canship 0.3.0 → 0.3.1

package/README-zh-CN.md

@@ -46,6 +46,7 @@ npx canship .
 | `--only=ids` | 仅执行匹配规则，支持逗号分隔及重复参数 |
 | `--skip=ids` | 排除匹配规则，支持逗号分隔及重复参数 |
 | `--no-config` | 忽略项目配置 |
+| `--no-ignore-markers` | 不遵从被扫描源码中的忽略标记 |
 | `--list-rules` | 列出规则及限制，不扫描；支持 `--json` |
 | `--no-excerpts` | 所有报告省略源码摘录，不改变结果和退出码 |
 | `-h`, `--help` | 显示帮助 |
@@ -74,7 +75,7 @@ JSON 使用独立于包版本的 `schemaVersion: 1`，npm 包附带 [结构定
 
 保存为 `.github/workflows/canship.yml`，在推送和 PR 时扫描并生成统计摘要。安装扫描器需要联网，扫描不联网；不安装或执行项目依赖，默认不上传 SARIF。
 
-示例固定 Action 提交，安装 npm 版 `0.2.1`；`version` 不使用仓库中的未发布源码。Action 兼容 0.2.1 无 `schemaVersion` 的报告。
+示例固定 Action 提交，显式安装 npm 版 `0.3.0`；`version` 不使用仓库中的未发布源码。Action 兼容 0.2.1 无 `schemaVersion` 的报告。
 
 ```yaml
 name: canship
@@ -89,15 +90,15 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: Tasomei/canship@37cf06e014168968a88679157564e5c489f99c50
+      - uses: Tasomei/canship@8b1a3aa88c77e92e2806b343af6003372855bc70
         with:
-          version: '0.2.1'
+          version: '0.3.0'
 ```
 
 | 输入 | 默认值 | 说明 |
 |---|---|---|
 | `path` | `.` | 检出目录内的扫描路径 |
-| `version` | `0.2.1` | 精确 npm 版本，不接受范围或标签 |
+| `version` | `0.3.0` | 精确 npm 版本，不接受范围或标签 |
 | `fail-on` | `blocking` | `blocking`：确定的 P0/P1；`any`：全部结果；`none`：仅报告结果 |
 | `only` / `skip` | 未设置 | 互斥，逗号分隔的规则选择器 |
 | `baseline` | 未设置 | 相对扫描目录的已有基线 |
@@ -120,7 +121,7 @@ jobs:
 }
 ```
 
-命令行参数优先；`only`、`skip` 互斥，接受规则 ID 或命名空间。未选规则不执行，`ruleSelection.removed` 仅统计已执行规则中被过滤的结果。扫描不可信项目时使用 `--no-config`；`bestEffort` 仅限命令行设置。
+命令行参数优先；`only`、`skip` 互斥，接受规则 ID 或命名空间。未选规则不执行，`ruleSelection.removed` 仅统计已执行规则中被过滤的结果。扫描不可信项目时同时使用 `--no-config --no-ignore-markers`，二者均由被扫描项目控制；`bestEffort` 仅限命令行设置。
 
 ### 忽略标记
 
@@ -131,7 +132,7 @@ jobs:
 const corsOptions = { origin: '*', credentials: true }
 ```
 
-报告披露忽略、规则筛选和基线抑制信息；主动排除不标记为未完成。
+报告披露忽略、规则筛选和基线抑制信息；主动排除不标记为未完成。标记可使退出码降为 `0`；`--no-config` 不影响标记，`--no-ignore-markers` 使两种标记均失效。
 
 ### 基线
 

package/README.md

@@ -46,6 +46,7 @@ Omitting the path scans the current directory.
 | `--only=ids` | Run matching rules; comma-separated and repeatable |
 | `--skip=ids` | Exclude matching rules; comma-separated and repeatable |
 | `--no-config` | Ignore project configuration |
+| `--no-ignore-markers` | Disregard ignore markers in scanned source |
 | `--list-rules` | List rules and limits without scanning; supports `--json` |
 | `--no-excerpts` | Omit source excerpts from every report; preserve findings and exit status |
 | `-h`, `--help` | Show help |
@@ -74,7 +75,7 @@ JSON uses `schemaVersion: 1`, independent of the package version; the npm packag
 
 Save as `.github/workflows/canship.yml` to scan on pushes and pull requests, with a counts-only summary. Scanner installation requires network access; scanning does not. Project dependencies are not installed or executed, and SARIF upload is disabled by default.
 
-The example pins the Action commit and installs npm version `0.2.1`; `version` does not use unreleased repository source. The Action accepts 0.2.1 reports without `schemaVersion`.
+The example pins the Action commit and explicitly installs npm version `0.3.0`; `version` does not use unreleased repository source. The Action accepts 0.2.1 reports without `schemaVersion`.
 
 ```yaml
 name: canship
@@ -89,15 +90,15 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: Tasomei/canship@37cf06e014168968a88679157564e5c489f99c50
+      - uses: Tasomei/canship@8b1a3aa88c77e92e2806b343af6003372855bc70
         with:
-          version: '0.2.1'
+          version: '0.3.0'
 ```
 
 | Input | Default | Meaning |
 |---|---|---|
 | `path` | `.` | Directory within the checkout |
-| `version` | `0.2.1` | Exact npm version; no ranges or tags |
+| `version` | `0.3.0` | Exact npm version; no ranges or tags |
 | `fail-on` | `blocking` | `blocking`: certain P0/P1; `any`: all findings; `none`: findings only reported |
 | `only` / `skip` | unset | Mutually exclusive, comma-separated rule selectors |
 | `baseline` | unset | Existing baseline relative to the scanned directory |
@@ -120,7 +121,7 @@ Place `canship.config.json` in the scanned directory. Supported keys: `baseline`
 }
 ```
 
-CLI options take precedence. `only` and `skip` are mutually exclusive and accept rule IDs or namespaces. Unselected rules do not run; `ruleSelection.removed` counts filtered findings only from executed rules. Use `--no-config` for untrusted projects. `bestEffort` is CLI-only.
+CLI options take precedence. `only` and `skip` are mutually exclusive and accept rule IDs or namespaces. Unselected rules do not run; `ruleSelection.removed` counts filtered findings only from executed rules. For untrusted projects use `--no-config --no-ignore-markers`; the scanned project controls both. `bestEffort` is CLI-only.
 
 ### Ignore markers
 
@@ -131,7 +132,7 @@ A standalone `canship-ignore-file` comment excludes a file; `canship-ignore-next
 const corsOptions = { origin: '*', credentials: true }
 ```
 
-Reports disclose exclusions, rule selection, and baseline suppression. Deliberate exclusions do not mark the scan incomplete.
+Reports disclose exclusions, rule selection, and baseline suppression. Deliberate exclusions do not mark the scan incomplete. Markers can lower the exit code to `0`; `--no-config` does not affect them, `--no-ignore-markers` disables both kinds.
 
 ### Baselines
 

package/dist/cli.js

@@ -779,7 +779,7 @@ function isExampleContext(relPath) {
   if (/\.(test|spec)\.[jt]sx?$/i.test(name)) return true;
   return false;
 }
-function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root), limits = {}) {
+function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root), limits = {}, honorIgnoreMarkers = true) {
   const skipped = [];
   const ignored = [];
   const fromGit = isGitRepo ? listViaGit(root, gitExecutable) : null;
@@ -863,7 +863,7 @@ function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root
       continue;
     }
     const lines = content.split(/\r?\n/);
-    if (hasIgnoreMarker(lines)) {
+    if (honorIgnoreMarkers && hasIgnoreMarker(lines)) {
       ignored.push(relPath);
       continue;
     }
@@ -3453,7 +3453,8 @@ async function scan(root, options = {}) {
   const started = Date.now();
   const gitExecutable = resolveGitExecutable(root);
   const git2 = detectGitRepo(root, gitExecutable);
-  const { files, skipped, ignored, vendored } = collectFiles(root, git2 === "repo", gitExecutable);
+  const honorIgnoreMarkers = options.honorIgnoreMarkers !== false;
+  const { files, skipped, ignored, vendored } = collectFiles(root, git2 === "repo", gitExecutable, {}, honorIgnoreMarkers);
   const findings = [];
   const errors = [];
   const fileRules = FILE_RULES.filter((rule2) => shouldRunRule(rule2.id, options.only ?? [], options.skip ?? []));
@@ -3488,10 +3489,8 @@ async function scan(root, options = {}) {
       errors.push({ ruleId: rule2.id, file: null, message: messageOf(err), kind: "crashed" });
     }
   }
-  const { kept, ignored: ignoredFindings } = suppressIgnoredLines(
-    dedupe(downgradeExampleContext(findings, files)),
-    files
-  );
+  const deduped = dedupe(downgradeExampleContext(findings, files));
+  const { kept, ignored: ignoredFindings } = honorIgnoreMarkers ? suppressIgnoredLines(deduped, files) : { kept: deduped, ignored: [] };
   const selected = applyRuleSelection(kept, options);
   const counts = /* @__PURE__ */ new Map();
   const bounded = sortFindings(selected.kept).filter((finding) => {
@@ -4626,7 +4625,7 @@ function renderRuleCatalog() {
 }
 
 // src/cli.ts
-var VERSION = true ? "0.3.0" : "0.0.0-dev";
+var VERSION = true ? "0.3.1" : "0.0.0-dev";
 function finish(code) {
   process.exitCode = code;
 }
@@ -4691,6 +4690,7 @@ function parseArgs(argv) {
     skip: [],
     sarif: null,
     noConfig: false,
+    noIgnoreMarkers: false,
     help: false,
     version: false,
     listRules: false,
@@ -4759,6 +4759,9 @@ function parseArgs(argv) {
       case "--no-config":
         args.noConfig = true;
         break;
+      case "--no-ignore-markers":
+        args.noIgnoreMarkers = true;
+        break;
       case "--list-rules":
         args.listRules = true;
         break;
@@ -4807,6 +4810,9 @@ var HELP = `
         --sarif[=F]   Write a SARIF 2.1.0 log for CI code scanning
                       (default canship.sarif)
         --no-config   Ignore canship.config.json in the scanned directory
+        --no-ignore-markers
+                      Disregard canship-ignore-file and canship-ignore-next-line
+                      markers; use with --no-config for untrusted projects
         --list-rules  List rule IDs, scope, and limits; add --json for structured output
         --no-excerpts Omit source excerpts from every report; paths and descriptions remain
     -h, --help        Show this help
@@ -4887,7 +4893,7 @@ async function main() {
   const showAll = args.showAll || config.all === true;
   const bestEffort = args.bestEffort;
   const baselinePath = args.baseline !== null ? resolve2(args.baseline) : args.baselineDefault ? resolve2(args.root, DEFAULT_BASELINE_PATH) : config.baseline !== void 0 ? insideProject(args.root, config.baseline) : null;
-  const scanned = await scan(args.root, { only, skip });
+  const scanned = await scan(args.root, { only, skip, honorIgnoreMarkers: !args.noIgnoreMarkers });
   if (args.baselineWrite !== null || args.baselineWriteDefault) {
     const target = args.baselineWrite !== null ? resolve2(args.baselineWrite) : resolve2(args.root, DEFAULT_BASELINE_PATH);
     const baseline = buildBaseline(scanned.findings);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canship",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Static scanner for exposed credentials and open access rules in JS/TS front-end projects. Scans local files without executing project code or making network requests.",
   "keywords": [
     "security",