@vaultcompass/vault-guard-core 1.4.0 → 1.4.2

package/dist/scan-output.js

@@ -26,6 +26,35 @@ function normalizeFilePath(file, cwd) {
         return file;
     return rel || '.';
 }
+/** Matches a Windows drive-letter absolute path (`C:\...`, `C:/...`) or a UNC path (`\\server\share`). */
+const WINDOWS_ABSOLUTE_PATH_RE = /^(?:[a-zA-Z]:[\\/]|\\\\)/;
+function isWindowsStylePath(p) {
+    return WINDOWS_ABSOLUTE_PATH_RE.test(p);
+}
+/**
+ * SARIF `artifactLocation.uri` must be a relative-reference URI: forward
+ * slashes only, no leading `./`, no leading `/` (the GitHub Code Scanning
+ * SARIF spec requires this even when the scanner itself runs on Windows,
+ * where `path.relative` returns backslash-separated paths).
+ *
+ * Picks `path.win32` when either side of the comparison looks like a
+ * Windows-style path, so this is correct both when the process itself runs
+ * on Windows (native `path` is already `path.win32`) and when a
+ * Windows-style path is normalized on a POSIX host (tests, or a SARIF file
+ * produced elsewhere and re-normalized).
+ */
+function toSarifArtifactUri(file, cwd) {
+    if (cwd === null)
+        return file.split('\\').join('/');
+    const base = cwd ?? process.cwd();
+    const impl = isWindowsStylePath(file) || isWindowsStylePath(base) ? path_1.default.win32 : path_1.default;
+    if (!impl.isAbsolute(file))
+        return file.split('\\').join('/');
+    const rel = impl.relative(base, file);
+    if (rel.startsWith('..') || impl.isAbsolute(rel))
+        return file.split('\\').join('/');
+    return (rel || '.').split('\\').join('/');
+}
 function formatJson(results, opts = {}) {
     const fpCwd = opts.cwd === undefined ? process.cwd() : opts.cwd;
     const output = {
@@ -60,6 +89,7 @@ function formatJson(results, opts = {}) {
 }
 /** SARIF 2.1.0 — compatible with GitHub Code Scanning (upload-sarif action). */
 function formatSarif(results, opts = {}) {
+    const fpCwd = opts.cwd === undefined ? process.cwd() : opts.cwd;
     const rules = [
         ...new Set(results.flatMap(r => r.matches.map(m => m.type))),
     ].map(id => ({
@@ -82,7 +112,7 @@ function formatSarif(results, opts = {}) {
         locations: [
             {
                 physicalLocation: {
-                    artifactLocation: { uri: normalizeFilePath(file, opts.cwd), uriBaseId: '%SRCROOT%' },
+                    artifactLocation: { uri: toSarifArtifactUri(file, opts.cwd), uriBaseId: '%SRCROOT%' },
                     region: {
                         startLine: m.line,
                         startColumn: m.column + 1,
@@ -91,6 +121,10 @@ function formatSarif(results, opts = {}) {
                 },
             },
         ],
+        // Same fingerprint the JSON output emits per finding (positional: keyed
+        // on relative path + type + line + offset + matchLength). Lets GitHub
+        // Code Scanning track a finding's identity across runs.
+        partialFingerprints: { 'vault-guard/v1': (0, match_fingerprint_1.fingerprintForMatch)(fpCwd, file, m) },
     })));
     // Diagnostics are emitted as SARIF notifications (tool/driver/notifications)
     // so they appear in the GitHub Code Scanning UI as tool warnings rather than

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard-core",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Secret-scanning engine: vendor-anchored patterns, entropy gating, baselines, SARIF/JSON, hook helpers.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",