@xenos1996/usat 1.0.0 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/ci-integration.md +29 -8
- package/package.json +3 -1
- package/rules/core/testing.yaml +5 -1
package/docs/ci-integration.md
CHANGED
|
@@ -128,19 +128,40 @@ improvement — the thing a single audit can never do.
|
|
|
128
128
|
|
|
129
129
|
USAT audits itself with the full stack — copy what fits:
|
|
130
130
|
|
|
131
|
-
| Workflow
|
|
132
|
-
|
|
|
133
|
-
| `ci.yml`
|
|
134
|
-
| `self-audit.yml`
|
|
135
|
-
| `scorecard.yml`
|
|
136
|
-
| `automerge.yml`
|
|
137
|
-
| `gitleaks-pin.yml`
|
|
138
|
-
| `release.yml`
|
|
131
|
+
| Workflow | What it does |
|
|
132
|
+
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
133
|
+
| `ci.yml` | lint+format+typecheck · Vitest with coverage thresholds · build + CLI smoke · rule-pack validation · npm audit + gitleaks + license scan · **hygiene** (`check-adrs` + `check-docs`) |
|
|
134
|
+
| `self-audit.yml` | `usat audit . --depth deep --fail-on critical` on every PR, score as PR comment |
|
|
135
|
+
| `scorecard.yml` | OpenSSF Scorecard monthly + on push (API-verified hygiene; SARIF to Security tab) |
|
|
136
|
+
| `automerge.yml` | Dependabot patch/minor auto-merge once CI is green (majors stay manual) |
|
|
137
|
+
| `gitleaks-pin.yml` | Monthly check that the curl-pinned gitleaks binary in `ci.yml` is current (no bot watches it) — opens a deduped issue when stale |
|
|
138
|
+
| `release.yml` | Tag push `v*` → OIDC trusted publishing (no long-lived token) + `--provenance` + CycloneDX SBOM artifact |
|
|
139
|
+
| `release-please.yml` | Conventional commits → open Release PR (bump + CHANGELOG as reviewable diff); merging it cuts the tag that fires `release.yml` |
|
|
140
|
+
| `commits` in `ci.yml` | Lints PR commit messages (commitlint) — releases are computed from history, so history must parse |
|
|
139
141
|
|
|
140
142
|
Release setup note: trusted publishing needs a one-time owner step on
|
|
141
143
|
npmjs.com (package Settings → Trusted Publisher → this repo + workflow)
|
|
142
144
|
before the first OIDC publish succeeds.
|
|
143
145
|
|
|
146
|
+
## How a release happens (developer-style, no manual versioning)
|
|
147
|
+
|
|
148
|
+
1. Land PRs with Conventional Commits titles (`feat:`, `fix:`, `docs:`,
|
|
149
|
+
`refactor:` …) — squash-merge so the title becomes the commit.
|
|
150
|
+
`feat` → minor bump, `fix` → patch, `BREAKING CHANGE:` footer → major.
|
|
151
|
+
Anything else (docs, chore, test) rides along without bumping.
|
|
152
|
+
2. release-please keeps one open **Release PR** updated: version bump in
|
|
153
|
+
`package.json` + CHANGELOG entries, as a diff you review like code.
|
|
154
|
+
3. Merge the Release PR → tag `vX.Y.Z` is cut → `release.yml` publishes
|
|
155
|
+
via OIDC with provenance + SBOM. Tags are the release act; never push
|
|
156
|
+
`v*` tags by hand (first bootstrap tag `v1.0.0` excepted).
|
|
157
|
+
4. release-please itself authenticates with a fine-grained PAT
|
|
158
|
+
(`RELEASE_PLEASE_TOKEN`, repo-scoped: Contents, PRs, Issues
|
|
159
|
+
read+write) — **not** `GITHUB_TOKEN`. Tags pushed by `GITHUB_TOKEN`
|
|
160
|
+
do not trigger downstream workflows, so with the default token the
|
|
161
|
+
tag lands, the GitHub Release is created… and `release.yml` never
|
|
162
|
+
fires. Nothing reaches npm. This failure is silent by design
|
|
163
|
+
(loop prevention) — the PAT is load-bearing, not optional.
|
|
164
|
+
|
|
144
165
|
## Choosing a depth in CI
|
|
145
166
|
|
|
146
167
|
| Depth | Rules | Runtime (≈10k files) | Use for |
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xenos1996/usat",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.1.0",
|
|
4
4
|
"description": "Universal Software Audit Template — an open-source, self-adapting audit framework for any project, any stack, any stage",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -82,6 +82,8 @@
|
|
|
82
82
|
"yaml": "^2.6.1"
|
|
83
83
|
},
|
|
84
84
|
"devDependencies": {
|
|
85
|
+
"@commitlint/cli": "^21.2.2",
|
|
86
|
+
"@commitlint/config-conventional": "^21.2.2",
|
|
85
87
|
"@eslint/js": "^10.0.1",
|
|
86
88
|
"@types/node": "^26.4.1",
|
|
87
89
|
"@vitest/coverage-v8": "^5.0.0",
|
package/rules/core/testing.yaml
CHANGED
|
@@ -120,7 +120,11 @@ rules:
|
|
|
120
120
|
- { fact: 'maturity:beta' }
|
|
121
121
|
check:
|
|
122
122
|
kind: grep_present
|
|
123
|
-
|
|
123
|
+
# NOTE: `coverage\s*:\s*\{` covers Vitest-style `coverage: { thresholds:
|
|
124
|
+
# … }` blocks — the earlier `coverage\s*{` (no colon) missed exactly
|
|
125
|
+
# the config form this repo itself uses, so the rule failed USAT's own
|
|
126
|
+
# self-audit the week thresholds were added. Keep both alternatives.
|
|
127
|
+
pattern: '(coverageThreshold|failUnder|--fail-under|min-coverage|coverage\s*\{|coverage\s*:\s*\{|\[tool\.coverage\.report\]\s*\n[^\n]*fail_under)'
|
|
124
128
|
include:
|
|
125
129
|
[
|
|
126
130
|
'package.json',
|