@starterculture/devkeep-actions 0.0.1

package/dist/crypting-candidates-scan.js

@@ -0,0 +1,371 @@
+#!/usr/bin/env node
+
+// ../../modules/core/dist/github/client.js
+import { Octokit } from "@octokit/rest";
+function createGithubClient(token) {
+  if (!token) {
+    throw new Error("GitHub token is required");
+  }
+  return new Octokit({ auth: token });
+}
+
+// ../../modules/core/dist/github/retryOnConflict.js
+async function retryOnConflict(attempt, maxAttempts = 3) {
+  for (let tryNumber = 1; ; tryNumber++) {
+    try {
+      return await attempt();
+    } catch (error) {
+      const status = error.status;
+      if (tryNumber >= maxAttempts || status !== 409 && status !== 422) {
+        throw error;
+      }
+      await new Promise((resolve) => setTimeout(resolve, 300 * tryNumber));
+    }
+  }
+}
+
+// ../../modules/devlore/dist/diff.js
+function toDiffFile(file) {
+  return {
+    filename: file.filename,
+    status: file.status,
+    patch: file.patch ?? "(no patch available)"
+  };
+}
+async function getProjectDiff(octokit, { owner, repo, base, head }) {
+  try {
+    const { data } = await octokit.rest.repos.compareCommitsWithBasehead({
+      owner,
+      repo,
+      basehead: `${base}...${head}`
+    });
+    return {
+      commitMessages: data.commits.map((commit) => commit.commit.message),
+      files: (data.files ?? []).map(toDiffFile)
+    };
+  } catch {
+    const { data } = await octokit.rest.repos.getCommit({ owner, repo, ref: head });
+    return {
+      commitMessages: [data.commit.message],
+      files: (data.files ?? []).map(toDiffFile)
+    };
+  }
+}
+
+// ../../modules/devcrypt/dist/patterns.js
+var SECRET_PREFIX_PATTERNS = [
+  /\bAKIA[0-9A-Z]{16}\b/,
+  // AWS access key id
+  /\bsk-(ant-)?[A-Za-z0-9_-]{20,}\b/,
+  // OpenAI / Anthropic secret key
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/,
+  // GitHub personal access / other tokens
+  /\bgithub_pat_[A-Za-z0-9_]{20,}\b/,
+  // GitHub fine-grained PAT
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
+  // Slack tokens
+  /\bAIza[0-9A-Za-z_-]{35}\b/,
+  // Google API key
+  /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/
+  // JWT-shaped
+];
+var PEM_BLOCK_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var SECRET_ASSIGNMENT_PATTERN = new RegExp(`(?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*["']([^"'\`]+)["']`, "i");
+
+// ../../modules/devcrypt/dist/candidateScan.js
+function addedLines(patch) {
+  const lines = [];
+  let newLineNumber = 0;
+  for (const rawLine of patch.split("\n")) {
+    const hunkHeader = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(rawLine);
+    if (hunkHeader) {
+      newLineNumber = Number(hunkHeader[1]);
+      continue;
+    }
+    if (rawLine.startsWith("+++") || rawLine.startsWith("---")) {
+      continue;
+    }
+    if (rawLine.startsWith("+")) {
+      lines.push({ text: rawLine.slice(1), lineNumber: newLineNumber });
+      newLineNumber++;
+    } else if (rawLine.startsWith(" ")) {
+      newLineNumber++;
+    }
+  }
+  return lines;
+}
+function redactMatch(value) {
+  if (value.length <= 10) {
+    return "*".repeat(value.length);
+  }
+  return `${value.slice(0, 4)}${"*".repeat(value.length - 8)}${value.slice(-4)}`;
+}
+var VENDOR_URL_ASSIGNMENT_PATTERN = /(?:=|:|\()\s*["'](https?:\/\/(?!localhost|127\.0\.0\.1|(?:[a-z0-9-]+\.)?(?:github\.com|npmjs\.com|anthropic\.com))[a-z0-9.-]+\.[a-z]{2,}[^\s"']*)["']/i;
+var ENV_VAR_REFERENCE_PATTERN = /\b(?:process\.env\.([A-Z_][A-Z0-9_]*)|os\.environ(?:\.get)?\s*\(\s*["']([A-Z_][A-Z0-9_]*)|os\.environ\s*\[\s*["']([A-Z_][A-Z0-9_]*)["']\s*\])/;
+var VENDOR_IMPORT_PATTERN = /(?:import\s+(?:[\s\S]*?\sfrom\s+)?["'](?!\.|@devkeep\/|node:)([a-zA-Z0-9@][a-zA-Z0-9@/_.-]*)["']|require\(\s*["'](?!\.|@devkeep\/|node:)([a-zA-Z0-9@][a-zA-Z0-9@/_.-]*)["']\s*\))/;
+function scanLineForSecrets(text, filename, lineNumber) {
+  const drafts = [];
+  for (const pattern of SECRET_PREFIX_PATTERNS) {
+    const match = pattern.exec(text);
+    if (match) {
+      drafts.push({
+        category: "secret",
+        label: `Possible key/token in ${filename}`,
+        reason: "Matches a known API key/token format",
+        sourceFile: filename,
+        sourceLine: lineNumber,
+        matchedValue: redactMatch(match[0])
+      });
+    }
+  }
+  if (PEM_BLOCK_PATTERN.test(text)) {
+    drafts.push({
+      category: "secret",
+      label: `Possible private key in ${filename}`,
+      reason: "Looks like a private key block",
+      sourceFile: filename,
+      sourceLine: lineNumber,
+      matchedValue: "-----BEGIN [REDACTED] PRIVATE KEY-----"
+    });
+  }
+  const assignmentMatch = SECRET_ASSIGNMENT_PATTERN.exec(text);
+  if (assignmentMatch?.[1]) {
+    drafts.push({
+      category: "secret",
+      label: `Possible hardcoded secret in ${filename}`,
+      reason: "Assigns what looks like a secret value directly, not from an env/config reference",
+      sourceFile: filename,
+      sourceLine: lineNumber,
+      matchedValue: redactMatch(assignmentMatch[1])
+    });
+  }
+  return drafts;
+}
+function scanLineForVendorArtifacts(text, filename, lineNumber) {
+  const drafts = [];
+  const urlMatch = VENDOR_URL_ASSIGNMENT_PATTERN.exec(text);
+  if (urlMatch?.[1]) {
+    drafts.push({
+      category: "vendor",
+      label: `New vendor URL in ${filename}`,
+      reason: "A new external URL assigned to a config value",
+      sourceFile: filename,
+      sourceLine: lineNumber,
+      matchedValue: urlMatch[1]
+    });
+  }
+  const envMatch = ENV_VAR_REFERENCE_PATTERN.exec(text);
+  if (envMatch) {
+    const name = envMatch[1] ?? envMatch[2] ?? envMatch[3];
+    drafts.push({
+      category: "vendor",
+      label: `New env-var reference in ${filename}`,
+      reason: "References a new environment variable",
+      sourceFile: filename,
+      sourceLine: lineNumber,
+      matchedValue: name ?? text.trim()
+    });
+  }
+  const importMatch = VENDOR_IMPORT_PATTERN.exec(text);
+  if (importMatch) {
+    const packageName = importMatch[1] ?? importMatch[2];
+    drafts.push({
+      category: "vendor",
+      label: `New vendor import in ${filename}`,
+      reason: "Imports a new third-party package",
+      sourceFile: filename,
+      sourceLine: lineNumber,
+      matchedValue: packageName ?? text.trim()
+    });
+  }
+  return drafts;
+}
+function scanDiffFile(file) {
+  const drafts = [];
+  for (const { text, lineNumber } of addedLines(file.patch)) {
+    drafts.push(...scanLineForSecrets(text, file.filename, lineNumber));
+    drafts.push(...scanLineForVendorArtifacts(text, file.filename, lineNumber));
+  }
+  return drafts;
+}
+function scanDiffForCandidates(diff) {
+  return diff.files.flatMap(scanDiffFile);
+}
+
+// ../../modules/devcrypt/dist/blindIndex.js
+import { createHmac, randomBytes } from "node:crypto";
+function computeBlindIndex(value, key) {
+  return createHmac("sha256", key).update(value, "utf-8").digest("hex");
+}
+
+// ../../modules/devcrypt/dist/types.js
+function normalizeEntry(raw) {
+  if (Array.isArray(raw.items)) {
+    return raw;
+  }
+  const legacy = raw;
+  const { encrypted, value, wrappedDek, keyId, iv, authTag, blindIndexHash, ...rest } = legacy;
+  return {
+    ...rest,
+    items: [
+      {
+        id: legacy.id,
+        label: "",
+        encrypted,
+        value,
+        wrappedDek,
+        keyId,
+        iv,
+        authTag,
+        blindIndexHash,
+        legacyAad: true
+      }
+    ]
+  };
+}
+
+// ../../modules/devcrypt/dist/vaultStore.js
+function isNotFound(error) {
+  return typeof error === "object" && error !== null && "status" in error && error.status === 404;
+}
+async function getExistingFile(octokit, { owner, repo }, path) {
+  try {
+    const { data } = await octokit.rest.repos.getContent({ owner, repo, path });
+    if (Array.isArray(data) || data.type !== "file") {
+      return null;
+    }
+    return { content: Buffer.from(data.content, "base64").toString("utf-8"), sha: data.sha };
+  } catch (error) {
+    if (isNotFound(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+var VAULT_ROOT = "devcrypt";
+var INDEX_PATH = `${VAULT_ROOT}/index.json`;
+function parseIndexValue(raw) {
+  const hash = raw.lastIndexOf("#");
+  return hash === -1 ? { path: raw } : { path: raw.slice(0, hash), itemId: raw.slice(hash + 1) };
+}
+async function readIndex(octokit, repoRef) {
+  const existing = await getExistingFile(octokit, repoRef, INDEX_PATH);
+  if (!existing) {
+    return { map: {} };
+  }
+  return { map: JSON.parse(existing.content), sha: existing.sha };
+}
+var ENTRY_SUBTREES = [`${VAULT_ROOT}/personal/`, `${VAULT_ROOT}/projects/`, `${VAULT_ROOT}/unscoped/`];
+async function findDuplicate(octokit, repoRef, blindIndexHash) {
+  const { map } = await readIndex(octokit, repoRef);
+  const raw = map[blindIndexHash];
+  if (!raw) {
+    return null;
+  }
+  const { path, itemId } = parseIndexValue(raw);
+  const existing = await getExistingFile(octokit, repoRef, path);
+  return existing ? { entry: normalizeEntry(JSON.parse(existing.content)), itemId } : null;
+}
+
+// ../../modules/devcrypt/dist/candidateStore.js
+var CANDIDATES_ROOT = `${VAULT_ROOT}/candidates`;
+function candidatePath(id) {
+  return `${CANDIDATES_ROOT}/${id}.json`;
+}
+async function writeCandidate(octokit, repoRef, candidate) {
+  await retryOnConflict(async () => {
+    const path = candidatePath(candidate.id);
+    const existing = await getExistingFile(octokit, repoRef, path);
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner: repoRef.owner,
+      repo: repoRef.repo,
+      path,
+      message: existing ? `Update ${path} (Devcrypt)` : `Add ${path} (Devcrypt)`,
+      content: Buffer.from(JSON.stringify(candidate, null, 2), "utf-8").toString("base64"),
+      sha: existing?.sha
+    });
+  });
+}
+
+// ../../modules/devcrypt/dist/actions/scanCryptingCandidates.js
+import { randomUUID } from "node:crypto";
+async function scanCryptingCandidates(params) {
+  const { projectOctokit, vaultOctokit, projectOwner, projectRepoName, vaultRepo, baseSha, headSha, blindIndexKey } = params;
+  const diff = await getProjectDiff(projectOctokit, {
+    owner: projectOwner,
+    repo: projectRepoName,
+    base: baseSha,
+    head: headSha
+  });
+  const drafts = scanDiffForCandidates(diff);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  let candidatesFlagged = 0;
+  for (const draft of drafts) {
+    if (draft.category === "vendor") {
+      const blindIndexHash = computeBlindIndex(draft.matchedValue, blindIndexKey);
+      const existingEntry = await findDuplicate(vaultOctokit, vaultRepo, blindIndexHash);
+      if (existingEntry) {
+        continue;
+      }
+    }
+    const candidate = {
+      id: randomUUID(),
+      status: "pending",
+      commitSha: headSha,
+      projectOwner,
+      projectRepo: projectRepoName,
+      flaggedAt: now,
+      ...draft
+    };
+    await writeCandidate(vaultOctokit, vaultRepo, candidate);
+    candidatesFlagged++;
+  }
+  return { candidatesFlagged };
+}
+
+// ../../modules/devcrypt/dist/bin/scanCryptingCandidatesCli.js
+function requireEnv(env, name) {
+  const value = env[name];
+  if (!value) {
+    throw new Error(`${name} is not set`);
+  }
+  return value;
+}
+var defaultDeps = {
+  env: process.env,
+  scanCryptingCandidates,
+  createGithubClient,
+  log: console.log
+};
+async function main(deps = defaultDeps) {
+  const { env } = deps;
+  const [projectOwner, projectRepoName] = requireEnv(env, "PROJECT_REPO").split("/");
+  const [vaultOwner, vaultRepo] = requireEnv(env, "VAULT_REPO").split("/");
+  const baseSha = requireEnv(env, "BASE_SHA");
+  const headSha = requireEnv(env, "HEAD_SHA");
+  const projectOctokit = deps.createGithubClient(requireEnv(env, "GITHUB_TOKEN"));
+  const vaultOctokit = deps.createGithubClient(requireEnv(env, "DEVKEEP_GITHUB_TOKEN"));
+  const blindIndexKey = Buffer.from(requireEnv(env, "DEVCRYPT_BLIND_INDEX_KEY"), "base64");
+  const result = await deps.scanCryptingCandidates({
+    projectOctokit,
+    vaultOctokit,
+    projectOwner,
+    projectRepoName,
+    vaultRepo: { owner: vaultOwner, repo: vaultRepo },
+    baseSha,
+    headSha,
+    blindIndexKey
+  });
+  deps.log(`Flagged ${result.candidatesFlagged} crypting candidate(s)`);
+}
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+  });
+}
+export {
+  main,
+  requireEnv
+};