@shidesheng0218/dsh-plugin-lint 0.1.0 → 0.4.0

package/src/core/pack.js

@@ -0,0 +1,95 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { extractTarball } from './tarball.js';
+
+export function detectPackageManager(dir) {
+  if (existsSync(join(dir, 'pnpm-lock.yaml'))) return 'pnpm';
+  if (existsSync(join(dir, 'yarn.lock'))) return 'yarn';
+  if (existsSync(join(dir, 'bun.lockb')) || existsSync(join(dir, 'bun.lock'))) return 'bun';
+  return 'npm';
+}
+
+function run(command, args, cwd) {
+  const env = { ...process.env, npm_config_ignore_scripts: 'true', YARN_ENABLE_SCRIPTS: 'false' };
+  // Package managers are Node programs; under NODE_V8_COVERAGE they would add
+  // their own internals to the caller's coverage report.
+  delete env.NODE_V8_COVERAGE;
+  return execFileSync(command, args, {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    env,
+  });
+}
+
+function findTarball(dir) {
+  const names = readdirSync(dir).filter((name) => name.endsWith('.tgz'));
+  if (names.length === 0) throw new Error('the package manager did not produce a .tgz');
+  return join(dir, names[0]);
+}
+
+/** Pack a local package and return the tarball path plus a cleanup handle. */
+export function packDirectory(dir, { manager = 'auto', ignoreScripts = true } = {}) {
+  const pm = manager === 'auto' ? detectPackageManager(dir) : manager;
+  const out = mkdtempSync(join(tmpdir(), 'dsh-pack-'));
+  const flags = ignoreScripts ? ['--ignore-scripts'] : [];
+  try {
+    if (pm === 'npm') run('npm', ['pack', ...flags, '--pack-destination', out], dir);
+    else if (pm === 'pnpm') {
+      // pnpm pack has no --ignore-scripts flag; the config form is the supported switch.
+      const noScripts = ignoreScripts ? ['--config.ignore-scripts=true'] : [];
+      run('pnpm', ['pack', ...noScripts, '--pack-destination', out], dir);
+    } else if (pm === 'bun') run('bun', ['pm', 'pack', ...flags, '--destination', out], dir);
+    else if (pm === 'yarn') {
+      // Yarn Berry disables lifecycle scripts through YARN_ENABLE_SCRIPTS (set in run()).
+      const target = join(out, 'package.tgz');
+      try {
+        run('yarn', ['pack', '--filename', target], dir);
+      } catch {
+        run('yarn', ['pack', '--out', target], dir);
+      }
+    } else {
+      throw new Error('unknown package manager: ' + pm);
+    }
+    return { tarball: findTarball(out), manager: pm, cleanup: () => rmSync(out, { recursive: true, force: true }) };
+  } catch (error) {
+    rmSync(out, { recursive: true, force: true });
+    throw new Error('pack failed with ' + pm + ': ' + String(error.stderr || error.message).trim().slice(0, 400));
+  }
+}
+
+/** Download a published package with npm pack and return the tarball. */
+export function packFromNpm(spec) {
+  const out = mkdtempSync(join(tmpdir(), 'dsh-npm-pack-'));
+  try {
+    run('npm', ['pack', spec, '--ignore-scripts', '--pack-destination', out], process.cwd());
+    return { tarball: findTarball(out), source: 'npm:' + spec, cleanup: () => rmSync(out, { recursive: true, force: true }) };
+  } catch (error) {
+    rmSync(out, { recursive: true, force: true });
+    throw new Error('npm pack ' + spec + ' failed: ' + String(error.stderr || error.message).trim().slice(0, 400));
+  }
+}
+
+export function findPackageRoot(dir) {
+  if (existsSync(join(dir, 'package.json'))) return dir;
+  const children = readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory());
+  for (const child of children) {
+    const path = join(dir, child.name);
+    if (existsSync(join(path, 'package.json'))) return path;
+  }
+  throw new Error('the tarball contains no package.json');
+}
+
+/** Extract a tarball into a fresh temp directory and return the package root. */
+export function extractTarballTo(dir) {
+  const out = mkdtempSync(join(tmpdir(), 'dsh-tarball-'));
+  try {
+    extractTarball(readFileSync(dir), out);
+    return { root: findPackageRoot(out), cleanup: () => rmSync(out, { recursive: true, force: true }) };
+  } catch (error) {
+    rmSync(out, { recursive: true, force: true });
+    throw error;
+  }
+}

package/src/core/packlist.js

@@ -0,0 +1,186 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { basename, join, relative } from 'node:path';
+
+const SKIP_DIRS = new Set(['.git', 'node_modules', 'CVS', '.svn', '.hg']);
+const REGEX_SPECIAL = new Set(['.', '+', '^', '$', '(', ')', '|', '{', '}', '\\', '/']);
+
+function normalizePath(value) {
+  return String(value).replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+/, '').replace(/\/+$/, '');
+}
+
+export function globToRegExp(pattern) {
+  const glob = normalizePath(pattern);
+  let source = '^';
+  for (let index = 0; index < glob.length; index += 1) {
+    const char = glob[index];
+    if (char === '*') {
+      if (glob[index + 1] === '*') {
+        while (glob[index + 1] === '*') index += 1;
+        if (glob[index + 1] === '/') {
+          index += 1;
+          source += '(?:.*/)?';
+        } else {
+          source += '.*';
+        }
+      } else {
+        source += '[^/]*';
+      }
+      continue;
+    }
+    if (char === '?') {
+      source += '[^/]';
+      continue;
+    }
+    if (char === '[') {
+      const close = glob.indexOf(']', index + 1);
+      if (close < 0) throw new Error(`unsupported glob: ${pattern}`);
+      let content = glob.slice(index + 1, close);
+      if (content.startsWith('!')) content = '^' + content.slice(1);
+      source += '[' + content + ']';
+      index = close;
+      continue;
+    }
+    source += REGEX_SPECIAL.has(char) ? '\\' + char : char;
+  }
+  return new RegExp(source + '$');
+}
+
+function matches(pattern, relPath) {
+  const normalized = normalizePath(pattern);
+  if (!normalized) return false;
+  if (normalized === relPath || relPath.startsWith(normalized + '/')) return true;
+  return normalized.includes('*') || normalized.includes('?') || normalized.includes('[')
+    ? globToRegExp(normalized).test(relPath)
+    : false;
+}
+
+function ruleState(rules, relPath, initial) {
+  let state = initial;
+  for (const raw of rules) {
+    let pattern = String(raw).trim();
+    if (!pattern) continue;
+    const negated = pattern.startsWith('!');
+    if (negated) pattern = pattern.slice(1);
+    if (matches(pattern, relPath)) state = !negated;
+  }
+  return state;
+}
+
+function intrinsic(relPath, main) {
+  if (relPath === 'package.json' || relPath === main) return true;
+  return /^(?:readme|license|licence|copying|notice)(?:\.|$)/i.test(relPath);
+}
+
+function alwaysIgnored(relPath) {
+  const name = basename(relPath);
+  return name === '.npmrc'
+    || name === '.gitignore'
+    || name === '.npmignore'
+    || name === '.DS_Store'
+    || name === 'npm-debug.log'
+    || name === 'yarn-error.log'
+    || name === 'package-lock.json'
+    || name === 'config.gypi'
+    || name === '.lock-wscript'
+    || /^\.wafpickle-/.test(name)
+    || /^\..*\.swp$/.test(name)
+    || name.endsWith('.orig');
+}
+
+function readIgnoreFile(path) {
+  try {
+    return readFileSync(path, 'utf8').split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter((line) => line && !line.startsWith('#'));
+  } catch {
+    return null;
+  }
+}
+
+/** npm uses .npmignore in a directory, falling back to .gitignore. */
+function ignoreFileIn(dir) {
+  const npmignore = join(dir, '.npmignore');
+  if (existsSync(npmignore)) return npmignore;
+  const gitignore = join(dir, '.gitignore');
+  if (existsSync(gitignore)) return gitignore;
+  return undefined;
+}
+
+export function buildPacklist(dir, manifest) {
+  const paths = new Set();
+  let complete = true;
+  if (manifest.files !== undefined && !Array.isArray(manifest.files)) complete = false;
+  if ((manifest.bundleDependencies || manifest.bundledDependencies || []).length > 0) complete = false;
+  const main = typeof manifest.main === 'string' && manifest.main ? normalizePath(manifest.main) : undefined;
+  if (main?.startsWith('../')) complete = false;
+
+  // npm-packlist disables the ROOT .npmignore/.gitignore as soon as package.json
+  // has a `files` array (the array is the complete selection). Nested ignore
+  // files still apply, which is why the groups are collected per directory below.
+  const hasFiles = Array.isArray(manifest.files);
+  const rootGroups = [];
+  if (!hasFiles) {
+    const rootFile = ignoreFileIn(dir);
+    if (rootFile) {
+      const rules = readIgnoreFile(rootFile);
+      if (rules === null) complete = false;
+      else rootGroups.push({ base: dir, rules });
+    }
+  }
+
+  function walk(current, inherited) {
+    let entries;
+    try {
+      entries = readdirSync(current, { withFileTypes: true });
+    } catch {
+      complete = false;
+      return;
+    }
+    let groups = inherited;
+    if (current !== dir) {
+      const nested = ignoreFileIn(current);
+      if (nested) {
+        const rules = readIgnoreFile(nested);
+        if (rules === null) complete = false;
+        else groups = [...inherited, { base: current, rules }];
+      }
+    }
+    for (const entry of entries) {
+      const absolute = join(current, entry.name);
+      const relPath = normalizePath(relative(dir, absolute));
+      if (entry.isSymbolicLink()) {
+        complete = false;
+        continue;
+      }
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) walk(absolute, groups);
+        continue;
+      }
+      if (!entry.isFile() || alwaysIgnored(relPath)) continue;
+      try {
+        const included = manifest.files === undefined
+          ? true
+          : Array.isArray(manifest.files) && ruleState(manifest.files, relPath, false);
+        let ignored = false;
+        for (const group of groups) {
+          const rel = normalizePath(relative(group.base, absolute));
+          if (rel === '' || rel.startsWith('..')) continue;
+          if (ruleState(group.rules, rel, false)) {
+            ignored = true;
+            break;
+          }
+        }
+        if (intrinsic(relPath, main) || (included && !ignored)) paths.add(relPath);
+      } catch {
+        complete = false;
+      }
+    }
+  }
+
+  walk(dir, rootGroups);
+  return { paths, complete };
+}
+
+export function hasPackedFile(packlist, relPath) {
+  return packlist.paths.has(normalizePath(relPath));
+}

package/src/core/peer.js

@@ -0,0 +1,39 @@
+import { satisfies } from './semver.js';
+
+/** DSH peer declarations the host checks before importing a plugin. */
+export function dshPeers(manifest) {
+  return Object.entries((manifest && manifest.peerDependencies) || {})
+    .filter(([name]) => name === '@deepseek-ai/dsh' || name.startsWith('@deepseek-ai/dsh-'))
+    .map(([name, range]) => ({ name, range: String(range) }));
+}
+
+/**
+ * Evaluate the host's admission rule for one target runtime.
+ *
+ * The host requires every DSH peer range to accept the single runtime version
+ * and lets prereleases participate. Missing peers impose no constraint; a range
+ * this module cannot decide is reported as 'unknown', never as a rejection.
+ */
+export function evaluatePeers(manifest, runtime) {
+  const peers = dshPeers(manifest);
+  const result = {
+    runtime: runtime || null,
+    peers,
+    verdict: 'no-constraint',
+    unsatisfied: [],
+    undecidable: [],
+  };
+  if (!runtime || peers.length === 0) return result;
+  for (const peer of peers) {
+    // The host substitutes the runtime version for workspace:^/~/* before
+    // comparing, so those ranges always match.
+    if (['workspace:^', 'workspace:~', 'workspace:*'].includes(peer.range)) continue;
+    const verdict = satisfies(runtime, peer.range);
+    if (verdict === null) result.undecidable.push(peer);
+    else if (verdict === false) result.unsatisfied.push(peer);
+  }
+  result.verdict = result.unsatisfied.length > 0 ? 'will-reject'
+    : result.undecidable.length > 0 ? 'unknown'
+      : 'will-load';
+  return result;
+}

package/src/core/profile-scan.js

@@ -0,0 +1,121 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { evaluatePeers } from './peer.js';
+
+function readJson(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return undefined; }
+}
+
+/** The host gates on the app-boot package version; fall back to the dsh package. */
+export function profileRuntimeVersion(profileDir, override) {
+  if (override) return override;
+  for (const path of [
+    join(profileDir, 'node_modules', '@deepseek-ai', 'dsh-app-boot', 'package.json'),
+    join(profileDir, 'node_modules', '@deepseek-ai', 'dsh', 'package.json'),
+  ]) {
+    const version = readJson(path)?.version;
+    if (typeof version === 'string' && version) return version;
+  }
+  return undefined;
+}
+
+function declaredBundles(manifest) {
+  const declared = manifest?.dsh?.profile?.bundles;
+  if (!Array.isArray(declared)) return [];
+  const names = [];
+  for (const entry of declared) {
+    const name = typeof entry === 'string'
+      ? entry
+      : entry?.name || entry?.id || entry?.package || entry?.bundle || entry?.plugin;
+    if (typeof name === 'string' && name && !names.includes(name)) names.push(name);
+  }
+  return names;
+}
+
+/** dsh.profile.bundles when present, otherwise every package in node_modules. */
+export function installedBundles(profileDir) {
+  const manifest = readJson(join(profileDir, 'package.json'));
+  const declared = declaredBundles(manifest);
+  if (declared.length > 0) return declared;
+  const nodeModules = join(profileDir, 'node_modules');
+  if (!existsSync(nodeModules)) return [];
+  const names = [];
+  for (const entry of readdirSync(nodeModules, { withFileTypes: true })) {
+    if (entry.name.startsWith('.')) continue;
+    const path = join(nodeModules, entry.name);
+    if (entry.name.startsWith('@')) {
+      let children = [];
+      try { children = readdirSync(path, { withFileTypes: true }); } catch { children = []; }
+      for (const child of children) names.push(entry.name + '/' + child.name);
+    } else {
+      names.push(entry.name);
+    }
+  }
+  return names;
+}
+
+function allowCommand(profileDir, name, version, runtime) {
+  if (!version || !runtime) return undefined;
+  return 'dsh plugin --profile ' + basename(profileDir)
+    + ' allow-version ' + name + '@' + version
+    + ' --dsh-version ' + runtime + ' --accept-risk';
+}
+
+/**
+ * Offline admission scan of an installed profile. It reads manifests only; it
+ * never imports a plugin or touches the running host.
+ */
+export function scanProfile(profileDir, { dshVersion } = {}) {
+  if (!existsSync(join(profileDir, 'package.json'))) {
+    throw new Error('not a profile directory (no package.json): ' + profileDir);
+  }
+  const runtime = profileRuntimeVersion(profileDir, dshVersion);
+  const plugins = [];
+  for (const name of installedBundles(profileDir)) {
+    const manifest = readJson(join(profileDir, 'node_modules', ...name.split('/'), 'package.json'));
+    if (!manifest) continue;
+    const peers = evaluatePeers(manifest, runtime);
+    plugins.push({
+      name,
+      version: typeof manifest.version === 'string' ? manifest.version : null,
+      firstParty: name.startsWith('@deepseek-ai/'),
+      runtime: runtime || null,
+      verdict: runtime ? peers.verdict : 'unknown',
+      unsatisfied: peers.unsatisfied,
+      undecidable: peers.undecidable,
+      allowCommand: peers.verdict === 'will-reject' ? allowCommand(profileDir, name, manifest.version, runtime) : undefined,
+    });
+  }
+  const summary = {
+    total: plugins.length,
+    willReject: plugins.filter((plugin) => plugin.verdict === 'will-reject').length,
+    willLoad: plugins.filter((plugin) => plugin.verdict === 'will-load').length,
+    noConstraint: plugins.filter((plugin) => plugin.verdict === 'no-constraint').length,
+    unknown: plugins.filter((plugin) => plugin.verdict === 'unknown').length,
+    firstParty: plugins.filter((plugin) => plugin.firstParty).length,
+  };
+  return { schemaVersion: 1, mode: 'profile-scan', profile: profileDir, runtime: runtime || null, plugins, summary };
+}
+
+export function formatProfileScan(scan) {
+  const lines = [
+    'profile ' + scan.profile + ' · runtime ' + (scan.runtime || 'unknown'),
+    '  ' + scan.summary.total + ' bundle(s) · ' + scan.summary.willReject + ' will-reject · '
+      + scan.summary.willLoad + ' will-load · ' + scan.summary.unknown + ' unknown',
+  ];
+  for (const plugin of scan.plugins) {
+    if (plugin.firstParty && plugin.verdict !== 'will-reject') continue;
+    if (plugin.verdict === 'will-reject') {
+      lines.push('  ✗ ' + plugin.name + '@' + (plugin.version || '?') + '  will-reject');
+      for (const peer of plugin.unsatisfied) {
+        lines.push('      ' + peer.name + ' "' + peer.range + '" does not accept ' + scan.runtime);
+      }
+      if (plugin.allowCommand) lines.push('      grant an exact exemption: ' + plugin.allowCommand);
+    } else if (plugin.verdict === 'unknown') {
+      lines.push('  ? ' + plugin.name + '@' + (plugin.version || '?') + '  unknown (no runtime version or an undecidable range)');
+    } else {
+      lines.push('  ✓ ' + plugin.name + '@' + (plugin.version || '?') + '  ' + plugin.verdict);
+    }
+  }
+  return lines.join('\n');
+}

package/src/core/report.js

@@ -0,0 +1,174 @@
+import { realpathSync } from 'node:fs';
+import { isAbsolute, join, relative } from 'node:path';
+import { fingerprint } from './baseline.js';
+
+const COLOR = {
+  error: '\u001b[31m',
+  warn: '\u001b[33m',
+  info: '\u001b[36m',
+  dim: '\u001b[2m',
+  bold: '\u001b[1m',
+  reset: '\u001b[0m',
+};
+
+const LABEL = { error: 'error', warn: 'warn ', info: 'info ' };
+
+/**
+ * An SVG badge for a README. The badge carries the verdict, not just the brand:
+ * "0 error · 1 warn · compatible with 2 DSH versions". A reader should learn
+ * something from the badge alone.
+ */
+export function toBadge(report) {
+  const s = report.summary;
+  const declared = (report.dsh && report.dsh.declared) || [];
+  const versionText = declared.length > 0 ? ' · ' + declared.length + ' DSH' : '';
+  const label = s.error + ' error · ' + s.warn + ' warn' + versionText;
+  const color = s.error > 0 ? '#cf222e' : s.warn > 0 ? '#bf8700' : '#1a7f37';
+  const left = 'dsh-plugin-lint';
+  const width = 90 + label.length * 6.2;
+  const leftWidth = 96;
+  const rightWidth = width - leftWidth;
+  return [
+    '<svg xmlns="http://www.w3.org/2000/svg" width="' + Math.round(width) + '" height="20" role="img" aria-label="' + left + ': ' + label + '">',
+    '  <title>' + left + ': ' + label + '</title>',
+    '  <linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient>',
+    '  <clipPath id="r"><rect width="' + Math.round(width) + '" height="20" rx="3" fill="#fff"/></clipPath>',
+    '  <g clip-path="url(#r)">',
+    '    <rect width="' + leftWidth + '" height="20" fill="#555"/>',
+    '    <rect x="' + leftWidth + '" width="' + Math.round(rightWidth) + '" height="20" fill="' + color + '"/>',
+    '    <rect width="' + Math.round(width) + '" height="20" fill="url(#s)"/>',
+    '  </g>',
+    '  <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110">',
+    '    <text aria-hidden="true" x="' + (leftWidth * 5) + '" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="' + (leftWidth * 10 - 100) + '">' + left + '</text>',
+    '    <text x="' + (leftWidth * 5) + '" y="140" transform="scale(.1)" fill="#fff" textLength="' + (leftWidth * 10 - 100) + '">' + left + '</text>',
+    '    <text aria-hidden="true" x="' + ((leftWidth + rightWidth / 2) * 10) + '" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="' + (rightWidth * 10 - 100) + '">' + label + '</text>',
+    '    <text x="' + ((leftWidth + rightWidth / 2) * 10) + '" y="140" transform="scale(.1)" fill="#fff" textLength="' + (rightWidth * 10 - 100) + '">' + label + '</text>',
+    '  </g>',
+    '</svg>',
+  ].join('\n');
+}
+
+export function formatText(report, options = {}) {
+  const paint = (level, text) => (options.color ? COLOR[level] + text + COLOR.reset : text);
+  const dim = (text) => (options.color ? COLOR.dim + text + COLOR.reset : text);
+  const lines = [];
+  const t = report.target;
+  lines.push((options.color ? COLOR.bold : '') + t.name + '@' + t.version
+    + (options.color ? COLOR.reset : '') + dim('  ' + report.checks + ' checks'));
+  lines.push('');
+
+  if (report.findings.length === 0) {
+    lines.push('  ' + paint('info', 'clean') + '  no findings');
+  }
+  for (const f of report.findings) {
+    const where = f.file ? f.file + (f.line ? ':' + f.line : '') : '';
+    lines.push('  ' + paint(f.level, f.rule + ' ' + LABEL[f.level]) + '  ' + f.title);
+    if (where) lines.push('         ' + dim(where));
+    if (f.message) lines.push('         ' + f.message);
+    if (f.evidence) lines.push('         ' + dim('evidence: ' + f.evidence));
+    if (f.hint) lines.push('         ' + dim('why: ' + f.hint));
+    lines.push('         ' + dim('doc: ' + f.doc));
+    lines.push('');
+  }
+
+  const s = report.summary;
+  lines.push('  ' + s.error + ' error · ' + s.warn + ' warn · ' + s.info + ' info');
+  return lines.join('\n');
+}
+
+function uriFor(report, file) {
+  const absolute = join(report.target.path, file || 'package.json');
+  let cwd = process.cwd();
+  let target = absolute;
+  try { cwd = realpathSync(cwd); } catch { /* keep the logical path */ }
+  try { target = realpathSync(absolute); } catch { /* the finding may point at a virtual path */ }
+  const rel = relative(cwd, target).replace(/\\/g, '/');
+  return rel && !rel.startsWith('..') && !isAbsolute(rel) ? rel : target.replace(/\\/g, '/');
+}
+
+function ruleHelpUri(id) {
+  return 'https://github.com/shidesheng0218/dsh-plugin-lint/blob/main/docs/rules/' + id + '.md';
+}
+
+export function toSarif(reports) {
+  const list = Array.isArray(reports) ? reports : [reports];
+  const ruleIndex = new Map();
+  const rules = [];
+  const results = [];
+  for (const report of list) {
+    for (const f of report.findings) {
+      if (!ruleIndex.has(f.rule)) {
+        ruleIndex.set(f.rule, rules.length);
+        rules.push({
+          id: f.rule,
+          name: f.rule,
+          shortDescription: { text: f.title },
+          helpUri: ruleHelpUri(f.rule),
+          properties: { doc: f.doc, level: f.level },
+        });
+      }
+      results.push({
+        ruleId: f.rule,
+        ruleIndex: ruleIndex.get(f.rule),
+        level: f.level === 'error' ? 'error' : f.level === 'warn' ? 'warning' : 'note',
+        message: { text: f.message + (f.hint ? ' — ' + f.hint : '') },
+        partialFingerprints: { 'dshPluginLint/v1': fingerprint(f) },
+        locations: [{
+          physicalLocation: {
+            artifactLocation: { uri: uriFor(report, f.file), uriBaseId: '%SRCROOT%' },
+            region: { startLine: f.line || 1 },
+          },
+        }],
+      });
+    }
+  }
+  return {
+    version: '2.1.0',
+    $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+    runs: [{
+      tool: { driver: { name: 'dsh-plugin-lint', informationUri: 'https://github.com/shidesheng0218/dsh-plugin-lint', rules } },
+      results,
+    }],
+  };
+}
+
+function escapeData(value) {
+  return String(value).replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
+}
+
+function escapeProperty(value) {
+  return escapeData(value).replace(/:/g, '%3A').replace(/,/g, '%2C');
+}
+
+export function toGithub(reports) {
+  const lines = [];
+  for (const report of reports) {
+    for (const f of report.findings) {
+      const level = f.level === 'error' ? 'error' : f.level === 'warn' ? 'warning' : 'notice';
+      const properties = ['file=' + escapeProperty(uriFor(report, f.file))];
+      if (f.line) properties.push('line=' + f.line);
+      properties.push('title=' + escapeProperty(f.rule + ' ' + f.title));
+      lines.push('::' + level + ' ' + properties.join(',') + '::' + escapeData(f.message + (f.hint ? ' — ' + f.hint : '')));
+    }
+  }
+  return lines.join('\n');
+}
+
+function xml(value) {
+  return String(value).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
+}
+
+export function toJunit(reports) {
+  const suites = reports.map((report) => {
+    const failures = report.findings.filter((finding) => finding.level !== 'info').length;
+    const cases = report.findings.map((finding) => {
+      const name = finding.rule + ' ' + (finding.file || 'package.json') + (finding.line ? ':' + finding.line : '');
+      const body = finding.level === 'info'
+        ? ''
+        : '<failure type="' + xml(finding.rule) + '" message="' + xml(finding.message) + '">' + xml(finding.evidence || '') + '</failure>';
+      return '<testcase classname="' + xml(report.target.name) + '" name="' + xml(name) + '">' + body + '</testcase>';
+    }).join('');
+    return '<testsuite name="' + xml(report.target.name) + '" tests="' + report.findings.length + '" failures="' + failures + '">' + cases + '</testsuite>';
+  }).join('');
+  return '<?xml version="1.0" encoding="UTF-8"?>\n<testsuites>' + suites + '</testsuites>';
+}