@svp-labs/talos 0.0.0 → 0.1.0

package/dist/checks/security/osv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv.js","sourceRoot":"","sources":["../../../src/checks/security/osv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIlD,MAAM,aAAa,GAAG,CAAC,CAAC,WAAW,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/B,iBAAiB,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjF,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC,CAAC,WAAW,CAAC;QACZ,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvD,MAAM,EAAE,CAAC;aACN,KAAK,CACJ,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CACpF;aACA,OAAO,CAAC,EAAE,CAAC;KACf,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KAClC,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3B,OAAO,EAAE,CAAC;SACP,KAAK,CACJ,CAAC,CAAC,WAAW,CAAC;QACZ,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACvC,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAqBH,iGAAiG;AACjG,SAAS,OAAO,CAAC,KAA4B;IAC3C,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AACzE,CAAC;AAED,mFAAmF;AACnF,SAAS,MAAM,CAAC,KAA4B,EAAE,OAAiD;IAC7F,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,EAAE,QAAQ,CAAC;QACjD,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,UAAU,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpD,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,KAA4B,EAAE,GAAY;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;SAC3D,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;SACjE,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE;QACrE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,kCAAkC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,kDAAkD,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,QAAQ;YACR,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;YACtB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;YAC5B,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;YAChC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7D,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;SAC1C,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAKD,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAmB,EAAE,QAAkB;IACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GACP,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,YAAY,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACjG,OAAO;QACL,IAAI,EAAE,OAAO,QAAQ,CAAC,EAAE,EAAE;QAC1B,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE;QAChD,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,OAAO,GAAG,CAAC,QAAQ,mBAAmB,QAAQ,CAAC,EAAE,GAAG,KAAK,KAAK,GAAG,GAAG;QACvG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAmB,EAAE,OAAe;IAC1D,OAAO;QACL,IAAI,EAAE,WAAW,OAAO,EAAE;QAC1B,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,EAAE;QAC5C,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,OAAO,GAAG,CAAC,QAAQ,gBAAgB,OAAO,qEAAqE;KACnJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAmB,EACnB,MAA0B,EAC1B,OAA0B;IAE1B,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;QAC3F,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/C,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAC/D,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAmC,EACnC,MAAoB,EACpB,OAA0B;IAE1B,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,CAAC;QAC/C,OAAO;YACL,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACxE,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC;SACzC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/checks/security/secrets.js

@@ -0,0 +1,35 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { GITLEAKS_PROJECT, readGitleaksProject, scanConfig, } from './gitleaks-config.js';
+import { defaultRuleIds, scanHistory } from './gitleaks.js';
+import { APPLIES } from '../../core/check.js';
+/** The project's gitleaks file, read, or nothing when the repository has none. */
+export async function gitleaksProject(ctx) {
+    if (!ctx.facts.files.includes(GITLEAKS_PROJECT))
+        return undefined;
+    const text = await readFile(join(ctx.root, GITLEAKS_PROJECT), 'utf8');
+    return readGitleaksProject(text);
+}
+/**
+ * gitleaks over the whole history reachable from the checked-out commit, with its default
+ * rules and the project's own. The gate composes the configuration itself, so nothing in the
+ * project's file can switch a default rule off; the config-strength check reports what tried.
+ */
+export function secretsCheck() {
+    return {
+        id: 'security/secrets',
+        tier: 'head',
+        scope: 'repo',
+        title: 'gitleaks: no secret anywhere in the git history',
+        applies: () => APPLIES,
+        run: async (ctx) => {
+            const tool = await ctx.tools.path('gitleaks');
+            const rules = (await gitleaksProject(ctx))?.rules ?? [];
+            const redefined = await defaultRuleIds(ctx, tool, rules.map((rule) => rule.id));
+            const config = join(ctx.scratch, 'gitleaks.toml');
+            await writeFile(config, scanConfig(rules.filter((rule) => !redefined.has(rule.id))));
+            return scanHistory(ctx, tool, config);
+        },
+    };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/checks/security/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/checks/security/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,gBAAgB,EAEhB,mBAAmB,EACnB,UAAU,GACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAiC,MAAM,qBAAqB,CAAC;AAE7E,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB;IACrD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,iDAAiD;QACxD,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO;QACtB,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,SAAS,GAAG,MAAM,cAAc,CACpC,GAAG,EACH,IAAI,EACJ,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC7B,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAClD,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrF,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/security/semgrep.js

@@ -0,0 +1,184 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { generatedHeader } from '../../configs/header.js';
+import { APPLIES, EngineError, skip } from '../../core/check.js';
+import { isDockerfile } from '../infra/files.js';
+export const SEMGREPIGNORE = '.semgrepignore';
+/** The registry's security rule sets every repository runs, whatever its languages. */
+const ALWAYS = ['p/default', 'p/security-audit', 'p/owasp-top-ten', 'p/secrets'];
+const having = (...globs) => (facts) => facts.has(...globs);
+/** The rule sets for what a repository has. */
+const BY_FILES = [
+    {
+        configs: ['p/javascript', 'p/typescript', 'p/nodejs'],
+        present: having('**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}'),
+    },
+    { configs: ['p/react'], present: having('**/*.{jsx,tsx}') },
+    { configs: ['p/python'], present: having('**/*.py') },
+    { configs: ['p/php', 'p/phpcs-security-audit'], present: having('**/*.php') },
+    { configs: ['p/rust'], present: having('**/*.rs') },
+    { configs: ['p/dockerfile'], present: (facts) => facts.files.some((file) => isDockerfile(file)) },
+    {
+        configs: ['p/docker-compose'],
+        present: having('**/compose.{yml,yaml}', '**/docker-compose*.{yml,yaml}'),
+    },
+    { configs: ['p/github-actions'], present: having('.github/workflows/*.{yml,yaml}') },
+    { configs: ['p/terraform'], present: having('**/*.tf') },
+];
+/**
+ * Registry rules that judge what a Talos check already decides, by another measure: Semgrep's
+ * pnpm rule asks for a longer minimum release age than the one day every SVP-Labs repository
+ * waits, and its Dependabot rule for a cooldown of seven days where each Dependabot entry waits
+ * that same day. `supply/settings` checks both, the cooldown on every entry included.
+ */
+const EXCLUDED_RULES = [
+    'package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age',
+    'package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown',
+];
+/** The rule sets a repository runs: the security sets, and each of its languages' and tools'. */
+export function semgrepConfigs(facts) {
+    const own = BY_FILES.filter((set) => set.present(facts)).flatMap((set) => set.configs);
+    return [...ALWAYS, ...own];
+}
+/**
+ * Without a `.semgrepignore`, Semgrep skips tests and other paths by default; this one skips
+ * only what `talos.yml` excludes, anchored at the root, besides what git ignores.
+ */
+export function renderSemgrepignore(exclude, version) {
+    return [
+        generatedHeader('#', version).trimEnd(),
+        "# Semgrep skips what git ignores and talos.yml's exclude, nothing more.",
+        ...exclude.map((entry) => `/${entry.replace(/^\/+/, '')}`),
+        '',
+    ].join('\n');
+}
+export const semgrepignore = {
+    path: SEMGREPIGNORE,
+    scope: 'repo',
+    applies: () => true,
+    render: (ctx) => renderSemgrepignore(ctx.config.exclude, ctx.version),
+};
+const result = z.looseObject({
+    check_id: z.string(),
+    path: z.string(),
+    start: z.looseObject({ line: z.number(), col: z.number().optional() }),
+    end: z.looseObject({ line: z.number() }),
+    extra: z.looseObject({
+        message: z.string().default(''),
+        metadata: z
+            .looseObject({ shortlink: z.string().optional(), source: z.string().optional() })
+            .default({}),
+    }),
+});
+const output = z.looseObject({
+    results: z.array(result).default([]),
+    errors: z
+        .array(z.looseObject({ level: z.string().default('error'), message: z.string().default('') }))
+        .default([]),
+});
+/** A rule's message, cut to its first sentence and one line. */
+export function firstSentence(message) {
+    const flat = message.replaceAll(/\s+/g, ' ').trim();
+    const end = flat.search(/[.!?](?:\s|$)/);
+    return end < 0 ? flat : flat.slice(0, end + 1);
+}
+/** Semgrep's JSON output; its errors at level `error` mean the scan can't be trusted. */
+export function parseSemgrep(text) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new EngineError("Semgrep's report is not JSON");
+    }
+    const parsed = output.safeParse(raw);
+    if (!parsed.success)
+        throw new EngineError("Semgrep's report is not in the expected form");
+    const fatal = parsed.data.errors.find((error) => error.level === 'error');
+    if (fatal !== undefined)
+        throw new EngineError(`Semgrep failed: ${firstSentence(fatal.message)}`);
+    return parsed.data.results.map((found) => {
+        const docs = found.extra.metadata.shortlink ?? found.extra.metadata.source;
+        return {
+            rule: `semgrep/${found.check_id}`,
+            message: firstSentence(found.extra.message) || `Semgrep's rule ${found.check_id} matched.`,
+            location: {
+                file: found.path,
+                line: found.start.line,
+                endLine: found.end.line,
+                ...(found.start.col === undefined ? {} : { column: found.start.col }),
+            },
+            ...(docs === undefined ? {} : { docs }),
+        };
+    });
+}
+/** How many characters of file names one scan is given, well inside any command line's limit. */
+const TARGET_CHARS = 100_000;
+/** The files in runs whose names fit one command line each, in order. */
+function targetBatches(files) {
+    const out = [];
+    let current = [];
+    let length = 0;
+    for (const file of files) {
+        if (current.length > 0 && length + file.length + 1 > TARGET_CHARS) {
+            out.push(current);
+            current = [];
+            length = 0;
+        }
+        current.push(file);
+        length += file.length + 1;
+    }
+    return current.length === 0 ? out : [...out, current];
+}
+async function scanFiles(ctx, targets, report) {
+    const tool = await ctx.tools.path('semgrep');
+    const args = [
+        'scan',
+        '--metrics=off',
+        '--disable-version-check',
+        '--quiet',
+        '--json',
+        `--output=${report}`,
+        ...semgrepConfigs(ctx.facts).map((config) => `--config=${config}`),
+        ...EXCLUDED_RULES.map((rule) => `--exclude-rule=${rule}`),
+        ...ctx.config.exclude.map((entry) => `--exclude=/${entry.replace(/^\/+/, '')}`),
+        ...targets,
+    ];
+    const env = { SEMGREP_SEND_METRICS: 'off', SEMGREP_ENABLE_VERSION_CHECK: '0' };
+    const run = await ctx.exec(tool, args, { cwd: ctx.root, env });
+    const text = await readFile(report, 'utf8').catch(() => undefined);
+    const findings = text === undefined ? undefined : parseSemgrep(text);
+    if (findings !== undefined && run.code === 0)
+        return findings;
+    const detail = run.stderr.trim().split('\n').at(-1) ?? '';
+    throw new EngineError(`semgrep exited ${run.code}: ${detail === '' ? 'no report' : detail}`);
+}
+/**
+ * Semgrep is given the files the run judges, by name: given a directory it would also scan what
+ * the checkout holds beyond them, such as a tool's sandbox copy of the sources or untracked files.
+ */
+async function scan(ctx) {
+    const findings = [];
+    for (const [index, targets] of targetBatches(ctx.facts.files).entries()) {
+        const report = join(ctx.scratch, `semgrep-${index}.json`);
+        findings.push(...(await scanFiles(ctx, targets, report)));
+    }
+    return findings;
+}
+/**
+ * Semgrep's registry rules for security, the repository's languages, Docker, Compose and
+ * GitHub Actions. They come from the registry on each run, so a new rule can fail a change that
+ * passed yesterday; its base commit fails it too, so the finding is debt, not new.
+ */
+export function semgrepCheck() {
+    return {
+        id: 'security/semgrep',
+        tier: 'head',
+        scope: 'repo',
+        title: "Semgrep's security rules for the repository's languages and tools",
+        applies: (ctx) => (ctx.facts.files.length > 0 ? APPLIES : skip('the repository is empty')),
+        run: scan,
+    };
+}
+//# sourceMappingURL=semgrep.js.map

package/dist/checks/security/semgrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../../src/checks/security/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAiC,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAIhG,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE9C,uFAAuF;AACvF,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC;AAQjF,MAAM,MAAM,GACV,CAAC,GAAG,KAAe,EAAE,EAAE,CACvB,CAAC,KAAgB,EAAW,EAAE,CAC5B,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAExB,+CAA+C;AAC/C,MAAM,QAAQ,GAAwB;IACpC;QACE,OAAO,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,UAAU,CAAC;QACrD,OAAO,EAAE,MAAM,CAAC,sCAAsC,CAAC;KACxD;IACD,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE;IAC3D,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;IACrD,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;IAC7E,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;IACnD,EAAE,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE;IACjG;QACE,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC,uBAAuB,EAAE,+BAA+B,CAAC;KAC1E;IACD,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,gCAAgC,CAAC,EAAE;IACpF,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;CACzD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,cAAc,GAAsB;IACxC,iFAAiF;IACjF,qFAAqF;CACtF,CAAC;AAEF,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA0B,EAAE,OAAe;IAC7E,OAAO;QACL,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE;QACvC,yEAAyE;QACzE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QAC1D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAc;IACtC,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,MAAM;IACb,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;IACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC;CACtE,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtE,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC;QACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,QAAQ,EAAE,CAAC;aACR,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;aAChF,OAAO,CAAC,EAAE,CAAC;KACf,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;SAC7F,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACzC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,8BAA8B,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,8CAA8C,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;IAC1E,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,mBAAmB,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3E,OAAO;YACL,IAAI,EAAE,WAAW,KAAK,CAAC,QAAQ,EAAE;YACjC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,kBAAkB,KAAK,CAAC,QAAQ,WAAW;YAC1F,QAAQ,EAAE;gBACR,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBACtB,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;gBACvB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;aACtE;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iGAAiG;AACjG,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B,yEAAyE;AACzE,SAAS,aAAa,CAAC,KAAwB;IAC7C,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,YAAY,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClB,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAiB,EACjB,OAA0B,EAC1B,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG;QACX,MAAM;QACN,eAAe;QACf,yBAAyB;QACzB,SAAS;QACT,QAAQ;QACR,YAAY,MAAM,EAAE;QACpB,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,MAAM,EAAE,CAAC;QAClE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACzD,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QAC/E,GAAG,OAAO;KACX,CAAC;IACF,MAAM,GAAG,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,4BAA4B,EAAE,GAAG,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACrE,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,IAAI,WAAW,CAAC,kBAAkB,GAAG,CAAC,IAAI,KAAK,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,IAAI,CAAC,GAAiB;IACnC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,mEAAmE;QAC1E,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC1F,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC"}

package/dist/checks/security/strength.js

@@ -0,0 +1,80 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { GITLEAKS_PROJECT, redefinitions } from './gitleaks-config.js';
+import { defaultRuleIds } from './gitleaks.js';
+import { OSV_CONFIG } from './osv-config.js';
+import { gitleaksProject } from './secrets.js';
+import { SEMGREPIGNORE } from './semgrep.js';
+import { APPLIES, skip } from '../../core/check.js';
+/** The whole file, so a change to it touches the finding. */
+async function wholeFile(ctx, file) {
+    const text = await readFile(join(ctx.root, file), 'utf8').catch(() => '');
+    const lines = Math.max(1, text.replace(/\r?\n$/, '').split(/\r?\n/).length);
+    return { file, line: 1, endLine: lines };
+}
+async function weaker(ctx, file, found) {
+    return {
+        rule: 'config/weaker',
+        key: `${file} ${found.key}`,
+        message: `${file} ${found.how}; it may only tighten the base.`,
+        location: await wholeFile(ctx, file),
+    };
+}
+async function gitleaksFaults(ctx) {
+    const project = await gitleaksProject(ctx);
+    if (project === undefined)
+        return [];
+    const ids = project.rules.map((rule) => rule.id);
+    const redefined = ids.length === 0
+        ? new Set()
+        : await defaultRuleIds(ctx, await ctx.tools.path('gitleaks'), ids);
+    return [...project.faults, ...redefinitions(redefined)];
+}
+/** Ignore files below the root, which the tools honour for the files under them. */
+function nestedIgnores(ctx) {
+    const osv = ctx.facts
+        .matching(`**/${OSV_CONFIG}`)
+        .filter((file) => file !== OSV_CONFIG)
+        .map((file) => ({
+        file,
+        found: {
+            key: 'osv-scanner ignores',
+            how: "keeps vulnerability exceptions outside talos.yml's supply_chain.exceptions",
+        },
+    }));
+    const semgrep = ctx.facts
+        .matching(`**/${SEMGREPIGNORE}`)
+        .filter((file) => file !== SEMGREPIGNORE)
+        .map((file) => ({
+        file,
+        found: {
+            key: 'semgrep ignores',
+            how: "hides files from Semgrep; talos.yml's exclude is where code is left out",
+        },
+    }));
+    return [...osv, ...semgrep];
+}
+/**
+ * The security tools' project-owned configuration, held to the bases: the project's gitleaks
+ * file keeps every default rule and allowlists only inside its own rules, and no osv-scanner or
+ * Semgrep ignore file below the root weakens what the root's generated ones say.
+ */
+export function strengthCheck() {
+    return {
+        id: 'security/config-strength',
+        tier: 'head',
+        scope: 'repo',
+        title: 'gitleaks, osv-scanner and Semgrep settings no weaker than the base',
+        applies: (ctx) => ctx.facts.has(GITLEAKS_PROJECT, `**/${OSV_CONFIG}`, `**/${SEMGREPIGNORE}`)
+            ? APPLIES
+            : skip('the repository has no project-owned security tool configuration'),
+        run: async (ctx) => {
+            const gitleaks = await gitleaksFaults(ctx);
+            return Promise.all([
+                ...gitleaks.map((found) => weaker(ctx, GITLEAKS_PROJECT, found)),
+                ...nestedIgnores(ctx).map((item) => weaker(ctx, item.file, item.found)),
+            ]);
+        },
+    };
+}
+//# sourceMappingURL=strength.js.map

package/dist/checks/security/strength.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strength.js","sourceRoot":"","sources":["../../../src/checks/security/strength.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAkB,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAiC,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAGnF,6DAA6D;AAC7D,KAAK,UAAU,SAAS,CAAC,GAAiB,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAiB,EAAE,IAAY,EAAE,KAAgB;IACrE,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,GAAG,iCAAiC;QAC9D,QAAQ,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAiB;IAC7C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,SAAS,GACb,GAAG,CAAC,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,IAAI,GAAG,EAAU;QACnB,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa,CAAC,GAAiB;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK;SAClB,QAAQ,CAAC,MAAM,UAAU,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC;SACrC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,IAAI;QACJ,KAAK,EAAE;YACL,GAAG,EAAE,qBAAqB;YAC1B,GAAG,EAAE,4EAA4E;SAClF;KACF,CAAC,CAAC,CAAC;IACN,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK;SACtB,QAAQ,CAAC,MAAM,aAAa,EAAE,CAAC;SAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC;SACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,IAAI;QACJ,KAAK,EAAE;YACL,GAAG,EAAE,iBAAiB;YACtB,GAAG,EAAE,yEAAyE;SAC/E;KACF,CAAC,CAAC,CAAC;IACN,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,oEAAoE;QAC3E,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,UAAU,EAAE,EAAE,MAAM,aAAa,EAAE,CAAC;YACxE,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,iEAAiE,CAAC;QAC7E,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC3C,OAAO,OAAO,CAAC,GAAG,CAAC;gBACjB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAChE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/supply/advisories.js

@@ -0,0 +1,66 @@
+import { z } from 'zod';
+import { getJson, inPool } from './fetcher.js';
+/** OSV's names for the ecosystems. */
+const OSV_ECOSYSTEM = {
+    npm: 'npm',
+    pypi: 'PyPI',
+    packagist: 'Packagist',
+    crates: 'crates.io',
+};
+const OSV = 'https://api.osv.dev/v1';
+const batch = z.looseObject({
+    results: z.array(z.looseObject({ vulns: z.array(z.looseObject({ id: z.string() })).default([]) })),
+});
+const vulnerability = z.looseObject({
+    id: z.string(),
+    affected: z
+        .array(z.looseObject({
+        package: z.looseObject({ name: z.string(), ecosystem: z.string() }).optional(),
+        ranges: z
+            .array(z.looseObject({
+            events: z.array(z.looseObject({ fixed: z.string().optional() })).default([]),
+        }))
+            .default([]),
+    }))
+        .default([]),
+});
+/** PyPI treats `-`, `_` and `.` alike and ignores case; npm, Packagist and crates.io are exact. */
+export function sameName(ecosystem, a, b) {
+    if (ecosystem !== 'pypi')
+        return a === b;
+    const normal = (name) => name.toLowerCase().replaceAll(/[-_.]+/g, '-');
+    return normal(a) === normal(b);
+}
+/** The versions an advisory says fix it, for one package. */
+export function fixedVersions(advisory, ecosystem, name) {
+    return advisory.affected
+        .filter((entry) => entry.package?.ecosystem === OSV_ECOSYSTEM[ecosystem])
+        .filter((entry) => sameName(ecosystem, entry.package?.name ?? '', name))
+        .flatMap((entry) => entry.ranges.flatMap((range) => range.events))
+        .flatMap((event) => (event.fixed === undefined ? [] : [event.fixed]));
+}
+async function advisory(lookup, id) {
+    return lookup.memo(`supply/osv/${id}`, async () => {
+        const url = `${OSV}/vulns/${encodeURIComponent(id)}`;
+        const raw = await getJson(lookup.fetcher, { url }, `the OSV API (${id})`);
+        return raw === undefined ? undefined : vulnerability.parse(raw);
+    });
+}
+/**
+ * Every version that fixes an advisory affecting any of `versions` of a package: one batched
+ * query for the advisories, then each advisory once per run.
+ */
+export async function fixesFor(lookup, ecosystem, name, versions) {
+    if (versions.length === 0)
+        return new Set();
+    const queries = versions.map((version) => ({
+        package: { name, ecosystem: OSV_ECOSYSTEM[ecosystem] },
+        version,
+    }));
+    const raw = await getJson(lookup.fetcher, { url: `${OSV}/querybatch`, method: 'POST', body: JSON.stringify({ queries }) }, `the OSV API (${name})`);
+    const results = batch.parse(raw ?? { results: [] }).results;
+    const ids = new Set(results.flatMap((result) => result.vulns.map((found) => found.id)));
+    const advisories = await inPool([...ids], 8, (id) => advisory(lookup, id));
+    return new Set(advisories.flatMap((found) => found === undefined ? [] : fixedVersions(found, ecosystem, name)));
+}
+//# sourceMappingURL=advisories.js.map

package/dist/checks/supply/advisories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisories.js","sourceRoot":"","sources":["../../../src/checks/supply/advisories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAe,MAAM,cAAc,CAAC;AAG5D,sCAAsC;AACtC,MAAM,aAAa,GAAwC;IACzD,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,WAAW;CACpB,CAAC;AAEF,MAAM,GAAG,GAAG,wBAAwB,CAAC;AAErC,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CACjF;CACF,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,WAAW,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC,CAAC,WAAW,CAAC;QACZ,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC9E,MAAM,EAAE,CAAC;aACN,KAAK,CACJ,CAAC,CAAC,WAAW,CAAC;YACZ,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SAC7E,CAAC,CACH;aACA,OAAO,CAAC,EAAE,CAAC;KACf,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAIH,mGAAmG;AACnG,MAAM,UAAU,QAAQ,CAAC,SAAoB,EAAE,CAAS,EAAE,CAAS;IACjE,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAC3B,QAAuB,EACvB,SAAoB,EACpB,IAAY;IAEZ,OAAO,QAAQ,CAAC,QAAQ;SACrB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,KAAK,aAAa,CAAC,SAAS,CAAC,CAAC;SACxE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;SACvE,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;SACjE,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,EAAU;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;QAC1E,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,SAAoB,EACpB,IAAY,EACZ,QAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE;QACtD,OAAO;KACR,CAAC,CAAC,CAAC;IACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,MAAM,CAAC,OAAO,EACd,EAAE,GAAG,EAAE,GAAG,GAAG,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAC/E,gBAAgB,IAAI,GAAG,CACxB,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,GAAG,CACZ,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CACjE,CACF,CAAC;AACJ,CAAC"}

package/dist/checks/supply/base.js

@@ -0,0 +1,37 @@
+const inside = (ranges, line) => ranges.some((range) => range.start <= line && line <= range.end);
+const lineCount = (ranges) => ranges.reduce((sum, range) => sum + range.end - range.start + 1, 0);
+/**
+ * A file as it was at the base commit, rebuilt from its text at head and its zero-context diff:
+ * the head lines outside the added ranges, with the removed lines put back at their old line
+ * numbers. A diff whose texts don't match its ranges, or a modified file with no hunks (a patch
+ * the API left out as too large), can't be trusted.
+ */
+export function baseText(head, change) {
+    if (change.status === 'added')
+        return { known: true, text: undefined };
+    const noHunks = change.status === 'modified' && change.added.length === 0 && change.removed.length === 0;
+    const consistent = lineCount(change.added) === change.addedText.length &&
+        lineCount(change.removed) === change.removedText.length;
+    if (noHunks || !consistent)
+        return { known: false };
+    const kept = head.split('\n').filter((_, index) => !inside(change.added, index + 1));
+    const removed = change.removedText;
+    const lines = [];
+    let next = { kept: 0, removed: 0 };
+    for (let line = 1; line <= kept.length + removed.length; line += 1) {
+        if (inside(change.removed, line)) {
+            lines.push(removed[next.removed] ?? '');
+            next = { ...next, removed: next.removed + 1 };
+        }
+        else {
+            lines.push(kept[next.kept] ?? '');
+            next = { ...next, kept: next.kept + 1 };
+        }
+    }
+    return { known: true, text: lines.join('\n') };
+}
+/** The change to a path, found by its head path or, for a rename, its base path. */
+export function changeTo(changes, path) {
+    return (changes.files.get(path) ?? [...changes.files.values()].find((change) => change.oldPath === path));
+}
+//# sourceMappingURL=base.js.map

package/dist/checks/supply/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/checks/supply/base.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,GAAG,CAAC,MAA4B,EAAE,IAAY,EAAW,EAAE,CACrE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;AAEnE,MAAM,SAAS,GAAG,CAAC,MAA4B,EAAU,EAAE,CACzD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAkB;IACvD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvE,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAC3F,MAAM,UAAU,GACd,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,MAAM;QACnD,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;IAC1D,IAAI,OAAO,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACxC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,QAAQ,CAAC,OAAkB,EAAE,IAAY;IACvD,OAAO,CACL,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CACjG,CAAC;AACJ,CAAC"}

package/dist/checks/supply/dates.js

@@ -0,0 +1,26 @@
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** The longest a young release may be allowed for. */
+export const MAX_ALLOW_DAYS = 7;
+/** The minimum age of a release, in hours. */
+const MIN_AGE_HOURS = 24;
+/** A UTC calendar date, `YYYY-MM-DD`. */
+export function isoDay(at) {
+    return at.toISOString().slice(0, 10);
+}
+/**
+ * An entry expires on its date: from that day on it no longer applies, as osv-scanner's
+ * `ignoreUntil` stops ignoring at the start of the day.
+ */
+export function expired(entry, now) {
+    return entry.expires <= isoDay(now);
+}
+/** Whether an entry's expiry lies more than `days` days after today. */
+export function beyond(entry, now, days) {
+    return entry.expires > isoDay(new Date(now.getTime() + days * DAY_MS));
+}
+/** Whole hours from `then` to `now`, never negative. */
+export function hoursBetween(then, now) {
+    return Math.max(0, Math.floor((now.getTime() - then.getTime()) / (60 * 60 * 1000)));
+}
+export const youngerThanADay = (published, now) => now.getTime() - published.getTime() < MIN_AGE_HOURS * 60 * 60 * 1000;
+//# sourceMappingURL=dates.js.map

package/dist/checks/supply/dates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dates.js","sourceRoot":"","sources":["../../../src/checks/supply/dates.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,sDAAsD;AACtD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,8CAA8C;AAC9C,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,yCAAyC;AACzC,MAAM,UAAU,MAAM,CAAC,EAAQ;IAC7B,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,KAAqB,EAAE,GAAS;IACtD,OAAO,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,MAAM,CAAC,KAAqB,EAAE,GAAS,EAAE,IAAY;IACnE,OAAO,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,IAAU,EAAE,GAAS;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAe,EAAE,GAAS,EAAW,EAAE,CACrE,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/dist/checks/supply/dependabot.js

@@ -0,0 +1,87 @@
+import picomatch from 'picomatch';
+import { parse } from 'yaml';
+import { z } from 'zod';
+/** Every day count a cooldown can set, its default first. */
+const DAYS = [
+    'default-days',
+    'semver-major-days',
+    'semver-minor-days',
+    'semver-patch-days',
+];
+const cooldown = z.looseObject({
+    'default-days': z.number().optional(),
+    'semver-major-days': z.number().optional(),
+    'semver-minor-days': z.number().optional(),
+    'semver-patch-days': z.number().optional(),
+    exclude: z.array(z.string()).default([]),
+});
+const update = z.looseObject({
+    'package-ecosystem': z.string(),
+    directory: z.string().optional(),
+    directories: z.array(z.string()).optional(),
+    cooldown: cooldown.optional(),
+});
+const config = z.looseObject({ updates: z.array(update).default([]) });
+function trimmed(directory) {
+    let end = directory.length;
+    while (end > 1 && directory.charAt(end - 1) === '/')
+        end -= 1;
+    return directory.slice(0, end);
+}
+function covers(entry, directory) {
+    const patterns = (entry.directories ?? [entry.directory ?? '/']).map(trimmed);
+    return patterns.some((pattern) => pattern === directory || picomatch(pattern, { dot: true })(directory));
+}
+/**
+ * A cooldown holds every version update at least a day: each day count it sets is 1 or more,
+ * and it exempts no dependency.
+ */
+export function holdsADay(held) {
+    if (held === undefined)
+        return false;
+    const days = DAYS.map((key) => held[key]);
+    const [defaultDays] = days;
+    if (defaultDays === undefined || defaultDays < 1)
+        return false;
+    return (days.every((value) => value === undefined || value >= 1) && (held.exclude ?? []).length === 0);
+}
+function missingEcosystems(updates, wanted) {
+    return wanted.flatMap((ecosystem) => ecosystem.directories.flatMap((directory) => {
+        const entries = updates.filter((u) => u['package-ecosystem'] === ecosystem.ecosystem);
+        if (entries.some((entry) => covers(entry, directory)))
+            return [];
+        return [
+            {
+                key: `dependabot ${ecosystem.ecosystem} ${directory}`,
+                message: `has no ${ecosystem.ecosystem} entry for ${directory}, so Dependabot proposes no updates there.`,
+            },
+        ];
+    }));
+}
+/** What `.github/dependabot.yml` lacks for the ecosystems the repository has. */
+export function dependabotGaps(text, wanted) {
+    if (text === undefined) {
+        const names = [...new Set(wanted.map((e) => e.ecosystem))].join(', ');
+        return [
+            {
+                key: 'dependabot file',
+                message: `is missing; it needs an entry with a one-day cooldown for each ecosystem here: ${names}.`,
+            },
+        ];
+    }
+    let parsed;
+    try {
+        parsed = config.parse(parse(text) ?? {});
+    }
+    catch {
+        return [{ key: 'dependabot file', message: 'cannot be read as a Dependabot configuration.' }];
+    }
+    const loose = parsed.updates
+        .filter((entry) => !holdsADay(entry.cooldown))
+        .map((entry) => ({
+        key: `dependabot cooldown ${entry['package-ecosystem']} ${entry.directory ?? ''}`,
+        message: `lets ${entry['package-ecosystem']} updates through before they are a day old: give the entry a cooldown with default-days of 1 or more and no exclusions.`,
+    }));
+    return [...loose, ...missingEcosystems(parsed.updates, wanted)];
+}
+//# sourceMappingURL=dependabot.js.map

package/dist/checks/supply/dependabot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependabot.js","sourceRoot":"","sources":["../../../src/checks/supply/dependabot.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,6DAA6D;AAC7D,MAAM,IAAI,GAAwB;IAChC,cAAc;IACd,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAOvE,SAAS,OAAO,CAAC,SAAiB;IAChC,IAAI,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;IAC3B,OAAO,GAAG,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,SAAiB;IAC9C,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CACnF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAA0C;IAClE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;IAC3B,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAC9F,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA0B,EAAE,MAA4B;IACjF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAClC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,SAAS,EAAS,EAAE;QACjD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC,SAAS,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACjE,OAAO;YACL;gBACE,GAAG,EAAE,cAAc,SAAS,CAAC,SAAS,IAAI,SAAS,EAAE;gBACrD,OAAO,EAAE,UAAU,SAAS,CAAC,SAAS,cAAc,SAAS,4CAA4C;aAC1G;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,IAAwB,EAAE,MAA4B;IACnF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,OAAO;YACL;gBACE,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,kFAAkF,KAAK,GAAG;aACpG;SACF,CAAC;IACJ,CAAC;IACD,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO;SACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;SAC7C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,GAAG,EAAE,uBAAuB,KAAK,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE,EAAE;QACjF,OAAO,EAAE,QAAQ,KAAK,CAAC,mBAAmB,CAAC,yHAAyH;KACrK,CAAC,CAAC,CAAC;IACN,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/checks/supply/deps.js

@@ -0,0 +1,8 @@
+import { httpFetcher } from './fetcher.js';
+import { lockfiles } from './lockfiles/index.js';
+import { APPLIES, skip } from '../../core/check.js';
+export const LIVE = { fetcher: httpFetcher, now: () => new Date() };
+export function hasLockfile(ctx) {
+    return lockfiles(ctx.facts).length > 0 ? APPLIES : skip('the repository has no lockfile');
+}
+//# sourceMappingURL=deps.js.map

package/dist/checks/supply/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../../src/checks/supply/deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,WAAW,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAyC,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAK3F,MAAM,CAAC,MAAM,IAAI,GAAe,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAEhF,MAAM,UAAU,WAAW,CAAC,GAAiB;IAC3C,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;AAC5F,CAAC"}