check-package-lock 1.10.0 → 1.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.editorconfig +16 -16
- package/.gitattributes +8 -0
- package/.github/dependabot.yml +16 -11
- package/.github/workflows/ci.yml +95 -0
- package/.github/workflows/scorecard.yml +51 -0
- package/.linelint.yml +10 -0
- package/LICENSE +21 -21
- package/README.md +46 -46
- package/eslint.config.js +17 -0
- package/index.js +12 -7
- package/package.json +11 -12
- package/renovate.json +6 -0
- package/test/index.js +26 -85
- package/.circleci/config.yml +0 -47
- package/.eslintrc.json +0 -20
package/.editorconfig
CHANGED
|
@@ -1,16 +1,16 @@
|
|
|
1
|
-
; This file is for unifying the coding style for different editors and IDEs.
|
|
2
|
-
; More information at https://editorconfig.org
|
|
3
|
-
|
|
4
|
-
root = true
|
|
5
|
-
|
|
6
|
-
[*]
|
|
7
|
-
charset = utf-8
|
|
8
|
-
end_of_line = lf
|
|
9
|
-
indent_size = 4
|
|
10
|
-
indent_style = space
|
|
11
|
-
insert_final_newline = true
|
|
12
|
-
trim_trailing_whitespace = true
|
|
13
|
-
|
|
14
|
-
[*.yml]
|
|
15
|
-
indent_style = space
|
|
16
|
-
indent_size = 2
|
|
1
|
+
; This file is for unifying the coding style for different editors and IDEs.
|
|
2
|
+
; More information at https://editorconfig.org
|
|
3
|
+
|
|
4
|
+
root = true
|
|
5
|
+
|
|
6
|
+
[*]
|
|
7
|
+
charset = utf-8
|
|
8
|
+
end_of_line = lf
|
|
9
|
+
indent_size = 4
|
|
10
|
+
indent_style = space
|
|
11
|
+
insert_final_newline = true
|
|
12
|
+
trim_trailing_whitespace = true
|
|
13
|
+
|
|
14
|
+
[*.yml]
|
|
15
|
+
indent_style = space
|
|
16
|
+
indent_size = 2
|
package/.gitattributes
ADDED
package/.github/dependabot.yml
CHANGED
|
@@ -1,11 +1,16 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
1
|
+
version: 2
|
|
2
|
+
updates:
|
|
3
|
+
- package-ecosystem: github-actions
|
|
4
|
+
directory: /
|
|
5
|
+
schedule:
|
|
6
|
+
interval: daily
|
|
7
|
+
cooldown:
|
|
8
|
+
default-days: 7
|
|
9
|
+
open-pull-requests-limit: 10
|
|
10
|
+
- package-ecosystem: npm
|
|
11
|
+
directory: /
|
|
12
|
+
schedule:
|
|
13
|
+
interval: daily
|
|
14
|
+
cooldown:
|
|
15
|
+
default-days: 7
|
|
16
|
+
open-pull-requests-limit: 10
|
|
@@ -0,0 +1,95 @@
|
|
|
1
|
+
name: CI
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
|
|
6
|
+
concurrency:
|
|
7
|
+
group: ${{ github.workflow }}-${{ github.ref }}
|
|
8
|
+
cancel-in-progress: true
|
|
9
|
+
|
|
10
|
+
permissions:
|
|
11
|
+
contents: read
|
|
12
|
+
security-events: write
|
|
13
|
+
|
|
14
|
+
jobs:
|
|
15
|
+
build:
|
|
16
|
+
name: Build and Test
|
|
17
|
+
runs-on: ubuntu-latest
|
|
18
|
+
environment: Development
|
|
19
|
+
|
|
20
|
+
steps:
|
|
21
|
+
- name: Harden Runner
|
|
22
|
+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
23
|
+
# https://github.com/step-security/harden-runner/releases
|
|
24
|
+
with:
|
|
25
|
+
egress-policy: audit
|
|
26
|
+
|
|
27
|
+
- name: Checkout repository
|
|
28
|
+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
29
|
+
# https://github.com/actions/checkout/releases
|
|
30
|
+
with:
|
|
31
|
+
persist-credentials: false
|
|
32
|
+
|
|
33
|
+
- name: Run zizmor
|
|
34
|
+
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
|
|
35
|
+
# https://github.com/zizmorcore/zizmor-action/releases
|
|
36
|
+
with:
|
|
37
|
+
persona: pedantic
|
|
38
|
+
env:
|
|
39
|
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
40
|
+
|
|
41
|
+
- name: Run CVE Lite CLI
|
|
42
|
+
uses: OWASP/cve-lite-cli@b4a69139a2f62ec3a9a85782c146ff702055d7f2 # v1.23.1
|
|
43
|
+
# https://github.com/OWASP/cve-lite-cli/releases
|
|
44
|
+
with:
|
|
45
|
+
fail-on: critical
|
|
46
|
+
|
|
47
|
+
- name: Setup Node.js
|
|
48
|
+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
49
|
+
# https://github.com/actions/setup-node/releases
|
|
50
|
+
with:
|
|
51
|
+
node-version: "lts/*"
|
|
52
|
+
cache: npm
|
|
53
|
+
|
|
54
|
+
- name: Install safe-chain
|
|
55
|
+
run: curl --fail --silent --show-error --retry 3 --location https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
|
|
56
|
+
|
|
57
|
+
# this must fail if safe-chain is working
|
|
58
|
+
- name: Test safe-chain
|
|
59
|
+
run: |
|
|
60
|
+
npm safe-chain-verify
|
|
61
|
+
! npm install safe-chain-test
|
|
62
|
+
|
|
63
|
+
- name: Install dependencies
|
|
64
|
+
run: npm ci
|
|
65
|
+
|
|
66
|
+
- name: Run Snyk to check for vulnerabilities
|
|
67
|
+
uses: snyk/actions/node@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
|
|
68
|
+
# https://github.com/snyk/actions/releases
|
|
69
|
+
env:
|
|
70
|
+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
|
71
|
+
|
|
72
|
+
- name: Check line endings
|
|
73
|
+
uses: fernandrone/linelint@7907a5dca0c28ea7dd05c6d8d8cacded713aca11 # 0.0.6
|
|
74
|
+
# https://github.com/fernandrone/linelint/releases
|
|
75
|
+
|
|
76
|
+
- name: Check EOL
|
|
77
|
+
uses: AODocs/check-eol@88fd9052e8ea211254a4de371011026603a329dc # v1.1
|
|
78
|
+
# https://github.com/AODocs/check-eol/releases
|
|
79
|
+
|
|
80
|
+
- name: Lint
|
|
81
|
+
run: ./node_modules/.bin/eslint '*.js' 'test/*.js'
|
|
82
|
+
|
|
83
|
+
- name: Run tests with coverage
|
|
84
|
+
run: ./node_modules/.bin/nyc npm test
|
|
85
|
+
|
|
86
|
+
- name: Generate coverage report
|
|
87
|
+
run: ./node_modules/.bin/nyc report --reporter=text-lcov > coverage.lcov
|
|
88
|
+
|
|
89
|
+
- name: Upload coverage to Codecov
|
|
90
|
+
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
|
|
91
|
+
# https://github.com/codecov/codecov-action/releases
|
|
92
|
+
with:
|
|
93
|
+
fail_ci_if_error: true
|
|
94
|
+
env:
|
|
95
|
+
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
name: Scorecard supply-chain security
|
|
2
|
+
on:
|
|
3
|
+
# For Branch-Protection check. Only the default branch is supported. See
|
|
4
|
+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
|
|
5
|
+
branch_protection_rule:
|
|
6
|
+
# To guarantee Maintained check is occasionally updated. See
|
|
7
|
+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
|
|
8
|
+
schedule:
|
|
9
|
+
- cron: '32 5 * * 0'
|
|
10
|
+
push:
|
|
11
|
+
branches: [ "main" ]
|
|
12
|
+
|
|
13
|
+
# Declare default permissions as read only.
|
|
14
|
+
permissions: read-all
|
|
15
|
+
|
|
16
|
+
jobs:
|
|
17
|
+
analysis:
|
|
18
|
+
name: Scorecard analysis
|
|
19
|
+
runs-on: ubuntu-latest
|
|
20
|
+
# `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
|
|
21
|
+
if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
|
|
22
|
+
permissions:
|
|
23
|
+
security-events: write # Needed to upload the results to code-scanning dashboard.
|
|
24
|
+
id-token: write # Needed to publish results and get a badge (see publish_results below).
|
|
25
|
+
|
|
26
|
+
steps:
|
|
27
|
+
- name: Checkout code
|
|
28
|
+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
29
|
+
with:
|
|
30
|
+
persist-credentials: false
|
|
31
|
+
|
|
32
|
+
- name: Run analysis
|
|
33
|
+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
|
|
34
|
+
with:
|
|
35
|
+
results_file: results.sarif
|
|
36
|
+
results_format: sarif
|
|
37
|
+
publish_results: true
|
|
38
|
+
|
|
39
|
+
- name: Upload artifacts
|
|
40
|
+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
41
|
+
# https://github.com/actions/upload-artifact/releases
|
|
42
|
+
with:
|
|
43
|
+
name: SARIF file
|
|
44
|
+
path: results.sarif
|
|
45
|
+
retention-days: 5
|
|
46
|
+
|
|
47
|
+
- name: Upload to code-scanning
|
|
48
|
+
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
|
|
49
|
+
# https://github.com/github/codeql-action/releases
|
|
50
|
+
with:
|
|
51
|
+
sarif_file: results.sarif
|
package/.linelint.yml
ADDED
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
# list of paths to ignore, uses gitignore syntaxes (executes before any rule)
|
|
2
|
+
ignore:
|
|
3
|
+
- node_modules/
|
|
4
|
+
rules:
|
|
5
|
+
# checks if file ends in a newline character
|
|
6
|
+
end-of-file:
|
|
7
|
+
# set to true to enable this rule
|
|
8
|
+
enable: true
|
|
9
|
+
# if true also checks if file ends in a single newline character
|
|
10
|
+
single-new-line: true
|
package/LICENSE
CHANGED
|
@@ -1,21 +1,21 @@
|
|
|
1
|
-
MIT License
|
|
2
|
-
|
|
3
|
-
Copyright (c) 2019 Henrik Gemal
|
|
4
|
-
|
|
5
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
-
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
-
in the Software without restriction, including without limitation the rights
|
|
8
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
-
furnished to do so, subject to the following conditions:
|
|
11
|
-
|
|
12
|
-
The above copyright notice and this permission notice shall be included in all
|
|
13
|
-
copies or substantial portions of the Software.
|
|
14
|
-
|
|
15
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
-
SOFTWARE.
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2019 Henrik Gemal
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
CHANGED
|
@@ -1,46 +1,46 @@
|
|
|
1
|
-
# check-package-lock
|
|
2
|
-
Checks the package-lock.json file for http:// links
|
|
3
|
-
|
|
4
|
-
## What does it do?
|
|
5
|
-
check-package-lock can check if the package-lock.json file contain insecure http:// links
|
|
6
|
-
|
|
7
|
-
## Usage
|
|
8
|
-
To check the package-lock.json file in the current folder:
|
|
9
|
-
```
|
|
10
|
-
npm install -g check-package-lock
|
|
11
|
-
check-package-lock
|
|
12
|
-
```
|
|
13
|
-
|
|
14
|
-
To check the package-lock.json file in another folder:
|
|
15
|
-
```
|
|
16
|
-
npm install -g check-package-lock
|
|
17
|
-
check-package-lock --folder 'nodefolder'
|
|
18
|
-
```
|
|
19
|
-
|
|
20
|
-
## Exit codes
|
|
21
|
-
```
|
|
22
|
-
0 = No errors
|
|
23
|
-
1 = Errors were founds in the package-lock.json files
|
|
24
|
-
2 = package-lock.json was not found
|
|
25
|
-
3 = Folder specified does not exists
|
|
26
|
-
4 = Folder specified is not a folder
|
|
27
|
-
```
|
|
28
|
-
|
|
29
|
-
## Continuous Integration
|
|
30
|
-
check-package-lock can be used in CI environments to check your package-lock.json file before merging a pull request
|
|
31
|
-
|
|
32
|
-
## Badges
|
|
33
|
-
|
|
34
|
-
[](https://circleci.com/gh/gemal/node-check-package-lock)
|
|
35
|
-
|
|
36
|
-
[](https://codecov.io/gh/gemal/node-check-package-lock)
|
|
37
|
-
|
|
38
|
-
[](https://github.styleci.io/repos/183420925)
|
|
39
|
-
|
|
40
|
-
[](https://snyk.io/test/github/gemal/node-check-package-lock)
|
|
41
|
-
|
|
42
|
-
[](https://lgtm.com/projects/g/gemal/node-check-package-lock/alerts/)
|
|
43
|
-
|
|
44
|
-
[](https://www.codefactor.io/repository/github/gemal/node-check-package-lock)
|
|
45
|
-
|
|
46
|
-
[](https://deepscan.io/dashboard#view=project&tid=14204&pid=17307&bid=392368)
|
|
1
|
+
# check-package-lock
|
|
2
|
+
Checks the package-lock.json file for http:// links
|
|
3
|
+
|
|
4
|
+
## What does it do?
|
|
5
|
+
check-package-lock can check if the package-lock.json file contain insecure http:// links
|
|
6
|
+
|
|
7
|
+
## Usage
|
|
8
|
+
To check the package-lock.json file in the current folder:
|
|
9
|
+
```
|
|
10
|
+
npm install -g check-package-lock
|
|
11
|
+
check-package-lock
|
|
12
|
+
```
|
|
13
|
+
|
|
14
|
+
To check the package-lock.json file in another folder:
|
|
15
|
+
```
|
|
16
|
+
npm install -g check-package-lock
|
|
17
|
+
check-package-lock --folder 'nodefolder'
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
## Exit codes
|
|
21
|
+
```
|
|
22
|
+
0 = No errors
|
|
23
|
+
1 = Errors were founds in the package-lock.json files
|
|
24
|
+
2 = package-lock.json was not found
|
|
25
|
+
3 = Folder specified does not exists
|
|
26
|
+
4 = Folder specified is not a folder
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
## CI - Continuous Integration
|
|
30
|
+
check-package-lock can be used in CI environments to check your package-lock.json file before merging a pull request
|
|
31
|
+
|
|
32
|
+
## Badges
|
|
33
|
+
|
|
34
|
+
[](https://circleci.com/gh/gemal/node-check-package-lock)
|
|
35
|
+
|
|
36
|
+
[](https://codecov.io/gh/gemal/node-check-package-lock)
|
|
37
|
+
|
|
38
|
+
[](https://github.styleci.io/repos/183420925)
|
|
39
|
+
|
|
40
|
+
[](https://snyk.io/test/github/gemal/node-check-package-lock)
|
|
41
|
+
|
|
42
|
+
[](https://lgtm.com/projects/g/gemal/node-check-package-lock/alerts/)
|
|
43
|
+
|
|
44
|
+
[](https://www.codefactor.io/repository/github/gemal/node-check-package-lock)
|
|
45
|
+
|
|
46
|
+
[](https://deepscan.io/dashboard#view=project&tid=14204&pid=17307&bid=392368)
|
package/eslint.config.js
ADDED
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
import globals from "globals";
|
|
2
|
+
import js from "@eslint/js";
|
|
3
|
+
|
|
4
|
+
|
|
5
|
+
export default [
|
|
6
|
+
{
|
|
7
|
+
languageOptions: {
|
|
8
|
+
globals: {
|
|
9
|
+
process: "readonly",
|
|
10
|
+
describe: "readonly",
|
|
11
|
+
it: "readonly",
|
|
12
|
+
...globals.browser
|
|
13
|
+
}
|
|
14
|
+
}
|
|
15
|
+
},
|
|
16
|
+
js.configs.recommended,
|
|
17
|
+
];
|
package/index.js
CHANGED
|
@@ -2,9 +2,14 @@
|
|
|
2
2
|
|
|
3
3
|
'use strict';
|
|
4
4
|
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
5
|
+
import fs from 'fs';
|
|
6
|
+
import path from 'path';
|
|
7
|
+
import { program } from 'commander';
|
|
8
|
+
import { fileURLToPath } from 'url';
|
|
9
|
+
|
|
10
|
+
// Define __filename and __dirname for ES modules
|
|
11
|
+
const __filename = fileURLToPath(import.meta.url);
|
|
12
|
+
const __dirname = path.dirname(__filename);
|
|
8
13
|
|
|
9
14
|
/**
|
|
10
15
|
* Check a folder.
|
|
@@ -17,7 +22,7 @@ function checkFolder() {
|
|
|
17
22
|
}
|
|
18
23
|
const pack = fullpath + 'package-lock.json';
|
|
19
24
|
if (fs.existsSync(pack)) {
|
|
20
|
-
const filecontent = fs.readFileSync(pack, {encoding: 'utf-8'});
|
|
25
|
+
const filecontent = fs.readFileSync(pack, { encoding: 'utf-8' });
|
|
21
26
|
if (filecontent.indexOf('http://registry.npmjs.org') > -1) { // lgtm [js/incomplete-url-substring-sanitization]
|
|
22
27
|
console.log(pack + ' is NOT OK. It contains references to http://registry.npmjs.org');
|
|
23
28
|
console.log('In order to fix this do:');
|
|
@@ -31,13 +36,13 @@ function checkFolder() {
|
|
|
31
36
|
return 0;
|
|
32
37
|
}
|
|
33
38
|
} else {
|
|
34
|
-
console.log(pack + ' does not
|
|
39
|
+
console.log(pack + ' does not exist');
|
|
35
40
|
return 2;
|
|
36
41
|
}
|
|
37
42
|
}
|
|
38
43
|
|
|
39
44
|
program
|
|
40
|
-
.version(
|
|
45
|
+
.version(JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'))).version)
|
|
41
46
|
.description('Checks the package-lock.json file for http:// links')
|
|
42
47
|
.option('-f, --folder <folder>', 'Folder with package-lock.json file')
|
|
43
48
|
.parse(process.argv);
|
|
@@ -54,7 +59,7 @@ if (options.folder) {
|
|
|
54
59
|
process.exitCode = 4;
|
|
55
60
|
}
|
|
56
61
|
} else {
|
|
57
|
-
console.log('Oops! Folder does not
|
|
62
|
+
console.log('Oops! Folder does not exist: ' + options.folder);
|
|
58
63
|
process.exitCode = 3;
|
|
59
64
|
}
|
|
60
65
|
} else {
|
package/package.json
CHANGED
|
@@ -1,16 +1,17 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "check-package-lock",
|
|
3
|
-
"version": "1.
|
|
4
|
-
"description": "Checks the package-lock.json file for http:// links",
|
|
3
|
+
"version": "1.12.0",
|
|
4
|
+
"description": "Checks the package-lock.json file for insecure http:// links",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"repository": {
|
|
7
7
|
"type": "git",
|
|
8
|
-
"url": "https://github.com/gemal/node-check-package-lock"
|
|
8
|
+
"url": "https://github.com/gemal/node-check-package-lock.git"
|
|
9
9
|
},
|
|
10
10
|
"scripts": {
|
|
11
11
|
"test": "mocha"
|
|
12
12
|
},
|
|
13
|
-
"
|
|
13
|
+
"type": "module",
|
|
14
|
+
"author": "Henrik Gemal <henrik@gemal.dk> (https://gemal.dk/)",
|
|
14
15
|
"license": "MIT",
|
|
15
16
|
"bin": {
|
|
16
17
|
"check-package-lock": "index.js"
|
|
@@ -30,18 +31,16 @@
|
|
|
30
31
|
],
|
|
31
32
|
"homepage": "https://github.com/gemal/node-check-package-lock",
|
|
32
33
|
"dependencies": {
|
|
33
|
-
"commander": "^
|
|
34
|
+
"commander": "^12.1.0"
|
|
34
35
|
},
|
|
35
36
|
"devDependencies": {
|
|
36
|
-
"
|
|
37
|
+
"@eslint/js": "^9.13.0",
|
|
38
|
+
"chai": "^5.1.2",
|
|
37
39
|
"child_process": "^1.0.2",
|
|
38
|
-
"
|
|
39
|
-
"eslint": "^8.8.0",
|
|
40
|
-
"eslint-config-google": "^0.14.0",
|
|
40
|
+
"eslint": "^9.13.0",
|
|
41
41
|
"expect": "^29.2.2",
|
|
42
|
-
"
|
|
42
|
+
"globals": "^15.11.0",
|
|
43
43
|
"mocha": "^10.0.0",
|
|
44
|
-
"nyc": "^
|
|
45
|
-
"snyk": "^1.594.0"
|
|
44
|
+
"nyc": "^17.1.0"
|
|
46
45
|
}
|
|
47
46
|
}
|
package/renovate.json
ADDED
package/test/index.js
CHANGED
|
@@ -1,115 +1,56 @@
|
|
|
1
|
-
|
|
1
|
+
import { expect } from 'chai';
|
|
2
|
+
import path from 'path';
|
|
3
|
+
import { exec } from "node:child_process";
|
|
4
|
+
import { fileURLToPath } from 'url';
|
|
2
5
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
const
|
|
6
|
-
const path = require('path');
|
|
7
|
-
const spawn = require('child_process').spawn;
|
|
8
|
-
const expect = require('chai').expect;
|
|
6
|
+
// Define __filename and __dirname in ES modules
|
|
7
|
+
const __filename = fileURLToPath(import.meta.url);
|
|
8
|
+
const __dirname = path.dirname(__filename);
|
|
9
9
|
|
|
10
10
|
describe('index.js', function() {
|
|
11
|
-
// eslint-disable-next-line no-invalid-this
|
|
12
11
|
this.timeout(8000);
|
|
13
12
|
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
13
|
+
function runTest(args, expectedExitCode, expectedOutput, done) {
|
|
14
|
+
const command = `node ${path.join(__dirname, '../index.js')} ${args.join(' ')}`;
|
|
15
|
+
exec(command, { cwd: path.join(__dirname, '../') }, (error, stdout) => {
|
|
16
|
+
if (error) {
|
|
17
|
+
expect(error.code).to.equal(expectedExitCode);
|
|
18
|
+
} else {
|
|
19
|
+
expect(stdout).to.match(expectedOutput);
|
|
20
|
+
}
|
|
22
21
|
done();
|
|
23
|
-
}).stdout.on('data', function(data) {
|
|
24
|
-
out += data;
|
|
25
22
|
});
|
|
23
|
+
}
|
|
24
|
+
|
|
25
|
+
it('should exit 1 having problems', function(done) {
|
|
26
|
+
runTest(['--folder', 'test/test1'], 1, /package-lock.json is NOT OK/, done);
|
|
26
27
|
});
|
|
27
28
|
|
|
28
29
|
it('should exit 0 having no problems', function(done) {
|
|
29
|
-
|
|
30
|
-
spawn('node', [path.join(__dirname, '../index.js'), '--folder', 'test/test2'], {
|
|
31
|
-
cwd: path.join(__dirname, '../'),
|
|
32
|
-
}).on('exit', function(code) {
|
|
33
|
-
assert.strictEqual(code, 0);
|
|
34
|
-
expect(out).to.match(/package-lock.json is OK/);
|
|
35
|
-
done();
|
|
36
|
-
}).stdout.on('data', function(data) {
|
|
37
|
-
out += data;
|
|
38
|
-
});
|
|
30
|
+
runTest(['--folder', 'test/test2'], 0, /package-lock.json is OK/, done);
|
|
39
31
|
});
|
|
40
32
|
|
|
41
33
|
it('should exit 0 having no problems with slash', function(done) {
|
|
42
|
-
|
|
43
|
-
spawn('node', [path.join(__dirname, '../index.js'), '--folder', 'test/test2/'], {
|
|
44
|
-
cwd: path.join(__dirname, '../'),
|
|
45
|
-
}).on('exit', function(code) {
|
|
46
|
-
assert.strictEqual(code, 0);
|
|
47
|
-
expect(out).to.match(/package-lock.json is OK/);
|
|
48
|
-
done();
|
|
49
|
-
}).stdout.on('data', function(data) {
|
|
50
|
-
out += data;
|
|
51
|
-
});
|
|
34
|
+
runTest(['--folder', 'test/test2/'], 0, /package-lock.json is OK/, done);
|
|
52
35
|
});
|
|
53
36
|
|
|
54
37
|
it('should exit 0 having no problems without folder', function(done) {
|
|
55
|
-
|
|
56
|
-
spawn('node', [path.join(__dirname, '../index.js')], {
|
|
57
|
-
cwd: path.join(__dirname, '../'),
|
|
58
|
-
}).on('exit', function(code) {
|
|
59
|
-
assert.strictEqual(code, 0);
|
|
60
|
-
expect(out).to.match(/package-lock.json is OK/);
|
|
61
|
-
done();
|
|
62
|
-
}).stdout.on('data', function(data) {
|
|
63
|
-
out += data;
|
|
64
|
-
});
|
|
38
|
+
runTest([], 0, /package-lock.json is OK/, done);
|
|
65
39
|
});
|
|
66
40
|
|
|
67
41
|
it('should exit 1 having problems', function(done) {
|
|
68
|
-
|
|
69
|
-
spawn('node', [path.join(__dirname, '../index.js'), '--folder', 'test/test3'], {
|
|
70
|
-
cwd: path.join(__dirname, '../'),
|
|
71
|
-
}).on('exit', function(code) {
|
|
72
|
-
assert.strictEqual(code, 1);
|
|
73
|
-
expect(out).to.match(/package-lock.json is NOT OK/);
|
|
74
|
-
expect(out).to.match(/Delete the node_modules folder/);
|
|
75
|
-
done();
|
|
76
|
-
}).stdout.on('data', function(data) {
|
|
77
|
-
out += data;
|
|
78
|
-
});
|
|
42
|
+
runTest(['--folder', 'test/test3'], 1, /package-lock.json is NOT OK/, done);
|
|
79
43
|
});
|
|
80
44
|
|
|
81
45
|
it('should exit 1 having problems with no file', function(done) {
|
|
82
|
-
|
|
83
|
-
spawn('node', [path.join(__dirname, '../index.js'), '--folder', 'test'], {
|
|
84
|
-
cwd: path.join(__dirname, '../'),
|
|
85
|
-
}).on('exit', function(code) {
|
|
86
|
-
assert.strictEqual(code, 2);
|
|
87
|
-
expect(out).to.match(/package-lock.json does not exists/);
|
|
88
|
-
done();
|
|
89
|
-
}).stdout.on('data', function(data) {
|
|
90
|
-
out += data;
|
|
91
|
-
});
|
|
46
|
+
runTest(['--folder', 'test'], 2, /package-lock.json does not exists/, done);
|
|
92
47
|
});
|
|
93
48
|
|
|
94
49
|
it('should exit 3 if folder does not exist', function(done) {
|
|
95
|
-
|
|
96
|
-
cwd: path.join(__dirname, '../'),
|
|
97
|
-
}).on('exit', function(code) {
|
|
98
|
-
assert.strictEqual(code, 3);
|
|
99
|
-
}).stdout.on('data', function(data) {
|
|
100
|
-
assert.strictEqual(data.toString(), 'Oops! Folder does not exists: 404\n');
|
|
101
|
-
done();
|
|
102
|
-
});
|
|
50
|
+
runTest(['--folder', '404'], 3, /Oops! Folder does not exists: 404\n/, done);
|
|
103
51
|
});
|
|
104
52
|
|
|
105
53
|
it('should exit 4 if folder is not a folder', function(done) {
|
|
106
|
-
|
|
107
|
-
cwd: path.join(__dirname, '../'),
|
|
108
|
-
}).on('exit', function(code) {
|
|
109
|
-
assert.strictEqual(code, 4);
|
|
110
|
-
}).stdout.on('data', function(data) {
|
|
111
|
-
assert.strictEqual(data.toString(), 'Oops! Folder is not a real folder: test/index.js\n');
|
|
112
|
-
done();
|
|
113
|
-
});
|
|
54
|
+
runTest(['--folder', 'test/index.js'], 4, /Oops! Folder is not a real folder: test\/index.js\n/, done);
|
|
114
55
|
});
|
|
115
56
|
});
|
package/.circleci/config.yml
DELETED
|
@@ -1,47 +0,0 @@
|
|
|
1
|
-
version: 2
|
|
2
|
-
jobs:
|
|
3
|
-
build:
|
|
4
|
-
docker:
|
|
5
|
-
# Use node image
|
|
6
|
-
- image: circleci/node
|
|
7
|
-
|
|
8
|
-
# code folder
|
|
9
|
-
working_directory: ~/repo
|
|
10
|
-
|
|
11
|
-
steps:
|
|
12
|
-
# check out code
|
|
13
|
-
- checkout
|
|
14
|
-
|
|
15
|
-
# restore cache dependencies
|
|
16
|
-
- restore_cache:
|
|
17
|
-
keys:
|
|
18
|
-
- v1-dependencies-{{ checksum "package.json" }}
|
|
19
|
-
# fallback to using the latest cache if no exact match is found
|
|
20
|
-
- v1-dependencies-
|
|
21
|
-
|
|
22
|
-
# install and cache packages
|
|
23
|
-
- run: npm install
|
|
24
|
-
- save_cache:
|
|
25
|
-
paths:
|
|
26
|
-
- node_modules
|
|
27
|
-
key: v1-dependencies-{{ checksum "package.json" }}
|
|
28
|
-
|
|
29
|
-
# audit the packages
|
|
30
|
-
- run: npm audit
|
|
31
|
-
- run: npm ls
|
|
32
|
-
|
|
33
|
-
# security test
|
|
34
|
-
- run: ./node_modules/.bin/snyk test
|
|
35
|
-
|
|
36
|
-
# correct line endings
|
|
37
|
-
- run: find ./ -path ./node_modules -prune -o -name '*.css' -o -name '*.json' -o -name '*.md' -o -name '*.js' -o -name '*.yml' | xargs ./node_modules/.bin/lintspaces --endofline 'lf' --newline --trailingspaces --verbose
|
|
38
|
-
|
|
39
|
-
# lint
|
|
40
|
-
- run: ./node_modules/.bin/eslint '*.js' 'test/*.js'
|
|
41
|
-
|
|
42
|
-
# run tests
|
|
43
|
-
- run: ./node_modules/.bin/nyc npm test
|
|
44
|
-
|
|
45
|
-
# upload code coverage
|
|
46
|
-
- run: ./node_modules/.bin/nyc report --reporter=text-lcov > coverage.lcov
|
|
47
|
-
- run: ./node_modules/.bin/codecov
|
package/.eslintrc.json
DELETED
|
@@ -1,20 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"env": {
|
|
3
|
-
"es6": true,
|
|
4
|
-
"node": true
|
|
5
|
-
},
|
|
6
|
-
"extends": ["eslint:recommended", "google"],
|
|
7
|
-
"globals": {
|
|
8
|
-
"Atomics": "readonly",
|
|
9
|
-
"SharedArrayBuffer": "readonly",
|
|
10
|
-
"it": true,
|
|
11
|
-
"describe": true
|
|
12
|
-
},
|
|
13
|
-
"parserOptions": {
|
|
14
|
-
"ecmaVersion": 2018
|
|
15
|
-
},
|
|
16
|
-
"rules": {
|
|
17
|
-
"max-len": ["error", {"code": 120}],
|
|
18
|
-
"indent": ["error", 4]
|
|
19
|
-
}
|
|
20
|
-
}
|