@socketsecurity/cli-with-sentry 0.15.34 → 0.15.36

package/dist/cli.js

@@ -3667,44 +3667,70 @@ function getBaseGitBranch() {
   // https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-branches#about-the-default-branch
   'main';
 }
-function getSocketBranchName(purl, newVersion, workspaceName) {
-  const purlObj = vendor.packageurlJsExports.PackageURL.fromString(purl);
-  const maybeWorkspaceName = workspaceName ? `${formatBranchName(workspaceName)}-` : '';
-  const maybeNamespace = purlObj.namespace ? `${formatBranchName(purlObj.namespace)}-` : '';
-  const fullName = `${maybeWorkspaceName}${maybeNamespace}${formatBranchName(purlObj.name)}`;
-  return `socket/${fullName}-${formatBranchName(newVersion)}`;
-}
-function getSocketPrTitlePattern(options) {
+function getSocketBranchName(purl, newVersion, workspace) {
+  const purlObj = utils.getPurlObject(purl);
+  const fmtType = formatBranchName(purlObj.type);
+  const fmtWorkspace = workspace ? `${formatBranchName(workspace)}` : 'root';
+  const fmtMaybeNamespace = purlObj.namespace ? `${formatBranchName(purlObj.namespace)}--` : '';
+  const fmtFullName = `${fmtMaybeNamespace}${formatBranchName(purlObj.name)}`;
+  const fmtVersion = formatBranchName(purlObj.version);
+  const fmtNewVersion = formatBranchName(newVersion);
+  return `socket/${fmtType}_${fmtWorkspace}_${fmtFullName}_${fmtVersion}_${fmtNewVersion}`;
+}
+function getSocketBranchPattern(options) {
   const {
+    newVersion,
     purl,
     workspace
   } = {
     __proto__: null,
     ...options
   };
-  const purlObj = purl ? vendor.packageurlJsExports.PackageURL.fromString(purl) : null;
-  const escapedPkgFullName = purlObj ? regexps.escapeRegExp(utils.getPkgFullNameFromPurlObj(purlObj)) : '\\S+';
-  const escapedPkgVersion = purlObj ? regexps.escapeRegExp(purlObj.version) : '\\S+';
-  const escapedWorkspaceDetails = workspace ? ` in ${regexps.escapeRegExp(workspace)}` : '';
-  return new RegExp(`Bump ${escapedPkgFullName} from ${escapedPkgVersion} to \\S+${escapedWorkspaceDetails}`);
-}
-function getSocketPullRequestTitle(purl, toVersion, workspace) {
-  const purlObj = vendor.packageurlJsExports.PackageURL.fromString(purl);
-  const pkgFullName = utils.getPkgFullNameFromPurlObj(purlObj);
-  const workspaceDetails = workspace ? ` in ${workspace}` : '';
-  return `Bump ${pkgFullName} from ${purlObj.version} to ${toVersion}${workspaceDetails}`;
-}
-function getSocketPullRequestBody(purl, newVersion, workspaceName) {
-  const purlObj = vendor.packageurlJsExports.PackageURL.fromString(purl);
-  const pkgFullName = utils.getPkgFullNameFromPurlObj(purlObj);
-  const workspaceDetails = workspaceName ? ` in ${workspaceName}` : '';
-  return `Bump [${pkgFullName}](${utils.getSocketDevPackageOverviewUrlFromPurl(purlObj)}) from ${purlObj.version} to ${newVersion}${workspaceDetails}.`;
-}
-function getSocketCommitMessage(purl, newVersion, workspaceName) {
-  const purlObj = vendor.packageurlJsExports.PackageURL.fromString(purl);
-  const pkgFullName = utils.getPkgFullNameFromPurlObj(purlObj);
-  const workspaceDetails = workspaceName ? ` in ${workspaceName}` : '';
-  return `socket: Bump ${pkgFullName} from ${purlObj.version} to ${newVersion}${workspaceDetails}`;
+  const purlObj = purl ? utils.getPurlObject(purl) : null;
+  const escType = purlObj ? regexps.escapeRegExp(purlObj.type) : '[^_]+';
+  const escWorkspace = workspace ? `${regexps.escapeRegExp(formatBranchName(workspace))}` : 'root';
+  const escMaybeNamespace = purlObj?.namespace ? `${regexps.escapeRegExp(formatBranchName(purlObj.namespace))}--` : '';
+  const escFullName = purlObj ? `${escMaybeNamespace}${regexps.escapeRegExp(formatBranchName(purlObj.name))}` : '[^_]+';
+  const escVersion = purlObj ? regexps.escapeRegExp(formatBranchName(purlObj.version)) : '[^_]+';
+  const escNewVersion = newVersion ? regexps.escapeRegExp(formatBranchName(newVersion)) : '[^_]+';
+  return new RegExp(`^socket/(${escType})_(${escWorkspace})_(${escFullName})_(${escVersion})_(${escNewVersion})$`);
+}
+function createSocketBranchParser(options) {
+  const pattern = getSocketBranchPattern(options);
+  return function parse(branch) {
+    const match = pattern.exec(branch);
+    if (!match) {
+      return null;
+    }
+    const {
+      0: type,
+      1: workspace,
+      2: fullName,
+      3: version,
+      4: newVersion
+    } = match;
+    return {
+      newVersion,
+      purl: utils.getPurlObject(`pkg:${type}/${fullName}@${version}`),
+      workspace
+    };
+  };
+}
+function getSocketPullRequestTitle(purl, newVersion, workspace) {
+  const purlObj = utils.getPurlObject(purl);
+  const fullName = utils.getPkgFullNameFromPurlObj(purlObj);
+  return `Bump ${fullName} from ${purlObj.version} to ${newVersion}${workspace ? ` in ${workspace}` : ''}`;
+}
+function getSocketPullRequestBody(purl, newVersion, workspace) {
+  const purlObj = utils.getPurlObject(purl);
+  const fullName = utils.getPkgFullNameFromPurlObj(purlObj);
+  const pkgOverviewUrl = utils.getSocketDevPackageOverviewUrlFromPurl(purlObj);
+  return `Bump [${fullName}](${pkgOverviewUrl}) from ${purlObj.version} to ${newVersion}${workspace ? ` in ${workspace}` : ''}.`;
+}
+function getSocketCommitMessage(purl, newVersion, workspace) {
+  const purlObj = utils.getPurlObject(purl);
+  const fullName = utils.getPkgFullNameFromPurlObj(purlObj);
+  return `socket: Bump ${fullName} from ${purlObj.version} to ${newVersion}${workspace ? ` in ${workspace}` : ''}`;
 }
 async function gitCleanFdx(cwd = process.cwd()) {
   const stdioIgnoreOptions = {
@@ -3819,9 +3845,15 @@ async function gitUnstagedModifiedFiles(cwd = process.cwd()) {
 let _octokit;
 function getOctokit() {
   if (_octokit === undefined) {
+    // Lazily access constants.ENV.SOCKET_CLI_GITHUB_TOKEN.
+    const {
+      SOCKET_CLI_GITHUB_TOKEN
+    } = constants.ENV;
+    if (!SOCKET_CLI_GITHUB_TOKEN) {
+      debug.debugFn('miss: SOCKET_CLI_GITHUB_TOKEN env var');
+    }
     _octokit = new vendor.Octokit({
-      // Lazily access constants.ENV.SOCKET_CLI_GITHUB_TOKEN.
-      auth: constants.ENV.SOCKET_CLI_GITHUB_TOKEN
+      auth: SOCKET_CLI_GITHUB_TOKEN
     });
   }
   return _octokit;
@@ -3829,10 +3861,16 @@ function getOctokit() {
 let _octokitGraphql;
 function getOctokitGraphql() {
   if (!_octokitGraphql) {
+    // Lazily access constants.ENV.SOCKET_CLI_GITHUB_TOKEN.
+    const {
+      SOCKET_CLI_GITHUB_TOKEN
+    } = constants.ENV;
+    if (!SOCKET_CLI_GITHUB_TOKEN) {
+      debug.debugFn('miss: SOCKET_CLI_GITHUB_TOKEN env var');
+    }
     _octokitGraphql = vendor.graphql2.defaults({
       headers: {
-        // Lazily access constants.ENV.SOCKET_CLI_GITHUB_TOKEN.
-        authorization: `token ${constants.ENV.SOCKET_CLI_GITHUB_TOKEN}`
+        authorization: `token ${SOCKET_CLI_GITHUB_TOKEN}`
       }
     });
   }
@@ -3878,25 +3916,30 @@ async function writeCache(key, data) {
   }
   await fs$2.writeJson(cacheJsonPath, data);
 }
-async function cleanupOpenPrs(owner, repo, newVersion, options) {
+async function cleanupOpenPrs(owner, repo, options) {
   const contextualMatches = await getOpenSocketPrsWithContext(owner, repo, options);
   if (!contextualMatches.length) {
     return [];
   }
   const cachesToSave = new Map();
+  const {
+    newVersion
+  } = {
+    __proto__: null,
+    ...options
+  };
   const octokit = getOctokit();
   const settledMatches = await Promise.allSettled(contextualMatches.map(async ({
     context,
     match
   }) => {
     const {
+      newVersion: prToVersion,
       number: prNum
     } = match;
     const prRef = `PR #${prNum}`;
-    const prToVersionText = /(?<= to )\S+/.exec(match.title)?.[0];
-    const prToVersion = vendor.semverExports.coerce(prToVersionText);
     // Close older PRs.
-    if (prToVersion && vendor.semverExports.lt(prToVersion, newVersion)) {
+    if (prToVersion && newVersion && vendor.semverExports.lt(prToVersion, newVersion)) {
       try {
         await octokit.pulls.update({
           owner,
@@ -3911,7 +3954,7 @@ async function cleanupOpenPrs(owner, repo, newVersion, options) {
         cachesToSave.set(context.cacheKey, context.data);
         return null;
       } catch (e) {
-        debug.debugFn(`fail: close ${prRef}\n`, e?.message || 'unknown error');
+        debug.debugFn(`fail: close ${prRef} for ${prToVersion}\n`, e?.message || 'unknown error');
       }
     }
     // Update stale PRs.
@@ -3990,9 +4033,15 @@ async function enablePrAutoMerge({
     enabled: false
   };
 }
-function getGitHubEnvRepoInfo() {
+function getGithubEnvRepoInfo() {
   // Lazily access constants.ENV.GITHUB_REPOSITORY.
-  const ownerSlashRepo = constants.ENV.GITHUB_REPOSITORY;
+  const {
+    GITHUB_REPOSITORY
+  } = constants.ENV;
+  if (!GITHUB_REPOSITORY) {
+    debug.debugFn('miss: GITHUB_REPOSITORY env var');
+  }
+  const ownerSlashRepo = GITHUB_REPOSITORY;
   const slashIndex = ownerSlashRepo.indexOf('/');
   if (slashIndex === -1) {
     return null;
@@ -4016,7 +4065,7 @@ async function getOpenSocketPrsWithContext(owner, repo, options_) {
   const checkAuthor = strings.isNonEmptyString(author);
   const octokit = getOctokit();
   const octokitGraphql = getOctokitGraphql();
-  const titlePattern = getSocketPrTitlePattern(options);
+  const prBranchParser = createSocketBranchParser(options);
   const contextualMatches = [];
   try {
     // Optimistically fetch only the first 50 open PRs using GraphQL to minimize
@@ -4050,7 +4099,10 @@ async function getOpenSocketPrsWithContext(owner, repo, options_) {
       const node = nodes[i];
       const login = node.author?.login;
       const matchesAuthor = checkAuthor ? login === author : true;
-      if (matchesAuthor && titlePattern.test(node.title)) {
+      const matchesBranch = prBranchParser(node.headRefName);
+      debug.debugFn('gql node.headRefName', node.headRefName);
+      debug.debugFn('qgl matchesBranch', matchesBranch);
+      if (matchesAuthor && matchesBranch) {
         contextualMatches.push({
           context: {
             apiType: 'graphql',
@@ -4062,6 +4114,7 @@ async function getOpenSocketPrsWithContext(owner, repo, options_) {
           },
           match: {
             ...node,
+            ...matchesBranch,
             author: login ?? '<unknown>'
           }
         });
@@ -4092,7 +4145,10 @@ async function getOpenSocketPrsWithContext(owner, repo, options_) {
     const pr = allOpenPrs[i];
     const login = pr.user?.login;
     const matchesAuthor = checkAuthor ? login === author : true;
-    if (matchesAuthor && titlePattern.test(pr.title)) {
+    const matchesBranch = prBranchParser(pr.head.ref);
+    debug.debugFn('octa node.headRefName', pr.head.ref);
+    debug.debugFn('octa matchesBranch', matchesBranch);
+    if (matchesAuthor && matchesBranch) {
       contextualMatches.push({
         context: {
           apiType: 'rest',
@@ -4103,6 +4159,7 @@ async function getOpenSocketPrsWithContext(owner, repo, options_) {
           parent: allOpenPrs
         },
         match: {
+          ...matchesBranch,
           author: login ?? '<unknown>',
           baseRefName: pr.base.ref,
           headRefName: pr.head.ref,
@@ -4130,15 +4187,16 @@ async function openPr(owner, repo, branch, purl, newVersion, options) {
     debug.debugFn('miss: GITHUB_ACTIONS env var');
     return null;
   }
+  const purlObj = utils.getPurlObject(purl);
   const octokit = getOctokit();
   try {
     return await octokit.pulls.create({
       owner,
       repo,
-      title: getSocketPullRequestTitle(purl, newVersion, workspace),
+      title: getSocketPullRequestTitle(purlObj, newVersion, workspace),
       head: branch,
       base: baseBranch,
-      body: getSocketPullRequestBody(purl, newVersion, workspace)
+      body: getSocketPullRequestBody(purlObj, newVersion, workspace)
     });
   } catch (e) {
     let message = `Failed to open pull request`;
@@ -4167,7 +4225,7 @@ async function prExistForBranch(owner, repo, branch) {
   } catch {}
   return false;
 }
-async function setGitRemoteGitHubRepoUrl(owner, repo, token, cwd = process.cwd()) {
+async function setGitRemoteGithubRepoUrl(owner, repo, token, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
     stdio: 'ignore'
@@ -4240,15 +4298,17 @@ async function npmFix(pkgEnvDetails, {
   const gitUser = constants.ENV.SOCKET_CLI_GIT_USER_NAME;
   const githubToken = constants.ENV.SOCKET_CLI_GITHUB_TOKEN;
   const isCi = !!(constants.ENV.CI && constants.ENV.GITHUB_ACTIONS && constants.ENV.GITHUB_REPOSITORY && gitEmail && gitUser && githubToken);
+  const repoInfo = isCi ? getGithubEnvRepoInfo() : null;
   spinner?.start();
-  let count = 0;
-  let repoInfo = null;
-  if (isCi) {
-    repoInfo = getGitHubEnvRepoInfo();
-    count += (await getOpenSocketPrs(repoInfo.owner, repoInfo.repo, {
-      author: gitUser
-    })).length;
-  }
+  const openPrs =
+  // Check repoInfo to make TypeScript happy.
+  isCi && repoInfo ? await getOpenSocketPrs(repoInfo.owner, repoInfo.repo, {
+    author: gitUser
+  }) : [];
+  if (openPrs.length) {
+    debug.debugFn(`found: ${openPrs.length} open PRs`);
+  }
+  let count = isCi ? openPrs.length : 0;
   const arb = new shadowInject.Arborist({
     path: rootPath,
     ...shadowInject.SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES
@@ -4259,9 +4319,9 @@ async function npmFix(pkgEnvDetails, {
   let alertsMap;
   try {
     alertsMap = purls.length ? await utils.getAlertsMapFromPurls(purls, getAlertsMapOptions({
-      limit
+      limit: limit + openPrs.length
     })) : await shadowInject.getAlertsMapFromArborist(arb, getAlertsMapOptions({
-      limit
+      limit: limit + openPrs.length
     }));
   } catch (e) {
     spinner?.stop();
@@ -4273,7 +4333,7 @@ async function npmFix(pkgEnvDetails, {
     };
   }
   const infoByPkgName = utils.getCveInfoFromAlertsMap(alertsMap, {
-    limit
+    limit: limit + openPrs.length
   });
   if (!infoByPkgName) {
     spinner?.stop();
@@ -4306,10 +4366,15 @@ async function npmFix(pkgEnvDetails, {
       length
     } = sortedInfoEntries; i < length; i += 1) {
     const isLastInfoEntry = i === length - 1;
+    const infoEntry = sortedInfoEntries[i];
     const {
-      0: name,
-      1: infos
-    } = sortedInfoEntries[i];
+      0: name
+    } = infoEntry;
+    const openPrsForPkg = openPrs.filter(pr => name === packages.resolvePackageName(pr.purl));
+    const infos = [...infoEntry[1].values()].filter(info => !openPrsForPkg.find(pr => pr.newVersion === info.firstPatchedVersionIdentifier));
+    if (!infos.length) {
+      continue infoEntriesLoop;
+    }
     logger.logger.log(`Processing vulns for ${name}:`);
     logger.logger.indent();
     spinner?.indent();
@@ -4447,7 +4512,9 @@ async function npmFix(pkgEnvDetails, {
             error = e;
           }
           spinner?.stop();
-          if (!errored && isCi) {
+
+          // Check repoInfo to make TypeScript happy.
+          if (!errored && isCi && repoInfo) {
             try {
               // eslint-disable-next-line no-await-in-loop
               const result = await gitUnstagedModifiedFiles(cwd);
@@ -4503,7 +4570,8 @@ async function npmFix(pkgEnvDetails, {
               }
 
               // eslint-disable-next-line no-await-in-loop
-              await Promise.allSettled([setGitRemoteGitHubRepoUrl(repoInfo.owner, repoInfo.repo, githubToken, cwd), cleanupOpenPrs(repoInfo.owner, repoInfo.repo, newVersion, {
+              await Promise.allSettled([setGitRemoteGithubRepoUrl(repoInfo.owner, repoInfo.repo, githubToken, cwd), cleanupOpenPrs(repoInfo.owner, repoInfo.repo, {
+                newVersion,
                 purl: oldPurl,
                 workspace
               })]);
@@ -4670,15 +4738,17 @@ async function pnpmFix(pkgEnvDetails, {
   const gitUser = constants.ENV.SOCKET_CLI_GIT_USER_NAME;
   const githubToken = constants.ENV.SOCKET_CLI_GITHUB_TOKEN;
   const isCi = !!(constants.ENV.CI && constants.ENV.GITHUB_ACTIONS && constants.ENV.GITHUB_REPOSITORY && gitEmail && gitUser && githubToken);
+  const repoInfo = isCi ? getGithubEnvRepoInfo() : null;
   spinner?.start();
-  let count = 0;
-  let repoInfo = null;
-  if (isCi) {
-    repoInfo = getGitHubEnvRepoInfo();
-    count += (await getOpenSocketPrs(repoInfo.owner, repoInfo.repo, {
-      author: gitUser
-    })).length;
-  }
+  const openPrs =
+  // Check repoInfo to make TypeScript happy.
+  isCi && repoInfo ? await getOpenSocketPrs(repoInfo.owner, repoInfo.repo, {
+    author: gitUser
+  }) : [];
+  if (openPrs.length) {
+    debug.debugFn(`found: ${openPrs.length} open PRs`);
+  }
+  let count = isCi ? openPrs.length : 0;
   let actualTree;
   const lockfilePath = path.join(rootPath, 'pnpm-lock.yaml');
   let lockfileContent = await utils.readPnpmLockfile(lockfilePath);
@@ -4727,9 +4797,9 @@ async function pnpmFix(pkgEnvDetails, {
   let alertsMap;
   try {
     alertsMap = purls.length ? await utils.getAlertsMapFromPurls(purls, getAlertsMapOptions({
-      limit
+      limit: limit + openPrs.length
     })) : await utils.getAlertsMapFromPnpmLockfile(lockfile, getAlertsMapOptions({
-      limit
+      limit: limit + openPrs.length
     }));
   } catch (e) {
     spinner?.stop();
@@ -4741,7 +4811,7 @@ async function pnpmFix(pkgEnvDetails, {
     };
   }
   const infoByPkgName = utils.getCveInfoFromAlertsMap(alertsMap, {
-    limit
+    limit: limit + openPrs.length
   });
   if (!infoByPkgName) {
     spinner?.stop();
@@ -4773,10 +4843,15 @@ async function pnpmFix(pkgEnvDetails, {
       length
     } = sortedInfoEntries; i < length; i += 1) {
     const isLastInfoEntry = i === length - 1;
+    const infoEntry = sortedInfoEntries[i];
     const {
-      0: name,
-      1: infos
-    } = sortedInfoEntries[i];
+      0: name
+    } = infoEntry;
+    const openPrsForPkg = openPrs.filter(pr => name === packages.resolvePackageName(pr.purl));
+    const infos = [...infoEntry[1].values()].filter(info => !openPrsForPkg.find(pr => pr.newVersion === info.firstPatchedVersionIdentifier));
+    if (!infos.length) {
+      continue infoEntriesLoop;
+    }
     logger.logger.log(`Processing vulns for ${name}:`);
     logger.logger.indent();
     spinner?.indent();
@@ -4985,7 +5060,9 @@ async function pnpmFix(pkgEnvDetails, {
             errored = true;
           }
           spinner?.stop();
-          if (!errored && isCi) {
+
+          // Check repoInfo to make TypeScript happy.
+          if (!errored && isCi && repoInfo) {
             try {
               // eslint-disable-next-line no-await-in-loop
               const result = await gitUnstagedModifiedFiles(cwd);
@@ -5044,7 +5121,8 @@ async function pnpmFix(pkgEnvDetails, {
               }
 
               // eslint-disable-next-line no-await-in-loop
-              await Promise.allSettled([setGitRemoteGitHubRepoUrl(repoInfo.owner, repoInfo.repo, githubToken, cwd), cleanupOpenPrs(repoInfo.owner, repoInfo.repo, newVersion, {
+              await Promise.allSettled([setGitRemoteGithubRepoUrl(repoInfo.owner, repoInfo.repo, githubToken, cwd), cleanupOpenPrs(repoInfo.owner, repoInfo.repo, {
+                newVersion,
                 purl: oldPurl,
                 workspace
               })]);
@@ -11324,7 +11402,7 @@ async function createScanFromGithub({
       scansCreated += 1;
     }
   }
-  logger.logger.success(targetRepos.length, 'Github repos detected');
+  logger.logger.success(targetRepos.length, 'GitHub repos detected');
   logger.logger.success(scansCreated, 'with supported Manifest files');
   return {
     ok: true,
@@ -11373,11 +11451,11 @@ async function scanOneRepo(repoSlug, {
   } = repoResult.data;
   logger.logger.info(`Default branch: \`${defaultBranch}\``);
   const treeResult = await getRepoBranchTree({
+    defaultBranch,
+    githubToken,
     orgGithub,
     repoSlug,
-    repoApiUrl,
-    defaultBranch,
-    githubToken
+    repoApiUrl
   });
   if (!treeResult.ok) {
     return treeResult;
@@ -11555,26 +11633,23 @@ async function downloadManifestFile({
     downloadUrl = JSON.parse(downloadUrlText).download_url;
   } catch {
     logger.logger.fail(`GitHub response contained invalid JSON for download url for: ${file}`);
-    debug.debugFn('content: raw (not JSON)', downloadUrlText);
     return {
       ok: false,
       message: 'Invalid JSON response',
       cause: `Server responded with invalid JSON for download url ${downloadUrl}`
     };
   }
-  debug.debugFn('download: manifest file');
   const localPath = path.join(tmpDir, file);
-  debug.debugFn('download:', downloadUrl, '->', localPath);
+  debug.debugFn('download: manifest file started', downloadUrl, '->', localPath);
 
   // Now stream the file to that file...
-
   const result = await streamDownloadWithFetch(localPath, downloadUrl);
   if (!result.ok) {
     // Do we proceed? Bail? Hrm...
     logger.logger.fail(`Failed to download manifest file, skipping to next file. File: ${file}`);
     return result;
   }
-  debug.debugLog(`[DEBUG] Downloaded manifest file.`);
+  debug.debugFn('download: manifest file completed');
   return {
     ok: true,
     data: undefined
@@ -13605,5 +13680,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=7e206930-1632-4ae3-b9bc-0c092c388970
+//# debugId=38099217-d20f-4a32-ab28-1f8227909c96
 //# sourceMappingURL=cli.js.map