@vibecontrols/vibe-plugin-security-release-gate 2026.731.1 → 2026.1108.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +1 -1
- package/dist/provider.d.ts +1 -2
- package/package.json +37 -24
package/dist/index.js
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{ProviderRegistry,TelemetryEmitter,createLifecycleHooks}from"@vibecontrols/plugin-sdk";import{createHash}from"crypto";import{promises as fs}from"fs";import*as path from"path";import{normalizeOpaDecision}from"@vibecontrols/vibe-plugin-security/normalizer";var POLICY_VERSION=2,POLICY_ID="vibecontrols.security.release";class ReleaseGateProvider{name="opa-release-gate";stage="promote.prod";toolVersion=`agent-local-policy@${POLICY_ID}/v${POLICY_VERSION}`;
|
|
2
|
+
import{ProviderRegistry,TelemetryEmitter,createLifecycleHooks}from"@vibecontrols/plugin-sdk";import{createHash}from"crypto";import{promises as fs}from"fs";import*as path from"path";import{normalizeOpaDecision}from"@vibecontrols/vibe-plugin-security/normalizer";var POLICY_VERSION=2,POLICY_ID="vibecontrols.security.release";class ReleaseGateProvider{name="opa-release-gate";stage="promote.prod";toolVersion=`agent-local-policy@${POLICY_ID}/v${POLICY_VERSION}`;async init(_host){}async ensureToolInstalled(){}async run(input){let startedAt=Date.now(),cfg=input.config??{};input.onProgress?.({pct:10,message:"Loading upstream scan data"});let upstreamFindings=cfg.upstreamFindings??[],upstreamSummary=cfg.upstreamSummary??{critical:0,high:0,medium:0,low:0,info:0};input.onProgress?.({pct:40,message:"Evaluating release gate policy"});let decision=evaluatePolicy(upstreamFindings,upstreamSummary,cfg);input.onProgress?.({pct:70,message:"Building deny[] -> findings"});let opaResultDoc=JSON.stringify({result:{allow:decision.allow,deny:decision.denyReasons}}),findings=normalizeOpaDecision(opaResultDoc,this.name),evidencePath=path.join(input.workdir,"opa-decision.json"),evidenceJson=JSON.stringify(decision,null,2);await fs.writeFile(evidencePath,evidenceJson,"utf-8");let stat=await fs.stat(evidencePath),sha256=createHash("sha256").update(evidenceJson).digest("hex"),evidence=[{type:"opa-decision",localPath:evidencePath,sha256,sizeBytes:stat.size}];return input.onProgress?.({pct:100,message:"Release gate evaluated"}),{runId:input.runId,status:"succeeded",findings,evidence,durationMs:Date.now()-startedAt,summary:summarize(findings)}}async cancel(_runId){}metadata(){return{stage:this.stage,supportedProfiles:["backend","frontend","cli","sdk","mcp","mobile","container","iac"],toolVersion:this.toolVersion,description:"Agent-local release-gate policy for the promote.prod stage. No backend."}}}function evaluatePolicy(upstreamFindings,summary,cfg){let denyReasons=[],openCriticals=upstreamFindings.filter((f)=>f.severity==="critical"&&f.status==="open"),openHighs=upstreamFindings.filter((f)=>f.severity==="high"&&f.status==="open");if(openCriticals.length>0)denyReasons.push(`${openCriticals.length} critical finding(s) open: ${openCriticals.slice(0,3).map((f)=>f.ruleId).join(", ")}${openCriticals.length>3?"...":""}`);if(!cfg.upstreamScanRunId&&summary.critical===0&&summary.high===0&&summary.medium===0&&summary.low===0&&summary.info===0)denyReasons.push("No upstream scan recorded \u2014 build stage must run before promote.prod");if(cfg.requireSignedArtifact&&!cfg.signature?.verified)denyReasons.push("Required signature is missing or not verified");if(typeof cfg.maxHighOpen==="number"&&openHighs.length>cfg.maxHighOpen)denyReasons.push(`${openHighs.length} open high-severity finding(s) exceeds maxHighOpen=${cfg.maxHighOpen}`);return{allow:denyReasons.length===0,denyReasons,evaluatedAt:new Date().toISOString(),policyVersion:POLICY_VERSION,policyId:POLICY_ID,input:{summary,openCriticalCount:openCriticals.length,openHighCount:openHighs.length,upstreamScanRunId:cfg.upstreamScanRunId}}}function summarize(findings){let s={critical:0,high:0,medium:0,low:0,info:0};for(let f of findings)s[f.severity]++;return s}var PLUGIN_NAME="security-release-gate",PLUGIN_VERSION="2026.527.1",createPlugin=(_ctx)=>{let provider=new ReleaseGateProvider,telemetry=new TelemetryEmitter(PLUGIN_NAME,PLUGIN_VERSION),lifecycle=createLifecycleHooks({name:PLUGIN_NAME,telemetryEventName:"security.release-gate.ready",onInit:async(host)=>{await provider.init(host),new ProviderRegistry(host).registerProvider("security.release","opa-release-gate",provider),telemetry.emit("security.release-gate.registered",{provider:"opa-release-gate",toolVersion:provider.toolVersion})}});return{name:PLUGIN_NAME,version:PLUGIN_VERSION,description:"OPA Rego release-gate provider for the promote.prod stage.",tags:["backend","provider","integration"],capabilities:{storage:"rw",audit:!0,telemetry:!0,gateway:!0},onServerStart:lifecycle.onServerStart,onServerStop:lifecycle.onServerStop}},src_default=createPlugin;export{ReleaseGateProvider,createPlugin,src_default as default};
|
package/dist/provider.d.ts
CHANGED
|
@@ -4,8 +4,7 @@ export declare class ReleaseGateProvider implements SecurityProvider {
|
|
|
4
4
|
readonly name = "opa-release-gate";
|
|
5
5
|
readonly stage: SecurityStage;
|
|
6
6
|
readonly toolVersion = "agent-local-policy@vibecontrols.security.release/v2";
|
|
7
|
-
|
|
8
|
-
init(host: HostServices): Promise<void>;
|
|
7
|
+
init(_host: HostServices): Promise<void>;
|
|
9
8
|
ensureToolInstalled(): Promise<void>;
|
|
10
9
|
run(input: SecurityScanInput): Promise<SecurityScanResult>;
|
|
11
10
|
cancel(_runId: string): Promise<void>;
|
package/package.json
CHANGED
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vibecontrols/vibe-plugin-security-release-gate",
|
|
3
|
-
"version": "2026.
|
|
3
|
+
"version": "2026.1108.2",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"main": "./dist/index.js",
|
|
6
6
|
"types": "./dist/index.d.ts",
|
|
7
7
|
"description": "OPA-backed release-gate provider for the promote.prod lifecycle stage. Calls the backend policy decision resolver and maps deny[] to NormalizedFinding[]. Registers as a security.release provider with @vibecontrols/vibe-plugin-security.",
|
|
8
8
|
"engines": {
|
|
9
|
-
"bun": ">=1.
|
|
9
|
+
"bun": ">=1.4.4"
|
|
10
10
|
},
|
|
11
11
|
"author": {
|
|
12
12
|
"name": "Vignesh T.V",
|
|
@@ -14,32 +14,31 @@
|
|
|
14
14
|
},
|
|
15
15
|
"license": "MIT",
|
|
16
16
|
"scripts": {
|
|
17
|
-
"build": "bun build ./src/index.ts --outdir ./dist --target bun --minify-syntax --minify-whitespace --external elysia --external @vibecontrols/vibe-plugin-security --external @vibecontrols/plugin-sdk && tsc
|
|
18
|
-
"dev": "tsc --watch",
|
|
19
|
-
"lint": "eslint
|
|
20
|
-
"format": "
|
|
21
|
-
"format:check": "
|
|
22
|
-
"type:check": "
|
|
23
|
-
"test": "bun test
|
|
17
|
+
"build": "bun build ./src/index.ts --outdir ./dist --target bun --minify-syntax --minify-whitespace --external elysia --external @vibecontrols/vibe-plugin-security --external @vibecontrols/plugin-sdk && tsc -p tsconfig.build.json",
|
|
18
|
+
"dev": "tsc -p tsconfig.build.json --watch",
|
|
19
|
+
"lint": "eslint .",
|
|
20
|
+
"format": "bun fmt",
|
|
21
|
+
"format:check": "bun fmt --check",
|
|
22
|
+
"type:check": "boff gate -- bun check --no-pretty",
|
|
23
|
+
"test": "bun test",
|
|
24
24
|
"clean": "rimraf dist",
|
|
25
25
|
"prebuild": "bun run clean",
|
|
26
26
|
"prepublishOnly": "bun run build",
|
|
27
|
-
"sanity": "
|
|
27
|
+
"sanity": "boff sanity",
|
|
28
|
+
"sanity:force": "boff sanity --force",
|
|
29
|
+
"audit": "bun audit --audit-level=high"
|
|
28
30
|
},
|
|
29
31
|
"dependencies": {
|
|
30
|
-
"@vibecontrols/plugin-sdk": "2026.
|
|
31
|
-
"@vibecontrols/vibe-plugin-security": "2026.
|
|
32
|
+
"@vibecontrols/plugin-sdk": "2026.1107.1",
|
|
33
|
+
"@vibecontrols/vibe-plugin-security": "2026.731.1"
|
|
32
34
|
},
|
|
33
35
|
"devDependencies": {
|
|
34
|
-
"@
|
|
35
|
-
"@types/
|
|
36
|
-
"
|
|
37
|
-
"
|
|
38
|
-
"
|
|
39
|
-
"
|
|
40
|
-
"rimraf": "^6.0.1",
|
|
41
|
-
"typescript": "^5.9.3",
|
|
42
|
-
"typescript-eslint": "^8.56.0"
|
|
36
|
+
"@burdenoff/toolchain": "2026.1107.14",
|
|
37
|
+
"@types/bun": "^1.4.4",
|
|
38
|
+
"eslint": "^9.39.5",
|
|
39
|
+
"knip": "^6.44.1",
|
|
40
|
+
"rimraf": "^6.1.4",
|
|
41
|
+
"typescript": "6.0.3"
|
|
43
42
|
},
|
|
44
43
|
"peerDependencies": {
|
|
45
44
|
"@vibecontrols/agent": ">=2026.428.0"
|
|
@@ -63,10 +62,10 @@
|
|
|
63
62
|
],
|
|
64
63
|
"repository": {
|
|
65
64
|
"type": "git",
|
|
66
|
-
"url": "git+https://github.com/
|
|
65
|
+
"url": "git+https://github.com/Algoshred/vibe-plugin-security-release-gate.git"
|
|
67
66
|
},
|
|
68
67
|
"bugs": {
|
|
69
|
-
"url": "https://github.com/
|
|
68
|
+
"url": "https://github.com/Algoshred/vibe-plugin-security-release-gate/issues"
|
|
70
69
|
},
|
|
71
70
|
"homepage": "https://vibecontrols.com",
|
|
72
71
|
"publishConfig": {
|
|
@@ -78,5 +77,19 @@
|
|
|
78
77
|
"!dist/**/*.map",
|
|
79
78
|
"README.md",
|
|
80
79
|
"LICENSE"
|
|
81
|
-
]
|
|
80
|
+
],
|
|
81
|
+
"packageManager": "bun@1.4.4",
|
|
82
|
+
"boff": {
|
|
83
|
+
"type": "plugin",
|
|
84
|
+
"sanity": {
|
|
85
|
+
"steps": [
|
|
86
|
+
"format",
|
|
87
|
+
"lint",
|
|
88
|
+
"typecheck",
|
|
89
|
+
"build",
|
|
90
|
+
"test",
|
|
91
|
+
"knip"
|
|
92
|
+
]
|
|
93
|
+
}
|
|
94
|
+
}
|
|
82
95
|
}
|