@scalequality/check 0.5.3 → 0.5.4

package/README.md

@@ -23,8 +23,9 @@ and **Turn on continuous measurement**. Store the token as a CI secret named
 | `--json` | — | off | Print the raw result as JSON |
 | `--exclude <path>` | — | — | Exclude a generated file/directory by literal checkout-relative path; repeatable |
 | `--dry-run` | — | off | Measure locally and validate the package without uploading; no token needed |
+| `--artifact <path>` | `SQ_ARTIFACTS` | — | Scan a binary this job built for its components, licenses and CVEs (needs trivy); repeatable |
 
-Exit codes: `0` passed (or track-only), `1` below the cutoff, `2` error.
+Exit codes: `0` passed (or track-only), `1` below the cutoff or a license blocked by your policy, `2` error.
 
 ## CI examples
 
@@ -201,3 +202,26 @@ A file that changes or cannot be copied stops submission before any upload.
 The existing 60 MiB compressed upload limit, Git durability calculation and
 maturity gates are unchanged. This release requires the matching server reader
 that accepts the complete staged report index.
+
+## 0.5.4: open source licenses in the pull request, and the binaries you build
+
+**License gate.** Each run sends where it happened (GitHub Actions, GitLab CI,
+Azure Pipelines or Bitbucket Pipelines: the pull request's base and head
+branches and its number). ScaleQuality compares the run's dependencies with the
+base branch and lists every new dependency whose license your company policy
+forbids, in the log and, on GitHub Actions, in the job summary. It is a warning
+unless your organization turned on "Block the pull request" in Compliance ›
+Licenses; then the step exits 1 until the package is removed or an Owner or Admin
+accepts it with an exception.
+
+**`--artifact <path>`** (repeatable, or `SQ_ARTIFACTS=a.jar,b.war`). Scans a
+binary this job built (jar, war, ear, Go and Rust binaries with build metadata,
+.NET, wheels) with `trivy rootfs`, so the components bundled inside it, their
+licenses and their CVEs join the measurement. Needs trivy on PATH, like
+`--image`; without it the step says so and the gate still runs.
+
+```yaml
+- uses: aquasecurity/setup-trivy@v0.2.0
+- run: npx @scalequality/check --artifact target/app.war
+  env: { SQ_TOKEN: ${{ secrets.SQ_TOKEN }}, SQ_PROJECT: ${{ vars.SQ_PROJECT }} }
+```

package/bin/check.mjs

@@ -5,10 +5,11 @@
 // build. Pure Node 18+ (global fetch/FormData/Blob), no npm dependencies.
 
 import { spawnSync } from "node:child_process"
-import { readFileSync } from "node:fs"
+import { readFileSync, existsSync, appendFileSync } from "node:fs"
 import { prepareCheckoutArchive, normalizeExcludes } from "./archive.mjs"
 import { measureDurability } from "./durability.mjs"
 import { stageCoverageReports } from "./coverage.mjs"
+import { ciContext } from "./ci.mjs"
 
 const args = process.argv.slice(2)
 const flag = (name) => {
@@ -30,13 +31,21 @@ Options:
   --image <ref>    Also scan the container image this job just built, e.g.
                    myapp:\${{ github.sha }}. Needs trivy on PATH; skipped with a
                    note if it is missing, never fails the build for it.
+  --artifact <p>   Also scan a binary this job built (jar, war, ear, Go or Rust
+                   binary, .NET, wheel) for its components, their licenses and
+                   CVEs; repeatable. Needs trivy on PATH; skipped with a note if
+                   it is missing, never fails the build for it.
   --timeout <s>    Max seconds to wait for the measurement (default 600)
   --exclude <p>    Exclude a generated path relative to the checkout; repeatable
   --dry-run        Measure locally and check the package; do not upload (no token needed)
   --json           Print the raw result as JSON
   -h, --help       Show this help
 
-Exit codes: 0 passed (or track-only), 1 below the cutoff, 2 error.`)
+Pull requests that add a dependency whose license your company policy forbids
+are listed in the log and the job summary; the check fails for it only where
+your organization turned blocking on.
+
+Exit codes: 0 passed (or track-only), 1 below the cutoff or a blocked license, 2 error.`)
   process.exit(0)
 }
 
@@ -46,6 +55,10 @@ const host = (flag("--host") || process.env.SQ_HOST || "https://app.scalequality
 const jsonOut = has("--json")
 const dryRun = has("--dry-run")
 const image = flag("--image") || process.env.SQ_IMAGE
+const artifacts = [
+  ...args.flatMap((arg, i) => (arg === "--artifact" && args[i + 1] ? [args[i + 1]] : [])),
+  ...(process.env.SQ_ARTIFACTS ? process.env.SQ_ARTIFACTS.split(",").map((s) => s.trim()).filter(Boolean) : []),
+]
 const timeoutMs = Math.max(30, Number(flag("--timeout") || 600)) * 1000
 
 const base = `${host}/api/insights/continuous`
@@ -127,6 +140,80 @@ function slimReport(stdout, ref) {
   return json
 }
 
+/**
+ * Binaries this job built. A component bundled inside a jar or a Go binary is
+ * shipped like any dependency, but no lockfile lists it: the only place it can
+ * be read is the artifact, and the artifact only exists here. Same rules as the
+ * image: no trivy, a note and the gate still runs; a path that is not there is
+ * said, never skipped silently.
+ */
+function scanArtifacts() {
+  if (!artifacts.length) return null
+  const probe = spawnSync("trivy", ["--version"], { encoding: "utf8" })
+  if (probe.error || probe.status !== 0) {
+    log("ScaleQuality: --artifact was given but trivy is not on PATH, so the artifact scan was skipped.")
+    log("ScaleQuality: add it before this step, e.g. `- uses: aquasecurity/setup-trivy@v0.2.0`.")
+    return null
+  }
+  const reports = []
+  for (const path of artifacts.slice(0, 20)) {
+    if (!existsSync(path)) { log(`ScaleQuality: artifact ${path} does not exist, skipped.`); continue }
+    const r = spawnSync("trivy", [
+      "rootfs", "--format", "json", "--quiet",
+      "--scanners", "vuln,license", "--list-all-pkgs",
+      "--severity", "CRITICAL,HIGH,MEDIUM",
+      path,
+    ], { encoding: "utf8", maxBuffer: 128 * 1024 * 1024 })
+    if (r.error || r.status !== 0 || !r.stdout) { log(`ScaleQuality: could not scan ${path}, continuing without it.`); continue }
+    const report = slimArtifact(r.stdout, path)
+    if (report) reports.push({ name: path.split("/").pop() || path, report })
+  }
+  return reports.length ? JSON.stringify(reports) : null
+}
+
+/** Components with their licenses and the findings, nothing else: the server reads these fields. */
+function slimArtifact(stdout, path) {
+  let d
+  try { d = JSON.parse(stdout) } catch { return null }
+  let packages = 0, vulns = 0
+  const out = {
+    ArtifactName: d.ArtifactName || path,
+    Results: (d.Results || []).map((res) => ({
+      Target: res.Target,
+      Class: res.Class,
+      Type: res.Type,
+      Packages: (res.Packages || []).map((p) => {
+        packages++
+        return { Name: p.Name, Version: p.Version, Licenses: Array.isArray(p.Licenses) ? p.Licenses : undefined, Identifier: p.Identifier?.PURL ? { PURL: p.Identifier.PURL } : undefined }
+      }),
+      Vulnerabilities: (res.Vulnerabilities || []).map((v) => {
+        vulns++
+        return { VulnerabilityID: v.VulnerabilityID, PkgName: v.PkgName, InstalledVersion: v.InstalledVersion, FixedVersion: v.FixedVersion, Severity: v.Severity, Title: typeof v.Title === "string" ? v.Title.slice(0, 300) : undefined }
+      }),
+    })),
+  }
+  log(`ScaleQuality: scanned ${path}: ${packages} components, ${vulns} vulnerabilities`)
+  return JSON.stringify(out)
+}
+
+/** The license gate, in the log and in the job summary (GitHub Actions). */
+function reportLicenses(license) {
+  if (!license || license.result === "PASSED" || !license.newForbidden?.length) return
+  const total = license.newForbiddenTotal ?? license.newForbidden.length
+  const blocked = license.result === "BLOCKED"
+  const head = blocked
+    ? `ScaleQuality: ${total} new dependenc${total === 1 ? "y has" : "ies have"} a license your company policy forbids, so the pull request is blocked.`
+    : `ScaleQuality: ${total} new dependenc${total === 1 ? "y has" : "ies have"} a license your company policy forbids (warning; blocking is off for your organization).`
+  const lines = license.newForbidden.map((p) => `  - ${p.name}${p.version ? ` ${p.version}` : ""}: ${(p.licenses || []).join(", ")}${p.file ? ` (${p.file})` : ""}`)
+  ;(blocked ? console.error : console.log)([head, ...lines, "  Remove it, or ask an Owner or Admin to accept it with an exception in ScaleQuality."].join("\n"))
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    const md = [`### ${blocked ? "Blocked" : "Warning"}: forbidden license`, "", "| Package | Version | License | Found in |", "|---|---|---|---|",
+      ...license.newForbidden.map((p) => `| ${p.name} | ${p.version || ""} | ${(p.licenses || []).join(", ")} | ${p.file || ""} |`),
+      "", "Remove the dependency, or ask an Owner or Admin to accept it with an exception in ScaleQuality.", ""].join("\n")
+    try { appendFileSync(process.env.GITHUB_STEP_SUMMARY, md) } catch { /* the log already says it */ }
+  }
+}
+
 async function main() {
   const auth = { Authorization: `Bearer ${token}` }
   const excludes = normalizeExcludes(args.flatMap((arg, i) => arg === "--exclude" ? [args[i + 1]] : []))
@@ -160,6 +247,15 @@ async function main() {
   form.append("file", new Blob([buf]), "checkout.tar.gz")
   const containerReport = scanImage()
   if (containerReport) form.append("containerReport", containerReport)
+  const artifactReports = scanArtifacts()
+  if (artifactReports) form.append("artifactReports", artifactReports)
+  const ci = ciContext()
+  if (ci) {
+    form.append("ciProvider", ci.provider)
+    if (ci.baseRef) form.append("ciBaseRef", ci.baseRef)
+    if (ci.headRef) form.append("ciHeadRef", ci.headRef)
+    if (ci.pullRequest) form.append("ciPullRequest", String(ci.pullRequest))
+  }
   const r = await fetch(`${base}/report/upload`, {
     method: "POST",
     headers: auth,
@@ -213,7 +309,12 @@ async function main() {
   } else {
     const cut = last.cutoff != null ? ` (cutoff ${last.cutoff})` : " (track only)"
     log(`ScaleQuality: maturity ${last.maturity ?? "—"}${cut}`)
-    if (last.passed === false) console.error("ScaleQuality: below the line — failing the build.")
+    reportLicenses(last.license)
+    const licenseBlocked = last.license?.result === "BLOCKED"
+    const maturityFailed = last.gateResult === "FAILED"
+    if (last.passed === false && maturityFailed) console.error("ScaleQuality: below the line — failing the build.")
+    else if (last.passed === false && licenseBlocked) console.error("ScaleQuality: a forbidden license, failing the build.")
+    else if (last.passed === false) console.error("ScaleQuality: the gate did not pass, failing the build.")
     else if (last.cutoff == null) log("ScaleQuality: measurement completed (track only; no cutoff configured).")
     else log("ScaleQuality: passed.")
   }

package/bin/ci.mjs

@@ -0,0 +1,18 @@
+// Where a CI run happened, read from the provider's own variables.
+
+/**
+ * Where this run happened, from the CI's own variables: the pull request's base
+ * (what the license gate compares against), its head and number. Outside a pull
+ * request only the branch is known, and the base stays empty: never guessed.
+ */
+export function ciContext(env = process.env) {
+  const strip = (v) => (v ? String(v).replace(/^refs\/heads\//, "") : null)
+  if (env.GITHUB_ACTIONS) {
+    const pr = /^refs\/pull\/(\d+)\//.exec(env.GITHUB_REF || "")
+    return { provider: "github", baseRef: env.GITHUB_BASE_REF || null, headRef: env.GITHUB_HEAD_REF || env.GITHUB_REF_NAME || null, pullRequest: pr ? pr[1] : null }
+  }
+  if (env.GITLAB_CI) return { provider: "gitlab", baseRef: env.CI_MERGE_REQUEST_TARGET_BRANCH_NAME || null, headRef: env.CI_MERGE_REQUEST_SOURCE_BRANCH_NAME || env.CI_COMMIT_REF_NAME || null, pullRequest: env.CI_MERGE_REQUEST_IID || null }
+  if (env.TF_BUILD) return { provider: "azure", baseRef: strip(env.SYSTEM_PULLREQUEST_TARGETBRANCH), headRef: strip(env.SYSTEM_PULLREQUEST_SOURCEBRANCH || env.BUILD_SOURCEBRANCH), pullRequest: env.SYSTEM_PULLREQUEST_PULLREQUESTID || null }
+  if (env.BITBUCKET_BUILD_NUMBER) return { provider: "bitbucket", baseRef: env.BITBUCKET_PR_DESTINATION_BRANCH || null, headRef: env.BITBUCKET_BRANCH || null, pullRequest: env.BITBUCKET_PR_ID || null }
+  return null
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalequality/check",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "ScaleQuality continuous code-maturity check for CI. Re-measures your repo on every build and fails the pipeline below your maturity line.",
   "type": "module",
   "bin": {