@secureci/cli 0.3.0 → 0.4.0

package/dist/cli.js

@@ -38,6 +38,7 @@ const commander_1 = require("commander");
 const dry_run_1 = require("./runner/dry-run");
 const executor_1 = require("./runner/executor");
 const action_fetcher_1 = require("./runner/action-fetcher");
+const contract_source_1 = require("./contract-source");
 const validator_1 = require("./parser/validator");
 const workflow_parser_1 = require("./parser/workflow-parser");
 const pipeline_contract_parser_1 = require("./parser/pipeline-contract-parser");
@@ -384,10 +385,42 @@ async function validateFiles(files, contractFile, recurse = 'local', format = 't
         if (!quiet)
             fn();
     };
+    // A contract may be a local file or `owner/repo/path@ref` in another
+    // repository; resolve it once and record which version was enforced.
+    let contractPath = contractFile;
+    let contract;
+    let contractError;
+    if (contractFile) {
+        try {
+            const source = await (0, contract_source_1.resolveContractSource)(contractFile, {
+                fetchFile: (uses) => (0, action_fetcher_1.fetchRepoFile)(uses),
+                resolveSha: (uses) => (0, action_fetcher_1.resolveActionSha)(uses),
+                warn: (message) => logger_1.logger.warn(message)
+            });
+            contractPath = source.file;
+            const remote = source.remote;
+            contract = remote
+                ? {
+                    source: remote.uses,
+                    ref: remote.ref,
+                    commit: remote.commit,
+                    pinned: remote.pinned
+                }
+                : { source: contractFile };
+            if (remote) {
+                say(() => logger_1.logger.info(`Using contract ${remote.uses}${remote.commit ? ` at commit ${remote.commit.slice(0, 12)}` : ''}`));
+            }
+        }
+        catch (error) {
+            contractError = error instanceof Error ? error.message : 'Unknown error';
+        }
+    }
     const entries = [];
     for (const filePath of files) {
         try {
-            const result = await validateOneFile(filePath, contractFile, recurse, say);
+            if (contractError)
+                throw new Error(contractError);
+            const result = await validateOneFile(filePath, contractPath, recurse, say);
             entries.push({ file: filePath, result });
         }
         catch (error) {
@@ -409,7 +442,7 @@ async function validateFiles(files, contractFile, recurse = 'local', format = 't
     const allValid = entries.every((e) => e.result.valid);
     if (quiet) {
         // eslint-disable-next-line no-console
-        console.log((0, report_1.formatReport)(entries, format));
+        console.log((0, report_1.formatReport)(entries, format, { contract }));
         if (!allValid)
             process.exit(1);
         return;

package/dist/contract-source.js

@@ -0,0 +1,63 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveContractSource = resolveContractSource;
+const fs = __importStar(require("fs"));
+// owner/repo/path/to/file@ref: the same form as a remote reusable workflow.
+const REMOTE_CONTRACT = /^[^/.][^/]*\/[^/@]+\/[^@]+@([^@]+)$/;
+const FULL_SHA = /^[0-9a-f]{40}$/;
+/**
+ * Where to read `--contract` from. An existing local file always wins;
+ * otherwise `owner/repo/path@ref` is fetched like a remote reusable workflow.
+ * A ref that isn't a commit SHA can change under you, so it warns.
+ */
+async function resolveContractSource(value, deps) {
+    if (fs.existsSync(value))
+        return { file: value };
+    const match = REMOTE_CONTRACT.exec(value);
+    if (!match)
+        throw new Error(`Contract file not found: ${value}`);
+    const ref = match[1];
+    const pinned = FULL_SHA.test(ref);
+    if (!pinned) {
+        deps.warn(`Contract ${value} uses the moving ref "${ref}": its owner can change the standard without a change in this repository. Pin it to a commit SHA to control when it changes.`);
+    }
+    const file = await deps.fetchFile(value);
+    if (!file)
+        throw new Error(`Could not fetch contract ${value}`);
+    const commit = pinned ? ref : await deps.resolveSha(value);
+    return { file, remote: { uses: value, ref, commit, pinned } };
+}
+//# sourceMappingURL=contract-source.js.map

package/dist/report.js

@@ -41,13 +41,15 @@ function sarifResults(entry) {
  * carrying every file's findings, suitable for GitHub code scanning (upload
  * with `github/codeql-action/upload-sarif`).
  */
-function formatReport(entries, format) {
+function formatReport(entries, format, meta = {}) {
+    const contract = meta.contract ? { contract: meta.contract } : {};
     if (format === 'json') {
         const body = entries.length === 1
-            ? jsonForFile(entries[0])
+            ? { ...jsonForFile(entries[0]), ...contract }
             : {
                 valid: entries.every((e) => e.result.valid),
-                files: entries.map(jsonForFile)
+                files: entries.map(jsonForFile),
+                ...contract
             };
         return JSON.stringify(body, null, 2);
     }
@@ -63,7 +65,8 @@ function formatReport(entries, format) {
                         rules: Object.entries(RULES).map(([id, name]) => ({ id, name }))
                     }
                 },
-                results: entries.flatMap(sarifResults)
+                results: entries.flatMap(sarifResults),
+                ...(meta.contract ? { properties: contract } : {})
             }
         ]
     }, null, 2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {