A plain audit is clean.
-        run: npm audit
+        # Prod-scoped on purpose: this gate covers what actually ships. The
+        # release toolchain is not a project dependency (see publish.yml), so
+        # the `npm` package bundled by @semantic-release/npm never reaches this
+        # tree - which is what made the old exemption-based audit script
+        # necessary. The dev tree carries one advisory that cannot be fixed
+        # from here: GHSA-hp3w-g68c-fv3c, sprintf-js reached through
+        # @jest/transform -> babel-plugin-istanbul ->
+        # @istanbuljs/load-nyc-config -> js-yaml 3 -> argparse. Every package in
+        # that chain is at its latest published version, and the advisory lists
+        # no patched release at all (sprintf-js 1.1.3 is the newest and is
+        # still in range), so gating on it would mean a permanently red build.
+        # `npm audit fix --force` does not fix it either - it downgrades jest
+        # 30 -> 25 and takes the tree from 21 advisories to 45.
+        #
+        # The exemption is not open-ended: audit-watch.yml runs the full audit
+        # weekly and fails when this comment stops matching the tree - a new
+        # dev-tree advisory, this one disappearing, or sprintf-js publishing a
+        # newer release. Keep the GHSA id named here and in the EXEMPTIONS list
+        # of scripts/audit-watch.mjs.
+        run: npm audit --omit=dev --audit-level=low
       - name: Check Code Style
         run: npm run lint
       - name: Run Unit Tests

package/package.json

@@ -70,8 +70,8 @@
     "typescript": "6.0.3"
   },
   "dependencies": {
-    "@sasjs/utils": "3.6.4",
+    "@sasjs/utils": "4.0.0",
     "ignore": "7.0.11"
   },
-  "version": "4.1.3"
+  "version": "4.1.4"
 }

package/scripts/audit-watch.mjs

@@ -0,0 +1,249 @@
+/**
+ * Watches the dev-tree audit exemption declared in `.github/workflows/build.yml`.
+ *
+ * That workflow gates on `npm audit --omit=dev` because the dev tree carries one
+ * advisory nothing in this repo can fix: GHSA-hp3w-g68c-fv3c (sprintf-js,
+ * reached through @jest/transform -> babel-plugin-istanbul ->
+ * @istanbuljs/load-nyc-config -> js-yaml 3 -> argparse). Every package in that
+ * chain is at its latest published version and the advisory lists no patched
+ * release, so gating on it would mean a permanently red build.
+ *
+ * An exemption with no expiry is how a scoped gate becomes a permanent one, so
+ * this script re-checks it weekly and reports when it is out of date:
+ *
+ *   - a dev-tree advisory outside EXEMPTIONS appears - the exemption is too narrow
+ *   - an EXEMPTIONS advisory no longer appears in the tree - the exemption is dead
+ *   - a WATCHED_FOR_RELEASE package publishes a version newer than the one
+ *     recorded here - a fix may now exist, so re-evaluate and drop the exemption
+ *   - an EXEMPTIONS id is missing from the build.yml comment - the gate and this
+ *     script disagree about what is exempt
+ *
+ * Any of those exits 1, failing the scheduled run and making the workflow file an
+ * issue. The known advisory on its own does NOT exit 1: it is expected, and a job
+ * that is red every week trains people to ignore red.
+ *
+ * Run with `node scripts/audit-watch.mjs`.
+ */
+import { execFileSync } from 'node:child_process'
+import { appendFileSync, readFileSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const BUILD_WORKFLOW = path.join('.github', 'workflows', 'build.yml')
+
+/**
+ * Advisories the dev-scoped gate in build.yml is allowed to leave unaddressed.
+ * Each one must also be named in that workflow's comment - the check below
+ * enforces it, so the gate and this list cannot drift apart.
+ */
+const EXEMPTIONS = ['GHSA-hp3w-g68c-fv3c']
+
+/**
+ * Packages whose published version decides whether an exemption is still
+ * justified. `newestKnown` is the newest release at the time the exemption was
+ * written; a newer one on the registry means a fix may exist and the exemption
+ * deserves a fresh look rather than another year of silence.
+ */
+const WATCHED_FOR_RELEASE = [{ name: 'sprintf-js', newestKnown: '1.1.3' }]
+
+/**
+ * `npm audit --json` exits 1 whenever it reports anything, so the exit code says
+ * nothing about whether the command worked - parse the report instead.
+ */
+const runAudit = () => {
+  let stdout
+  try {
+    stdout = execFileSync('npm', ['audit', '--json'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore']
+    })
+  } catch (error) {
+    stdout = error.stdout
+  }
+  if (!stdout || !stdout.trim()) {
+    throw new Error('npm audit produced no JSON - run `npm ci` first')
+  }
+  return JSON.parse(stdout)
+}
+
+/**
+ * The advisories the report names, keyed by GHSA id. A `via` entry is a bare
+ * package name when the advisory is inherited from a dependency, and an object
+ * carrying the GHSA url when it is the root of the chain - only the latter are
+ * advisories in their own right.
+ */
+const collectAdvisories = (report) => {
+  const advisories = new Map()
+
+  for (const [packageName, info] of Object.entries(report?.vulnerabilities ?? {})) {
+    for (const via of info?.via ?? []) {
+      if (typeof via !== 'object' || via === null) continue
+      const id = String(via.url ?? '').split('/').pop()
+      if (!id?.startsWith('GHSA-')) continue
+
+      const entry = advisories.get(id) ?? {
+        severity: via.severity,
+        title: via.title,
+        packages: []
+      }
+      entry.packages.push(packageName)
+      advisories.set(id, entry)
+    }
+  }
+
+  return advisories
+}
+
+/** The version the registry currently resolves `latest` to, or null if offline. */
+const latestPublished = (name) => {
+  try {
+    return execFileSync('npm', ['view', name, 'version'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore']
+    }).trim()
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Numeric dotted comparison, so `1.1.10` sorts above `1.1.9`. A prerelease
+ * suffix is dropped from both sides first: `1.1.3-beta.1` is not newer than
+ * `1.1.3`, and a prerelease that happens to be tagged `latest` must not raise
+ * the alarm by itself.
+ */
+const isNewer = (candidate, baseline) => {
+  const a = candidate.split('-')[0].split('.')
+  const b = baseline.split('-')[0].split('.')
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    const left = a[i] ?? '0'
+    const right = b[i] ?? '0'
+    if (left === right) continue
+    const leftNumber = Number(left)
+    const rightNumber = Number(right)
+    if (Number.isNaN(leftNumber) || Number.isNaN(rightNumber)) {
+      return left > right
+    }
+    return leftNumber > rightNumber
+  }
+  return false
+}
+
+/**
+ * Write the report to the step summary and to the file the workflow reads.
+ * Wrapped so a failure to report cannot mask the failure being reported - and
+ * so the workflow's `gh issue create --body-file` always has a file, including
+ * on the path below where the watch itself broke.
+ */
+const writeReport = (summary) => {
+  try {
+    if (process.env.GITHUB_STEP_SUMMARY) {
+      appendFileSync(process.env.GITHUB_STEP_SUMMARY, summary)
+    }
+    if (process.env.AUDIT_WATCH_REPORT) {
+      writeFileSync(process.env.AUDIT_WATCH_REPORT, summary)
+    }
+  } catch (error) {
+    console.error(`could not write the report: ${error.message}`)
+  }
+}
+
+const main = () => {
+  const report = runAudit()
+  const advisories = collectAdvisories(report)
+  const problems = []
+
+  for (const [id, advisory] of advisories) {
+    if (EXEMPTIONS.includes(id)) continue
+    problems.push(
+      `new dev-tree advisory ${id} (${advisory.severity}): ${advisory.title} - ` +
+        `packages: ${[...new Set(advisory.packages)].sort().join(', ')}. ` +
+        'Fix it, or add it to EXEMPTIONS and name it in the build.yml comment.'
+    )
+  }
+
+  for (const id of EXEMPTIONS) {
+    if (advisories.has(id)) continue
+    problems.push(
+      `exempted advisory ${id} no longer appears in the tree - the exemption is ` +
+        'dead weight. Remove it from EXEMPTIONS and from the build.yml comment, ' +
+        'and restore the full `npm audit` gate.'
+    )
+  }
+
+  for (const { name, newestKnown } of WATCHED_FOR_RELEASE) {
+    const latest = latestPublished(name)
+    if (latest === null) {
+      console.log(`skipped the registry check for ${name} - npm view failed`)
+      continue
+    }
+    if (isNewer(latest, newestKnown)) {
+      problems.push(
+        `${name} has published ${latest}, newer than the ${newestKnown} recorded ` +
+          'with the exemption - a fix may exist. Re-evaluate the exemption, bump ' +
+          'the chain if it clears, and drop the exemption when it does.'
+      )
+    }
+  }
+
+  const buildWorkflow = readFileSync(path.join(ROOT, BUILD_WORKFLOW), 'utf8')
+  for (const id of EXEMPTIONS) {
+    if (buildWorkflow.includes(id)) continue
+    problems.push(
+      `exemption ${id} is not named in ${BUILD_WORKFLOW} - the gate and this ` +
+        'script disagree about what is exempt.'
+    )
+  }
+
+  const { moderate = 0, high = 0, critical = 0, total = 0 } =
+    report?.metadata?.vulnerabilities ?? {}
+
+  const summary = [
+    '## Dev-tree audit watch',
+    '',
+    `Full audit: ${total} advisories (${critical} critical, ${high} high, ${moderate} moderate).`,
+    '',
+    '| advisory | severity | packages | exempt |',
+    '| --- | --- | --- | --- |',
+    ...[...advisories].map(
+      ([id, advisory]) =>
+        `| ${id} | ${advisory.severity} | ${[...new Set(advisory.packages)].sort().join(', ')} | ` +
+        `${EXEMPTIONS.includes(id) ? 'yes' : '**no**'} |`
+    ),
+    '',
+    problems.length
+      ? ['### The exemption needs attention', '', ...problems.map((p) => `- ${p}`), ''].join('\n')
+      : 'The exemption still matches the tree - nothing to do.',
+    ''
+  ].join('\n')
+
+  console.log(summary)
+  writeReport(summary)
+
+  process.exitCode = problems.length ? 1 : 0
+}
+
+try {
+  main()
+} catch (error) {
+  // The watch itself broke, so the exemption went unchecked. Say so in the
+  // report rather than leaving the workflow to fail on a missing file.
+  const summary = [
+    '## Dev-tree audit watch',
+    '',
+    'The watch did not complete, so the dev-tree audit exemption was **not**',
+    'checked against the tree. Nothing is known about the advisories right now.',
+    '',
+    '```',
+    error.message,
+    '```',
+    '',
+    'Investigate the failing step, then re-run the workflow.',
+    ''
+  ].join('\n')
+
+  console.error(`audit watch failed: ${error.message}`)
+  writeReport(summary)
+  process.exit(1)
+}

package/utils/isIgnored.js

@@ -13,7 +13,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isIgnored = void 0;
-const utils_1 = require("@sasjs/utils");
+const file_1 = require("@sasjs/utils/file");
 const path_1 = __importDefault(require("path"));
 const ignore_1 = __importDefault(require("ignore"));
 const _1 = require(".");
@@ -32,8 +32,8 @@ const isIgnored = (fPath, configuration) => __awaiter(void 0, void 0, void 0, fu
     if (fPath === projectRoot)
         return false;
     let gitIgnoreFileContent = '';
-    if (yield (0, utils_1.fileExists)(gitIgnoreFilePath))
-        gitIgnoreFileContent = yield (0, utils_1.readFile)(gitIgnoreFilePath);
+    if (yield (0, file_1.fileExists)(gitIgnoreFilePath))
+        gitIgnoreFileContent = yield (0, file_1.readFile)(gitIgnoreFilePath);
     return (0, ignore_1.default)()
         .add(gitIgnoreFileContent)
         .add(config.ignoreList)

package/utils/isIgnored.js.map

@@ -1 +1 @@
-{"version":3,"file":"isIgnored.js","sourceRoot":"","sources":["../../src/utils/isIgnored.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAmD;AACnD,gDAAuB;AACvB,oDAA2B;AAC3B,wBAAiD;AAGjD;;;;;GAKG;AACI,MAAM,SAAS,GAAG,CACvB,KAAa,EACb,aAA0B,EACR,EAAE;IACpB,MAAM,MAAM,GAAG,aAAa,IAAI,CAAC,MAAM,IAAA,gBAAa,GAAE,CAAC,CAAA;IACvD,MAAM,WAAW,GAAG,MAAM,IAAA,iBAAc,GAAE,CAAA;IAC1C,MAAM,iBAAiB,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,WAAW,GAAG,cAAI,CAAC,GAAG,CAAA;IACvC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAEhD,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,KAAK,CAAA;IAEvC,IAAI,oBAAoB,GAAG,EAAE,CAAA;IAE7B,IAAI,MAAM,IAAA,kBAAU,EAAC,iBAAiB,CAAC;QACrC,oBAAoB,GAAG,MAAM,IAAA,gBAAQ,EAAC,iBAAiB,CAAC,CAAA;IAE1D,OAAO,IAAA,gBAAM,GAAE;SACZ,GAAG,CAAC,oBAAoB,CAAC;SACzB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;SACtB,OAAO,CAAC,YAAY,CAAC,CAAA;AAC1B,CAAC,CAAA,CAAA;AArBY,QAAA,SAAS,aAqBrB"}
+{"version":3,"file":"isIgnored.js","sourceRoot":"","sources":["../../src/utils/isIgnored.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,4CAAwD;AACxD,gDAAuB;AACvB,oDAA2B;AAC3B,wBAAiD;AAGjD;;;;;GAKG;AACI,MAAM,SAAS,GAAG,CACvB,KAAa,EACb,aAA0B,EACR,EAAE;IACpB,MAAM,MAAM,GAAG,aAAa,IAAI,CAAC,MAAM,IAAA,gBAAa,GAAE,CAAC,CAAA;IACvD,MAAM,WAAW,GAAG,MAAM,IAAA,iBAAc,GAAE,CAAA;IAC1C,MAAM,iBAAiB,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,WAAW,GAAG,cAAI,CAAC,GAAG,CAAA;IACvC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAEhD,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,KAAK,CAAA;IAEvC,IAAI,oBAAoB,GAAG,EAAE,CAAA;IAE7B,IAAI,MAAM,IAAA,iBAAU,EAAC,iBAAiB,CAAC;QACrC,oBAAoB,GAAG,MAAM,IAAA,eAAQ,EAAC,iBAAiB,CAAC,CAAA;IAE1D,OAAO,IAAA,gBAAM,GAAE;SACZ,GAAG,CAAC,oBAAoB,CAAC;SACzB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;SACtB,OAAO,CAAC,YAAY,CAAC,CAAA;AAC1B,CAAC,CAAA,CAAA;AArBY,QAAA,SAAS,aAqBrB"}