@xenos1996/usa 2.25.1 → 2.25.3

package/README.md

@@ -320,8 +320,8 @@ Rule packs are the easiest high-value contribution — one YAML file, no TypeScr
 ```bash
 git clone https://github.com/Er-Sajan-PLG/universal-software-auditor
 cd universal-software-auditor
-npm install && npm test
-npm run usa -- audit .       # run the CLI from source
+pnpm install && pnpm test
+pnpm run usa -- audit .       # run the CLI from source
 ```
 
 Agents and humans doing repo work: read `AGENTS.md` first — it holds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xenos1996/usa",
-  "version": "2.25.1",
+  "version": "2.25.3",
   "description": "Universal Software Auditor — an open-source, self-adapting audit framework for any project, any stack, any stage",
   "license": "MIT",
   "type": "module",
@@ -24,6 +24,10 @@
     "README.md",
     "LICENSE"
   ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "keywords": [
     "audit",
     "software-audit",
@@ -52,28 +56,6 @@
   "engines": {
     "node": ">=20.0.0"
   },
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "usa": "node --experimental-strip-types src/cli.ts",
-    "lint": "eslint .",
-    "lint:fix": "eslint . --fix",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:cov": "vitest run --coverage",
-    "self-audit": "npm run build && node dist/cli.js audit . --out AUDIT.md",
-    "docs:sync": "node scripts/sync-docs.mjs",
-    "docs:check": "node scripts/check-docs.mjs",
-    "docs:adrs": "node scripts/check-adrs.mjs",
-    "docs:cli": "node scripts/gen-cli-docs.mjs --check",
-    "docs:sample": "node scripts/gen-sample-report.mjs --check",
-    "docs:asvs": "node scripts/gen-asvs-coverage.mjs --check",
-    "docs:links": "node scripts/check-links.mjs",
-    "docs:all": "npm run docs:adrs && npm run docs:check && npm run docs:cli && npm run docs:sample && npm run docs:asvs",
-    "prepublishOnly": "npm run build"
-  },
   "lint-staged": {
     "*.{js,ts,mjs,cjs}": [
       "eslint --fix",
@@ -87,6 +69,8 @@
     "yaml": "^2.6.1"
   },
   "devDependencies": {
+    "@changesets/changelog-github": "^1.0.1",
+    "@changesets/cli": "^3.0.3",
     "@commitlint/cli": "^21.2.2",
     "@commitlint/config-conventional": "^21.2.2",
     "@eslint/js": "^10.0.1",
@@ -99,5 +83,31 @@
     "typescript": "^5.7.3",
     "typescript-eslint": "^8.20.0",
     "vitest": "^5.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "usa": "node --experimental-strip-types src/cli.ts",
+    "lint": "eslint .",
+    "actions:pin": "node scripts/pin-actions.mjs",
+    "actions:check": "node scripts/pin-actions.mjs --check",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:cov": "vitest run --coverage",
+    "self-audit": "npm run build && node dist/cli.js audit . --out AUDIT.md",
+    "docs:sync": "node scripts/sync-docs.mjs",
+    "docs:check": "node scripts/check-docs.mjs",
+    "docs:adrs": "node scripts/check-adrs.mjs",
+    "docs:cli": "node scripts/gen-cli-docs.mjs --check",
+    "docs:sample": "node scripts/gen-sample-report.mjs --check",
+    "docs:asvs": "node scripts/gen-asvs-coverage.mjs --check",
+    "docs:links": "node scripts/check-links.mjs",
+    "docs:all": "npm run docs:adrs && npm run docs:check && npm run docs:cli && npm run docs:sample && npm run docs:asvs",
+    "changeset": "changeset",
+    "version-packages": "changeset version && pnpm run format",
+    "release": "pnpm run build && changeset publish"
   }
-}
+}

package/rules/core/supply-chain.yaml

@@ -204,7 +204,7 @@ rules:
     tags: [github-actions]
 
   - id: SUP-010
-    title: Third-party actions are pinned to a version or SHA
+    title: Third-party actions are pinned to a commit SHA
     section: S3
     section_title: Supply Chain & Build Provenance
     severity: MEDIUM
@@ -212,11 +212,30 @@ rules:
     applies_when: { fact: 'ci:github-actions' }
     check:
       kind: grep_absent
-      pattern: 'uses:\s*[^@\s]+@(main|master|latest)\s*$'
+      # Anything that is not a 40-hex commit SHA is a moving target: even a
+      # semver tag like `@v4` is a mutable ref the upstream owner can repoint,
+      # so the next run executes a different commit with our secrets in scope.
+      # This used to match only `@main|@master|@latest`, which let every `@vN`
+      # tag through — the exact drift OpenSSF Scorecard's Pinned-Dependencies
+      # check flags, and the gap that produced 59 findings on this repo.
+      #
+      # The lookahead requires 40 hex chars AND a following boundary, so a
+      # 40-hex prefix of a longer ref (`…aaaa` + `zzz`) is still a failure.
+      # The `.github/workflows/*` include list plus the fact gate above keep
+      # this scoped to GitHub Actions; a Docker `image: …@sha256:` digest is a
+      # different syntax and not matched.
+      #
+      # `^(?!\s*#)` skips comment lines. Without it the rule matches prose
+      # that merely quotes the syntax — it flagged this repo's own ci.yml
+      # comment explaining the rule, the same self-match that hit
+      # scripts/pin-actions.mjs in the same session. A rule that fires on its
+      # own documentation is a false positive; comments are not directives.
+      pattern: '^(?!\s*#).*uses:\s*(?:[\w.-]+\/)+[\w.-]+@(?!([0-9a-f]{40})(?:\s|$))'
       include: ['.github/workflows/*.yml', '.github/workflows/*.yaml']
       flags: i
-    why: '`@main` on a third-party action means their next commit runs with your secrets.'
-    remediation: 'Pin to a full commit SHA; enable Dependabot for github-actions to keep them current.'
+    why: 'A mutable ref (`@v4`, `@main`) lets the upstream owner — or anyone who compromises them — run arbitrary code with your tokens; only a commit SHA is immutable.'
+    remediation: 'Pin to a full commit SHA with the version in a trailing comment (`uses: owner/action@<40-hex> # vX.Y.Z`), which keeps Dependabot able to raise update PRs. `node scripts/pin-actions.mjs` rewrites every workflow in place; `--check` fails if any ref drifts back.'
+    note: 'Tightened 2026-09-17 after OpenSSF Scorecard reported 59 unpinned actions. The trailing `# vX.Y.Z` comment is load-bearing: without it Dependabot cannot update a SHA pin.'
     references: ['OpenSSF-Scorecard:Pinned-Dependencies']
 
   - id: SUP-011