@sun-asterisk/sunlint 1.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (192) hide show
  1. package/CHANGELOG.md +202 -0
  2. package/LICENSE +21 -0
  3. package/README.md +490 -0
  4. package/cli-legacy.js +355 -0
  5. package/cli.js +35 -0
  6. package/config/default.json +22 -0
  7. package/config/presets/beginner.json +36 -0
  8. package/config/presets/ci.json +46 -0
  9. package/config/presets/recommended.json +24 -0
  10. package/config/presets/strict.json +32 -0
  11. package/config/rules-registry.json +681 -0
  12. package/config/sunlint-schema.json +166 -0
  13. package/config/typescript/custom-rules-new.js +0 -0
  14. package/config/typescript/custom-rules.js +9 -0
  15. package/config/typescript/eslint.config.js +110 -0
  16. package/config/typescript/package-lock.json +1585 -0
  17. package/config/typescript/package.json +13 -0
  18. package/config/typescript/security-rules/index.js +90 -0
  19. package/config/typescript/security-rules/s005-no-origin-auth.js +95 -0
  20. package/config/typescript/security-rules/s006-activation-recovery-secret-not-plaintext.js +69 -0
  21. package/config/typescript/security-rules/s008-crypto-agility.js +62 -0
  22. package/config/typescript/security-rules/s009-no-insecure-crypto.js +103 -0
  23. package/config/typescript/security-rules/s010-no-insecure-random-in-sensitive-context.js +123 -0
  24. package/config/typescript/security-rules/s011-no-insecure-uuid.js +66 -0
  25. package/config/typescript/security-rules/s012-hardcode-secret.js +71 -0
  26. package/config/typescript/security-rules/s014-insecure-tls-version.js +50 -0
  27. package/config/typescript/security-rules/s015-insecure-tls-certificate.js +43 -0
  28. package/config/typescript/security-rules/s016-sensitive-query-parameter.js +59 -0
  29. package/config/typescript/security-rules/s017-no-sql-injection.js +193 -0
  30. package/config/typescript/security-rules/s018-positive-input-validation.js +56 -0
  31. package/config/typescript/security-rules/s019-no-raw-user-input-in-email.js +113 -0
  32. package/config/typescript/security-rules/s020-no-eval-dynamic-execution.js +89 -0
  33. package/config/typescript/security-rules/s022-output-encoding.js +78 -0
  34. package/config/typescript/security-rules/s023-no-json-injection.js +300 -0
  35. package/config/typescript/security-rules/s025-server-side-input-validation.js +217 -0
  36. package/config/typescript/security-rules/s026-json-schema-validation.js +68 -0
  37. package/config/typescript/security-rules/s027-no-hardcoded-secrets.js +80 -0
  38. package/config/typescript/security-rules/s029-require-csrf-protection.js +79 -0
  39. package/config/typescript/security-rules/s030-no-directory-browsing.js +78 -0
  40. package/config/typescript/security-rules/s033-require-samesite-cookie.js +80 -0
  41. package/config/typescript/security-rules/s034-require-host-cookie-prefix.js +77 -0
  42. package/config/typescript/security-rules/s035-cookie-specific-path.js +74 -0
  43. package/config/typescript/security-rules/s036-no-unsafe-file-include.js +68 -0
  44. package/config/typescript/security-rules/s037-require-anti-cache-headers.js +70 -0
  45. package/config/typescript/security-rules/s038-no-version-disclosure.js +74 -0
  46. package/config/typescript/security-rules/s039-no-session-token-in-url.js +63 -0
  47. package/config/typescript/security-rules/s041-require-session-invalidate-on-logout.js +211 -0
  48. package/config/typescript/security-rules/s042-require-periodic-reauthentication.js +294 -0
  49. package/config/typescript/security-rules/s043-terminate-sessions-on-password-change.js +254 -0
  50. package/config/typescript/security-rules/s044-require-full-session-for-sensitive-operations.js +292 -0
  51. package/config/typescript/security-rules/s045-anti-automation-controls.js +46 -0
  52. package/config/typescript/security-rules/s046-secure-notification-on-auth-change.js +44 -0
  53. package/config/typescript/security-rules/s048-password-credential-recovery.js +54 -0
  54. package/config/typescript/security-rules/s050-session-token-weak-hash.js +94 -0
  55. package/config/typescript/security-rules/s052-secure-random-authentication-code.js +66 -0
  56. package/config/typescript/security-rules/s054-verification-default-account.js +109 -0
  57. package/config/typescript/security-rules/s057-utc-logging.js +54 -0
  58. package/config/typescript/security-rules/s058-no-ssrf.js +73 -0
  59. package/config/typescript/test-s005-working.ts +22 -0
  60. package/config/typescript/tsconfig.json +29 -0
  61. package/core/ai-analyzer.js +169 -0
  62. package/core/analysis-orchestrator.js +705 -0
  63. package/core/cli-action-handler.js +230 -0
  64. package/core/cli-program.js +106 -0
  65. package/core/config-manager.js +396 -0
  66. package/core/config-merger.js +136 -0
  67. package/core/config-override-processor.js +74 -0
  68. package/core/config-preset-resolver.js +65 -0
  69. package/core/config-source-loader.js +152 -0
  70. package/core/config-validator.js +126 -0
  71. package/core/dependency-manager.js +105 -0
  72. package/core/eslint-engine-service.js +312 -0
  73. package/core/eslint-instance-manager.js +104 -0
  74. package/core/eslint-integration-service.js +363 -0
  75. package/core/git-utils.js +170 -0
  76. package/core/multi-rule-runner.js +239 -0
  77. package/core/output-service.js +250 -0
  78. package/core/report-generator.js +320 -0
  79. package/core/rule-mapping-service.js +309 -0
  80. package/core/rule-selection-service.js +121 -0
  81. package/core/sunlint-engine-service.js +23 -0
  82. package/core/typescript-analyzer.js +262 -0
  83. package/core/typescript-engine.js +313 -0
  84. package/docs/AI.md +163 -0
  85. package/docs/ARCHITECTURE.md +78 -0
  86. package/docs/CI-CD-GUIDE.md +315 -0
  87. package/docs/COMMAND-EXAMPLES.md +256 -0
  88. package/docs/DEBUG.md +86 -0
  89. package/docs/DISTRIBUTION.md +153 -0
  90. package/docs/ESLINT-INTEGRATION-STRATEGY.md +392 -0
  91. package/docs/ESLINT_INTEGRATION.md +238 -0
  92. package/docs/FOLDER_STRUCTURE.md +59 -0
  93. package/docs/HEURISTIC_VS_AI.md +113 -0
  94. package/docs/README.md +32 -0
  95. package/docs/RELEASE_GUIDE.md +230 -0
  96. package/docs/RULE-RESPONSIBILITY-MATRIX.md +204 -0
  97. package/eslint-integration/.eslintrc.js +98 -0
  98. package/eslint-integration/cli.js +35 -0
  99. package/eslint-integration/eslint-plugin-custom/c002-no-duplicate-code.js +204 -0
  100. package/eslint-integration/eslint-plugin-custom/c003-no-vague-abbreviations.js +246 -0
  101. package/eslint-integration/eslint-plugin-custom/c006-function-name-verb-noun.js +207 -0
  102. package/eslint-integration/eslint-plugin-custom/c010-limit-block-nesting.js +90 -0
  103. package/eslint-integration/eslint-plugin-custom/c013-no-dead-code.js +43 -0
  104. package/eslint-integration/eslint-plugin-custom/c014-abstract-dependency-preferred.js +38 -0
  105. package/eslint-integration/eslint-plugin-custom/c017-limit-constructor-logic.js +39 -0
  106. package/eslint-integration/eslint-plugin-custom/c018-no-generic-throw.js +335 -0
  107. package/eslint-integration/eslint-plugin-custom/c023-no-duplicate-variable-name-in-scope.js +142 -0
  108. package/eslint-integration/eslint-plugin-custom/c027-limit-function-nesting.js +50 -0
  109. package/eslint-integration/eslint-plugin-custom/c029-catch-block-logging.js +80 -0
  110. package/eslint-integration/eslint-plugin-custom/c030-use-custom-error-classes.js +294 -0
  111. package/eslint-integration/eslint-plugin-custom/c034-no-implicit-return.js +34 -0
  112. package/eslint-integration/eslint-plugin-custom/c035-no-empty-catch.js +32 -0
  113. package/eslint-integration/eslint-plugin-custom/c041-no-config-inline.js +64 -0
  114. package/eslint-integration/eslint-plugin-custom/c042-boolean-name-prefix.js +406 -0
  115. package/eslint-integration/eslint-plugin-custom/c043-no-console-or-print.js +300 -0
  116. package/eslint-integration/eslint-plugin-custom/c047-no-duplicate-retry-logic.js +239 -0
  117. package/eslint-integration/eslint-plugin-custom/c048-no-var-declaration.js +31 -0
  118. package/eslint-integration/eslint-plugin-custom/c076-one-assert-per-test.js +184 -0
  119. package/eslint-integration/eslint-plugin-custom/index.js +155 -0
  120. package/eslint-integration/eslint-plugin-custom/package.json +13 -0
  121. package/eslint-integration/eslint-plugin-custom/package.json.bak +9 -0
  122. package/eslint-integration/eslint-plugin-custom/s003-no-unvalidated-redirect.js +86 -0
  123. package/eslint-integration/eslint-plugin-custom/s005-no-origin-auth.js +95 -0
  124. package/eslint-integration/eslint-plugin-custom/s006-activation-recovery-secret-not-plaintext.js +69 -0
  125. package/eslint-integration/eslint-plugin-custom/s008-crypto-agility.js +62 -0
  126. package/eslint-integration/eslint-plugin-custom/s009-no-insecure-crypto.js +103 -0
  127. package/eslint-integration/eslint-plugin-custom/s010-no-insecure-random-in-sensitive-context.js +123 -0
  128. package/eslint-integration/eslint-plugin-custom/s011-no-insecure-uuid.js +66 -0
  129. package/eslint-integration/eslint-plugin-custom/s012-hardcode-secret.js +71 -0
  130. package/eslint-integration/eslint-plugin-custom/s014-insecure-tls-version.js +50 -0
  131. package/eslint-integration/eslint-plugin-custom/s015-insecure-tls-certificate.js +43 -0
  132. package/eslint-integration/eslint-plugin-custom/s016-sensitive-query-parameter.js +59 -0
  133. package/eslint-integration/eslint-plugin-custom/s017-no-sql-injection.js +193 -0
  134. package/eslint-integration/eslint-plugin-custom/s018-positive-input-validation.js +56 -0
  135. package/eslint-integration/eslint-plugin-custom/s019-no-raw-user-input-in-email.js +113 -0
  136. package/eslint-integration/eslint-plugin-custom/s020-no-eval-dynamic-execution.js +89 -0
  137. package/eslint-integration/eslint-plugin-custom/s022-output-encoding.js +78 -0
  138. package/eslint-integration/eslint-plugin-custom/s023-no-json-injection.js +300 -0
  139. package/eslint-integration/eslint-plugin-custom/s025-server-side-input-validation.js +217 -0
  140. package/eslint-integration/eslint-plugin-custom/s026-json-schema-validation.js +68 -0
  141. package/eslint-integration/eslint-plugin-custom/s027-no-hardcoded-secrets.js +80 -0
  142. package/eslint-integration/eslint-plugin-custom/s029-require-csrf-protection.js +79 -0
  143. package/eslint-integration/eslint-plugin-custom/s030-no-directory-browsing.js +78 -0
  144. package/eslint-integration/eslint-plugin-custom/s033-require-samesite-cookie.js +80 -0
  145. package/eslint-integration/eslint-plugin-custom/s034-require-host-cookie-prefix.js +77 -0
  146. package/eslint-integration/eslint-plugin-custom/s035-cookie-specific-path.js +74 -0
  147. package/eslint-integration/eslint-plugin-custom/s036-no-unsafe-file-include.js +68 -0
  148. package/eslint-integration/eslint-plugin-custom/s037-require-anti-cache-headers.js +70 -0
  149. package/eslint-integration/eslint-plugin-custom/s038-no-version-disclosure.js +74 -0
  150. package/eslint-integration/eslint-plugin-custom/s039-no-session-token-in-url.js +63 -0
  151. package/eslint-integration/eslint-plugin-custom/s041-require-session-invalidate-on-logout.js +211 -0
  152. package/eslint-integration/eslint-plugin-custom/s042-require-periodic-reauthentication.js +294 -0
  153. package/eslint-integration/eslint-plugin-custom/s043-terminate-sessions-on-password-change.js +254 -0
  154. package/eslint-integration/eslint-plugin-custom/s044-require-full-session-for-sensitive-operations.js +292 -0
  155. package/eslint-integration/eslint-plugin-custom/s045-anti-automation-controls.js +46 -0
  156. package/eslint-integration/eslint-plugin-custom/s046-secure-notification-on-auth-change.js +44 -0
  157. package/eslint-integration/eslint-plugin-custom/s047-secure-random-passwords.js +108 -0
  158. package/eslint-integration/eslint-plugin-custom/s048-password-credential-recovery.js +54 -0
  159. package/eslint-integration/eslint-plugin-custom/s050-session-token-weak-hash.js +94 -0
  160. package/eslint-integration/eslint-plugin-custom/s052-secure-random-authentication-code.js +66 -0
  161. package/eslint-integration/eslint-plugin-custom/s054-verification-default-account.js +109 -0
  162. package/eslint-integration/eslint-plugin-custom/s055-verification-rest-check-the-incoming-content-type.js +143 -0
  163. package/eslint-integration/eslint-plugin-custom/s057-utc-logging.js +54 -0
  164. package/eslint-integration/eslint-plugin-custom/s058-no-ssrf.js +73 -0
  165. package/eslint-integration/eslint-plugin-custom/t002-interface-prefix-i.js +42 -0
  166. package/eslint-integration/eslint-plugin-custom/t003-ts-ignore-reason.js +48 -0
  167. package/eslint-integration/eslint-plugin-custom/t004-interface-public-only.js +160 -0
  168. package/eslint-integration/eslint-plugin-custom/t007-no-fn-in-constructor.js +52 -0
  169. package/eslint-integration/eslint-plugin-custom/t011-no-real-time-dependency.js +175 -0
  170. package/eslint-integration/eslint-plugin-custom/t019-no-empty-type.js +95 -0
  171. package/eslint-integration/eslint-plugin-custom/t025-no-nested-union-tuple.js +48 -0
  172. package/eslint-integration/eslint-plugin-custom/t026-limit-nested-generics.js +377 -0
  173. package/eslint-integration/eslint.config.js +125 -0
  174. package/eslint-integration/eslint.config.simple.js +24 -0
  175. package/eslint-integration/node_modules/eslint-plugin-custom/package.json +0 -0
  176. package/eslint-integration/package.json +23 -0
  177. package/eslint-integration/sample.ts +53 -0
  178. package/eslint-integration/test-s003.js +5 -0
  179. package/eslint-integration/tsconfig.json +27 -0
  180. package/examples/.github/workflows/code-quality.yml +111 -0
  181. package/examples/.sunlint.json +42 -0
  182. package/examples/README.md +47 -0
  183. package/examples/package.json +33 -0
  184. package/package.json +100 -0
  185. package/rules/C006_function_naming/analyzer.js +338 -0
  186. package/rules/C006_function_naming/config.json +86 -0
  187. package/rules/C019_log_level_usage/analyzer.js +359 -0
  188. package/rules/C019_log_level_usage/config.json +121 -0
  189. package/rules/C029_catch_block_logging/analyzer.js +339 -0
  190. package/rules/C029_catch_block_logging/config.json +59 -0
  191. package/rules/C031_validation_separation/README.md +72 -0
  192. package/rules/C031_validation_separation/analyzer.js +186 -0
package/CHANGELOG.md ADDED
@@ -0,0 +1,202 @@
1
+ # Changelog
2
+
3
+ All notable changes to Sun Lint will be documented in this file.
4
+
5
+ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6
+ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
+
8
+ ## [1.0.4] - 2025-07-08
9
+
10
+ ### 🔒 **Security Rules Integration**
11
+
12
+ #### Added
13
+ - **40 Security Rules** - Complete integration of TypeScript security rules (S005-S058)
14
+ - **Security Category Support** - New `--security` CLI option to run security rules only
15
+ - **Quality Category Support** - New `--quality` CLI option to run quality rules only
16
+ - **Dynamic Rule Configuration** - ESLint rules enabled/disabled based on user selection
17
+ - **Enhanced ESLint Integration** - TypeScript parser support and improved plugin loading
18
+
19
+ #### **Security Rules Implemented**
20
+ - **S005**: No Origin Header Authentication
21
+ - **S006**: Activation Recovery Secret Not Plaintext
22
+ - **S008**: Crypto Agility
23
+ - **S009**: No Insecure Crypto
24
+ - **S010**: No Insecure Random in Sensitive Context
25
+ - **S011**: No Insecure UUID
26
+ - **S012**: No Hardcoded Secrets
27
+ - **S014-S058**: 35 additional security rules (TLS, validation, session, auth, etc.)
28
+
29
+ *Complete list of all 43 security rules available in rules registry*
30
+
31
+ #### **CLI Enhancements**
32
+ ```bash
33
+ # Run security rules only
34
+ sunlint --security --typescript --input=src/
35
+
36
+ # Run quality rules only
37
+ sunlint --quality --typescript --input=src/
38
+
39
+ # Run all rules (quality + security + typescript)
40
+ sunlint --all --typescript --input=src/
41
+ ```
42
+
43
+ #### **Architecture Improvements**
44
+ - Enhanced rule registry with security rule metadata
45
+ - Improved category-based rule filtering
46
+ - Dynamic ESLint configuration based on selected rules
47
+ - Better TypeScript parsing support in ESLint integration
48
+ - Modular plugin architecture for custom security rules
49
+
50
+ ### Fixed
51
+ - ESLint TypeScript parser configuration
52
+ - Plugin resolution for custom security rules
53
+ - Rule mapping between SunLint and ESLint formats
54
+
55
+ ### Changed
56
+ - Updated rules registry structure to support security categories
57
+ - Enhanced CLI with category-specific options
58
+ - Improved rule configuration system
59
+
60
+ ---
61
+
62
+ ## [1.0.0] - 2024-01-XX (Previous Release)
63
+
64
+ ### 🎉 **Initial Release**
65
+
66
+ #### Added
67
+ - **☀️ Sun Lint CLI** - Universal coding standards checker
68
+ - **Multi-rule support** - Run single, multiple, or all rules
69
+ - **Quality & Security categories** - Separate analysis domains
70
+ - **Multi-language support** - TypeScript, Dart, Kotlin
71
+ - **Configuration system** - `.sunlint.json` with presets
72
+ - **Multiple output formats** - ESLint, Summary, Detailed, GitHub
73
+
74
+ #### **Quality Rules Implemented**
75
+ - **C005** - Single Responsibility Principle
76
+ - **C006** - Function Naming (verb/verb-noun)
77
+ - **C007** - Comment Quality (avoid code description)
78
+ - **C012** - Command Query Separation (CQS)
79
+ - **C014** - Dependency Injection usage
80
+ - **C015** - Domain Language usage
81
+ - **C019** - Log Level Usage (stable from previous version)
82
+ - **C031** - Validation Separation
83
+ - **C037** - API Response Format
84
+ - **C040** - Centralized Validation Logic
85
+
86
+ #### **Security Rules Planned**
87
+ - **S001** - SQL Injection Prevention
88
+ - **S002** - XSS Prevention
89
+ - **S003** - Authentication Checks
90
+ - **S004** - Data Encryption
91
+
92
+ #### **CLI Features**
93
+ - `sunlint --quality` - Run all quality rules
94
+ - `sunlint --security` - Run all security rules
95
+ - `sunlint --all` - Run all available rules
96
+ - `sunlint --rule=C019` - Run specific rule
97
+ - `sunlint --rules=C019,C006` - Run multiple rules
98
+ - `sunlint --config=.sunlint.json` - Use configuration file
99
+ - `sunlint --preset=@sun/sunlint/recommended` - Use preset
100
+
101
+ #### **Configuration**
102
+ - **Preset configurations** - recommended, strict, security, quality
103
+ - **Rule-specific settings** - error, warn, off severity levels
104
+ - **Language targeting** - Filter by programming language
105
+ - **Ignore patterns** - Exclude files/directories
106
+ - **Custom rule paths** - Extend with custom rules
107
+
108
+ #### **Output Formats**
109
+ - **ESLint format** - Compatible with IDEs and CI/CD
110
+ - **Summary format** - Human-readable overview
111
+ - **Detailed format** - Complete analysis results
112
+ - **GitHub format** - GitHub Actions integration
113
+
114
+ #### **Development Features**
115
+ - **Extensible architecture** - Easy to add new rules
116
+ - **Test framework** - Unit and integration tests
117
+ - **VS Code integration** - Problems panel support
118
+ - **CI/CD ready** - GitHub Actions and GitLab CI examples
119
+
120
+ #### **Documentation**
121
+ - **Comprehensive README** - Installation and usage guide
122
+ - **Contributing guide** - Development workflow and standards
123
+ - **Rule documentation** - Detailed rule explanations
124
+ - **Configuration examples** - Real-world configurations
125
+
126
+ ### 🏗 **Architecture**
127
+ - **Modular design** - Separate core, rules, and config
128
+ - **Plugin system** - Extensible rule loading
129
+ - **Multi-format output** - Flexible reporting
130
+ - **Configuration inheritance** - Preset and custom configs
131
+
132
+ ### 🚀 **Performance**
133
+ - **Fast analysis** - Optimized rule execution
134
+ - **Incremental scanning** - Only analyze changed files
135
+ - **Parallel processing** - Multi-rule concurrent execution
136
+ - **Memory efficient** - Minimal resource usage
137
+
138
+ ### 📦 **Distribution**
139
+ - **NPM package** - `@sun/sunlint`
140
+ - **Global installation** - `npm install -g @sun/sunlint`
141
+ - **Local project use** - Development dependency support
142
+ - **VS Code extension** - Future integration planned
143
+
144
+ ---
145
+
146
+ ## **Migration from coding-standards**
147
+
148
+ Sun Lint is the evolution of the previous `coding-standards` tool with enhanced features:
149
+
150
+ ### **What Changed**
151
+ - **Name**: `coding-standards` → `sunlint`
152
+ - **Command**: `coding-standards` → `sunlint`
153
+ - **Config**: `.coding-standards.json` → `.sunlint.json`
154
+ - **Package**: `@coding-quality/standards` → `@sun/sunlint`
155
+
156
+ ### **Migration Guide**
157
+ ```bash
158
+ # Uninstall old tool
159
+ npm uninstall -g @coding-quality/standards
160
+
161
+ # Install Sun Lint
162
+ npm install -g @sun/sunlint
163
+
164
+ # Update configuration file
165
+ mv .coding-standards.json .sunlint.json
166
+
167
+ # Update config contents
168
+ sed -i 's/coding-standards/sunlint/g' .sunlint.json
169
+
170
+ # Update scripts in package.json
171
+ sed -i 's/coding-standards/sunlint/g' package.json
172
+ ```
173
+
174
+ ### **What's Compatible**
175
+ - ✅ All existing rules (C005, C006, C007, etc.)
176
+ - ✅ Rule configurations and severity levels
177
+ - ✅ Output formats (eslint, summary, detailed)
178
+ - ✅ Command-line arguments and options
179
+ - ✅ Language support (TypeScript, Dart, Kotlin)
180
+
181
+ ### **What's New**
182
+ - ☀️ **Sun* branding** and unified tooling
183
+ - 🔒 **Security rule category** with planned security rules
184
+ - 🎯 **Quality/Security separation** with `--quality` and `--security` flags
185
+ - 📦 **Preset configurations** for common use cases
186
+ - 🔧 **Enhanced configuration** with extends and inheritance
187
+ - 📊 **GitHub Actions format** for better CI/CD integration
188
+
189
+ ---
190
+
191
+ **Release Notes Format:**
192
+ - 🎉 Major features
193
+ - ✨ Enhancements
194
+ - 🐛 Bug fixes
195
+ - 🔒 Security updates
196
+ - 📚 Documentation
197
+ - 🏗 Architecture changes
198
+ - 🚀 Performance improvements
199
+
200
+ ---
201
+
202
+ **Built with ☀️ by Sun* Engineering Team**
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2024 Sun* Engineering Team
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md ADDED
@@ -0,0 +1,490 @@
1
+ # ☀️ Sun Lint - Universal Coding Standards
2
+
3
+ **Multi-rule, Multi-language Code Quality & Security Analysis Tool with ESLint Integration**
4
+
5
+ ## 🎯 **Overview**
6
+
7
+ Sun Lint is a universal coding standards checker that provides comprehensive code quality and security analysis. Built by Sun* Engineering Team with integrated security rules from OWASP and industry best practices.
8
+
9
+ ### **✨ Key Features**
10
+ - ✅ **93+ Coding Rules**: Quality, security, and best practices
11
+ - ✅ **ESLint Integration**: Merge with existing ESLint configurations
12
+ - ✅ **Git Integration**: `--changed-files`, `--staged-files`, `--pr-mode`
13
+ - ✅ **TypeScript Support**: Native TypeScript analysis engine
14
+ - ✅ **CI/CD Ready**: Baseline comparison, fail-on-new-violations
15
+ - ✅ **Multiple Formats**: ESLint, JSON, Summary, Table output
16
+ - ✅ **Team Adoption**: Zero-disruption integration for existing workflows
17
+
18
+ ### **🚀 Quick Start**
19
+ - ✅ **Run single rule**: `sunlint --rule=C019`
20
+ - ✅ **Run multiple rules**: `sunlint --rules=C019,C006,C021`
21
+ - ✅ **Run all rules**: `sunlint --all` (93 rules total)
22
+ - ✅ **Run by category**: `sunlint --quality` or `sunlint --security`
23
+ - ✅ **ESLint integration**: `sunlint --all --eslint-integration`
24
+ - ✅ **Git workflow**: `sunlint --all --changed-files`
25
+
26
+ ## 📦 **Installation**
27
+
28
+ ### **Method 1: Global Installation (Recommended)**
29
+ ```bash
30
+ # Install globally for command-line usage - Universal for all languages
31
+ npm install -g @sun-asterisk/sunlint
32
+
33
+ # Verify installation
34
+ sunlint --version
35
+ ```
36
+
37
+ *✨ **Why Global?** SunLint supports multiple languages (TypeScript, Dart, Kotlin, Java, Swift, etc.). Global installation provides universal access across all project types.*
38
+
39
+ ### **Method 2: TypeScript Project Integration**
40
+ For TypeScript-specific projects that prefer project-level dependencies:
41
+ ```bash
42
+ # Add to TypeScript project dependencies
43
+ npm install --save-dev @sun-asterisk/sunlint
44
+
45
+ # Or using yarn
46
+ yarn add --dev @sun-asterisk/sunlint
47
+ ```
48
+
49
+ **Package.json scripts for TypeScript projects:**
50
+ ```json
51
+ {
52
+ "scripts": {
53
+ "lint": "sunlint --typescript --input=src",
54
+ "lint:changed": "sunlint --typescript --changed-files",
55
+ "lint:eslint-integration": "sunlint --typescript --eslint-integration --input=src"
56
+ },
57
+ "devDependencies": {
58
+ "@sun-asterisk/sunlint": "^1.0.5"
59
+ }
60
+ }
61
+ ```
62
+
63
+ ### **🌍 Multi-Language Strategy**
64
+ **Future Roadmap**: SunLint will expand to support:
65
+ - ✅ **TypeScript** (Phase 1 - Current)
66
+ - 🔄 **Dart** (Phase 2 - Planned)
67
+ - 🔄 **Kotlin** (Phase 3 - Planned)
68
+ - 🔄 **Java** (Phase 4 - Planned)
69
+ - 🔄 **Swift** (Phase 5 - Planned)
70
+
71
+ **Global installation ensures**:
72
+ - ✅ **Cross-project compatibility**: One tool for all languages
73
+ - ✅ **Team standardization**: Consistent tool across different project types
74
+ - ✅ **CI/CD simplicity**: Single installation for polyglot repositories
75
+
76
+ ### **Method 3: GitHub Package Registry (Private)**
77
+ ```bash
78
+ # 1. Setup GitHub Package Registry (one-time)
79
+ curl -fsSL https://raw.githubusercontent.com/sun-asterisk/engineer-excellence/main/coding-quality/extensions/sunlint/scripts/setup-github-registry.sh | GITHUB_TOKEN=your_token bash
80
+
81
+ # 2. Install SunLint globally
82
+ npm install -g @sun-asterisk/sunlint
83
+
84
+ # 3. Verify installation
85
+ sunlint --version
86
+ ```
87
+
88
+ **Manual setup**:
89
+ ```bash
90
+ # Configure GitHub Package Registry
91
+ echo "@sun-asterisk:registry=https://npm.pkg.github.com" >> ~/.npmrc
92
+ echo "//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}" >> ~/.npmrc
93
+
94
+ # Install from GitHub Packages globally
95
+ npm install -g @sun-asterisk/sunlint
96
+ ```
97
+
98
+ ### **Method 4: Direct GitHub Release**
99
+ ```bash
100
+ # Install from GitHub release tarball globally
101
+ npm install -g https://github.com/sun-asterisk/engineer-excellence/releases/download/sunlint-v1.0.5/sunlint-1.0.5.tgz
102
+
103
+ # Verify installation
104
+ sunlint --version
105
+ ```
106
+
107
+ ### **Method 5: Development Setup**
108
+ ```bash
109
+ # Clone and install for development
110
+ git clone https://github.com/sun-asterisk/engineer-excellence.git
111
+ cd engineer-excellence/coding-quality/extensions/sunlint
112
+ npm install
113
+ npm install -g .
114
+ ```
115
+
116
+ ## 🔗 **ESLint Integration** *(New in v1.0.5)*
117
+
118
+ SunLint can seamlessly integrate with existing ESLint configurations, combining both rule sets in a single execution.
119
+
120
+ ### **For Teams with Existing ESLint**
121
+ ```bash
122
+ # Analyze with both SunLint + existing ESLint rules
123
+ sunlint --all --eslint-integration --input=src
124
+
125
+ # Works with git integration too
126
+ sunlint --all --eslint-integration --changed-files
127
+ ```
128
+
129
+ ### **Configuration**
130
+ ```json
131
+ {
132
+ "sunlint": {
133
+ "eslintIntegration": {
134
+ "enabled": true,
135
+ "mergeRules": true,
136
+ "preserveUserConfig": true
137
+ },
138
+ "rules": {
139
+ "C006": "warn",
140
+ "C019": "error"
141
+ }
142
+ }
143
+ }
144
+ ```
145
+
146
+ ### **Benefits**
147
+ - ✅ **No workflow disruption**: Existing ESLint continues working
148
+ - ✅ **Single command**: Execute 93 SunLint + your existing ESLint rules
149
+ - ✅ **Conflict resolution**: Your ESLint rules take precedence
150
+ - ✅ **Combined reporting**: Unified violation tracking
151
+
152
+ **Example**: Team with 20 existing ESLint rules + 93 SunLint rules = **113 total rules** in single execution!
153
+
154
+ [📖 **Read Full ESLint Integration Guide**](./docs/ESLINT_INTEGRATION.md)
155
+
156
+ ## 🔀 **Git Integration** *(New in v1.0.5)*
157
+
158
+ SunLint provides powerful Git integration for optimized CI/CD workflows and development processes.
159
+
160
+ ### **Basic Git Commands**
161
+ ```bash
162
+ # Analyze only changed files (vs main branch)
163
+ sunlint --all --changed-files
164
+
165
+ # Analyze only staged files (pre-commit)
166
+ sunlint --all --staged-files
167
+
168
+ # PR mode with custom base branch
169
+ sunlint --all --changed-files --diff-base=origin/develop
170
+
171
+ # Files changed since specific commit
172
+ sunlint --all --since=abc123
173
+
174
+ # PR mode with failure only on new violations
175
+ sunlint --all --pr-mode --fail-on-new-violations
176
+ ```
177
+
178
+ ### **CI/CD Integration Examples**
179
+ ```bash
180
+ # GitHub Actions - PR check
181
+ sunlint --all --changed-files --diff-base=origin/main --format=summary
182
+
183
+ # Pre-commit hook
184
+ sunlint --all --staged-files --format=summary --no-ai
185
+
186
+ # Release validation
187
+ sunlint --all --since=last-release --format=json --output=quality-report.json
188
+ ```
189
+
190
+ ### **Combined Git + ESLint Integration**
191
+ ```bash
192
+ # Ultimate integration: Git + ESLint + SunLint
193
+ sunlint --all --eslint-integration --changed-files --fail-on-new-violations
194
+ ```
195
+
196
+ **Benefits**:
197
+ - ✅ **Performance**: Only analyze relevant files
198
+ - ✅ **PR-focused**: Catch issues in changed code
199
+ - ✅ **Incremental**: Fail only on new violations
200
+ - ✅ **Flexible**: Support multiple Git workflows
201
+
202
+ ## 🎯 **Usage Examples**
203
+ ```bash
204
+ # Install for specific project
205
+ npm install https://github.com/sun-asterisk/engineer-excellence/releases/download/sunlint-v1.0.0/sun-sunlint-1.0.0.tgz
206
+
207
+ # Use with npx
208
+ npx sunlint --quality --input=src
209
+ ```
210
+
211
+ ### **Verify Installation**
212
+ ```bash
213
+ sunlint --version
214
+ # Should output: 1.0.0
215
+
216
+ sunlint --help
217
+ # Shows full command options
218
+ ```
219
+
220
+ ## � **TypeScript Support** *(New in v1.0.5)*
221
+
222
+ SunLint provides native TypeScript analysis with dedicated engine and enhanced rule support.
223
+
224
+ ### **TypeScript-specific Commands**
225
+ ```bash
226
+ # Force TypeScript engine for all rules
227
+ sunlint --typescript --input=src
228
+
229
+ # TypeScript with specific rules
230
+ sunlint --typescript --rules=C006,C019,S047 --input=src
231
+
232
+ # TypeScript + ESLint integration
233
+ sunlint --typescript --eslint-integration --input=src
234
+
235
+ # TypeScript + Git integration
236
+ sunlint --typescript --changed-files --format=summary
237
+ ```
238
+
239
+ ### **Project Integration for TypeScript**
240
+ *Optional: If you prefer project-level dependencies*
241
+ ```json
242
+ {
243
+ "scripts": {
244
+ "lint:ts": "sunlint --typescript --input=src",
245
+ "lint:ts-changed": "sunlint --typescript --changed-files",
246
+ "lint:ts-eslint": "sunlint --typescript --eslint-integration --input=src"
247
+ },
248
+ "devDependencies": {
249
+ "@sun-asterisk/sunlint": "^1.0.5",
250
+ "@typescript-eslint/eslint-plugin": "^6.0.0",
251
+ "@typescript-eslint/parser": "^6.0.0"
252
+ }
253
+ }
254
+ ```
255
+
256
+ *Note: SunLint works equally well with global installation. Project-level dependencies are optional for TypeScript projects.*
257
+
258
+ ### **Features**
259
+ - ✅ **Native AST Analysis**: TypeScript parser integration
260
+ - ✅ **ESLint Bridge**: Seamless integration with existing ESLint rules
261
+ - ✅ **Type Checking**: Leverage TypeScript compiler for advanced analysis
262
+ - ✅ **Performance**: Optimized for TypeScript codebases
263
+
264
+ ## �📋 **Available Rules**
265
+
266
+ ### **Quality Rules** ✨
267
+ | Rule ID | Name | Category | Languages | Status |
268
+ |---------|------|----------|-----------|--------|
269
+ | **C005** | Single Responsibility | quality | TS, Dart, Kotlin | ✅ Stable |
270
+ | **C006** | Function Naming | quality | TS, Dart, Kotlin | ✅ Stable |
271
+ | **C007** | Comment Quality | quality | TS, Dart, Kotlin | ✅ Stable |
272
+ | **C012** | Command Query Separation | quality | TS, Dart, Kotlin | ✅ Stable |
273
+ | **C014** | Dependency Injection | quality | TS, Dart, Kotlin | ✅ Stable |
274
+ | **C015** | Domain Language | quality | TS, Dart, Kotlin | ✅ Stable |
275
+ | **C019** | Log Level Usage | quality | TS, Dart, Kotlin | ✅ Stable |
276
+ | **C031** | Validation Separation | quality | TS, Dart, Kotlin | ✅ Stable |
277
+ | **C037** | API Response Format | quality | TS, Dart, Kotlin | ✅ Stable |
278
+
279
+ ### **Security Rules** 🔒 *(New in v1.0.4)*
280
+ | Rule ID | Name | Category | Languages | Status |
281
+ |---------|------|----------|-----------|--------|
282
+ | **S005** | No Origin Header Authentication | security | TS, JS | ✅ Stable |
283
+ | **S006** | Activation Recovery Secret Not Plaintext | security | TS, JS | ✅ Stable |
284
+ | **S008** | Crypto Agility | security | TS, JS | ✅ Stable |
285
+ ### **Security Rules** 🔒 *(43 rules total)*
286
+ | Rule ID | Name | Category | Languages | Status |
287
+ |---------|------|----------|-----------|--------|
288
+ | **S005** | No Origin Header Authentication | security | TS, JS | ✅ Stable |
289
+ | **S008** | Crypto Agility | security | TS, JS | ✅ Stable |
290
+ | **S012** | No Hardcoded Secrets | security | TS, JS | ✅ Stable |
291
+ | **S014-S058** | *...40 additional security rules* | security | TS, JS | ✅ Stable |
292
+
293
+ *Complete list available in CHANGELOG.md*
294
+
295
+ ## 🎮 **Usage Examples**
296
+
297
+ ### **Basic Usage**
298
+ ```bash
299
+ # Run all rules (93 total: quality + security)
300
+ sunlint --all --typescript --input=src/
301
+
302
+ # Check specific category
303
+ sunlint --security --typescript --input=src/
304
+ sunlint --quality --typescript --input=src/
305
+
306
+ # Check specific rules
307
+ sunlint --rules=C019,S005 --typescript --input=src/
308
+ ```
309
+
310
+ ### **Complete Analysis** 🎯
311
+ ```bash
312
+ # Run all rules (quality + security = 44 rules)
313
+ sunlint --all --typescript --input=src/
314
+
315
+ # Local development scan
316
+ sunlint --typescript --input=. --format=summary
317
+
318
+ # Check single file
319
+ sunlint --all --typescript --input=components/Button.tsx
320
+ ```
321
+
322
+ ### **CI/CD Integration** 🚀
323
+ ```bash
324
+ # Full project scan (main branch)
325
+ sunlint --all --input=. --format=json --output=sunlint-report.json
326
+
327
+ # Changed files only (PR checks)
328
+ sunlint --all --changed-files --format=summary
329
+
330
+ # With ESLint integration
331
+ sunlint --all --eslint-integration --changed-files
332
+ ```
333
+
334
+ ## ⚙️ **Configuration**
335
+
336
+ Create `.sunlint.json` in your project root:
337
+
338
+ ```json
339
+ {
340
+ "extends": "@sun/sunlint/recommended",
341
+ "rules": {
342
+ "C019": "error",
343
+ "C006": "warn",
344
+ "S005": "error"
345
+ },
346
+ "categories": ["quality", "security"],
347
+ "ignorePatterns": ["node_modules/**", "dist/**"]
348
+ }
349
+ ```
350
+ - `@sun/sunlint/security` - Security-focused rules only
351
+ - `@sun/sunlint/quality` - Quality-focused rules only
352
+
353
+ ## 📊 **Output Formats**
354
+
355
+ ```bash
356
+ # ESLint-compatible JSON
357
+ sunlint --format=eslint --input=src
358
+
359
+ # Human-readable summary
360
+ sunlint --format=summary --input=src
361
+
362
+ # Detailed report
363
+ sunlint --format=detailed --input=src
364
+
365
+ # GitHub Actions format
366
+ sunlint --format=github --input=src
367
+ ```
368
+
369
+ ## 🚀 **CI/CD Strategy & Best Practices**
370
+
371
+ ### **Vấn đề về Performance và Cost**
372
+
373
+ | Approach | Ưu điểm | Nhược điểm | Khi nào sử dụng |
374
+ |----------|---------|------------|-----------------|
375
+ | **Full Scan** | Phát hiện hết tất cả issues, consistent | Chậm, tốn resource, nhiều noise | Main branch, weekly reports |
376
+ | **Changed Files Only** | Nhanh, relevant, cost-effective | Miss issues từ dependency changes | PR checks, pre-commit |
377
+ | **Baseline Comparison** | Balance giữa performance và coverage | Setup phức tạp hơn | Large projects |
378
+
379
+ ### **Recommended CI/CD Strategy**
380
+
381
+ ## 📊 **Output Formats**
382
+
383
+ ```bash
384
+ # ESLint-compatible JSON
385
+ sunlint --format=eslint --input=src
386
+
387
+ # Human-readable summary
388
+ sunlint --format=summary --input=src
389
+
390
+ # GitHub Actions format
391
+ sunlint --format=github --input=src
392
+ ```
393
+
394
+ ## 🚀 **CI/CD Best Practices**
395
+
396
+ ### **Recommended Strategy**
397
+ ```bash
398
+ # PR: Check changed files only (fast)
399
+ sunlint --all --changed-files --diff-base=origin/main
400
+
401
+ # Main branch: Full scan + baseline
402
+ sunlint --all --input=. --save-baseline=baseline.json
403
+ ```
404
+
405
+ **Performance**: Changed files (~10-30s) vs Full scan (~2-5min)
406
+
407
+ ## 🛠 **CI/CD Integration**
408
+
409
+ **GitHub Actions (PR Mode):**
410
+ ```yaml
411
+ name: Code Quality Check
412
+ on:
413
+ pull_request:
414
+ branches: [main, develop]
415
+
416
+ jobs:
417
+ sunlint:
418
+ runs-on: ubuntu-latest
419
+ steps:
420
+ - uses: actions/checkout@v3
421
+ with:
422
+ fetch-depth: 0 # Fetch full history for diff comparison
423
+
424
+ - name: Setup Node.js
425
+ uses: actions/setup-node@v3
426
+ with:
427
+ node-version: '18'
428
+
429
+ - name: Install SunLint
430
+ **GitHub Actions Example:**
431
+ ```yaml
432
+ name: Code Quality Check
433
+ on:
434
+ pull_request:
435
+ branches: [main]
436
+
437
+ jobs:
438
+ sunlint:
439
+ runs-on: ubuntu-latest
440
+ steps:
441
+ - uses: actions/checkout@v3
442
+ with:
443
+ fetch-depth: 0
444
+
445
+ - name: Setup Node.js
446
+ uses: actions/setup-node@v3
447
+ with:
448
+ node-version: '18'
449
+
450
+ - name: Install SunLint
451
+ run: npm install -g @sun-asterisk/sunlint
452
+
453
+ - name: Run SunLint on Changed Files
454
+ run: |
455
+ sunlint --all --changed-files --diff-base=origin/main \
456
+ --format=github --fail-on-new-violations
457
+ ```
458
+ with:
459
+ name: sunlint-baseline
460
+ path: sunlint-baseline.json
461
+ ```
462
+
463
+ **GitLab CI (PR Mode):**
464
+ ```yaml
465
+ sunlint:pr:
466
+ stage: code-quality
467
+ rules:
468
+ - if: $CI_PIPELINE_SOURCE == "merge_request_event"
469
+ script:
470
+ ```
471
+
472
+ ## 📚 **Documentation**
473
+
474
+ - **[Full Documentation](docs/)** - Complete guide and advanced features
475
+ - **[AI Analysis Guide](docs/AI.md)** - AI-powered analysis setup
476
+ - **[Debug Guide](docs/DEBUG.md)** - Debugging rules and CLI
477
+
478
+ ## 📜 **License**
479
+
480
+ MIT License - see [LICENSE](./LICENSE) for details.
481
+
482
+ ## 🔗 **Links**
483
+
484
+ - **Documentation**: [Sun Lint Docs](https://sunlint.docs.sun.com)
485
+ - **Issues**: [GitHub Issues](https://github.com/sun-engineering/sunlint/issues)
486
+ - **Changelog**: [CHANGELOG.md](./CHANGELOG.md)
487
+
488
+ ---
489
+
490
+ **Built with ☀️ by Sun* Engineering Team**