check-package-lock 1.11.0 → 1.13.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude/settings.local.json +9 -0
- package/.editorconfig +16 -16
- package/.gitattributes +8 -0
- package/.github/dependabot.yml +16 -11
- package/.github/workflows/ci.yml +96 -0
- package/.github/workflows/scorecard.yml +55 -0
- package/.linelint.yml +10 -0
- package/LICENSE +21 -22
- package/README.md +42 -46
- package/index.js +49 -68
- package/package.json +47 -49
- package/renovate.json +6 -0
- package/test/index.js +52 -56
- package/.circleci/config.yml +0 -47
- package/.eslintrc.json +0 -20
package/.editorconfig
CHANGED
|
@@ -1,16 +1,16 @@
|
|
|
1
|
-
; This file is for unifying the coding style for different editors and IDEs.
|
|
2
|
-
; More information at https://editorconfig.org
|
|
3
|
-
|
|
4
|
-
root = true
|
|
5
|
-
|
|
6
|
-
[*]
|
|
7
|
-
charset = utf-8
|
|
8
|
-
end_of_line = lf
|
|
9
|
-
indent_size = 4
|
|
10
|
-
indent_style = space
|
|
11
|
-
insert_final_newline = true
|
|
12
|
-
trim_trailing_whitespace = true
|
|
13
|
-
|
|
14
|
-
[*.yml]
|
|
15
|
-
indent_style = space
|
|
16
|
-
indent_size = 2
|
|
1
|
+
; This file is for unifying the coding style for different editors and IDEs.
|
|
2
|
+
; More information at https://editorconfig.org
|
|
3
|
+
|
|
4
|
+
root = true
|
|
5
|
+
|
|
6
|
+
[*]
|
|
7
|
+
charset = utf-8
|
|
8
|
+
end_of_line = lf
|
|
9
|
+
indent_size = 4
|
|
10
|
+
indent_style = space
|
|
11
|
+
insert_final_newline = true
|
|
12
|
+
trim_trailing_whitespace = true
|
|
13
|
+
|
|
14
|
+
[*.yml]
|
|
15
|
+
indent_style = space
|
|
16
|
+
indent_size = 2
|
package/.gitattributes
ADDED
package/.github/dependabot.yml
CHANGED
|
@@ -1,11 +1,16 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
1
|
+
version: 2
|
|
2
|
+
updates:
|
|
3
|
+
- package-ecosystem: github-actions
|
|
4
|
+
directory: /
|
|
5
|
+
schedule:
|
|
6
|
+
interval: daily
|
|
7
|
+
cooldown:
|
|
8
|
+
default-days: 7
|
|
9
|
+
open-pull-requests-limit: 10
|
|
10
|
+
- package-ecosystem: npm
|
|
11
|
+
directory: /
|
|
12
|
+
schedule:
|
|
13
|
+
interval: daily
|
|
14
|
+
cooldown:
|
|
15
|
+
default-days: 7
|
|
16
|
+
open-pull-requests-limit: 10
|
|
@@ -0,0 +1,96 @@
|
|
|
1
|
+
name: CI
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
|
|
6
|
+
concurrency:
|
|
7
|
+
group: ${{ github.workflow }}-${{ github.ref }}
|
|
8
|
+
cancel-in-progress: true
|
|
9
|
+
|
|
10
|
+
permissions: {}
|
|
11
|
+
|
|
12
|
+
jobs:
|
|
13
|
+
build:
|
|
14
|
+
name: Build and Test
|
|
15
|
+
runs-on: ubuntu-latest
|
|
16
|
+
environment: Development
|
|
17
|
+
permissions:
|
|
18
|
+
contents: read
|
|
19
|
+
security-events: write # to report vulnerabilities
|
|
20
|
+
|
|
21
|
+
steps:
|
|
22
|
+
- name: Harden Runner
|
|
23
|
+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
24
|
+
# https://github.com/step-security/harden-runner/releases
|
|
25
|
+
with:
|
|
26
|
+
egress-policy: audit
|
|
27
|
+
|
|
28
|
+
- name: Checkout repository
|
|
29
|
+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
30
|
+
# https://github.com/actions/checkout/releases
|
|
31
|
+
with:
|
|
32
|
+
persist-credentials: false
|
|
33
|
+
|
|
34
|
+
- name: Run zizmor
|
|
35
|
+
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
|
|
36
|
+
# https://github.com/zizmorcore/zizmor-action/releases
|
|
37
|
+
with:
|
|
38
|
+
persona: pedantic
|
|
39
|
+
env:
|
|
40
|
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
41
|
+
|
|
42
|
+
- name: Run CVE Lite CLI
|
|
43
|
+
uses: OWASP/cve-lite-cli@b4a69139a2f62ec3a9a85782c146ff702055d7f2 # v1.23.1
|
|
44
|
+
# https://github.com/OWASP/cve-lite-cli/releases
|
|
45
|
+
with:
|
|
46
|
+
fail-on: critical
|
|
47
|
+
|
|
48
|
+
- name: Setup Node.js
|
|
49
|
+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
50
|
+
# https://github.com/actions/setup-node/releases
|
|
51
|
+
with:
|
|
52
|
+
node-version: "lts/*"
|
|
53
|
+
cache: npm
|
|
54
|
+
|
|
55
|
+
- name: Install safe-chain
|
|
56
|
+
run: curl --fail --silent --show-error --retry 3 --location https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
|
|
57
|
+
|
|
58
|
+
# this must fail if safe-chain is working
|
|
59
|
+
- name: Test safe-chain
|
|
60
|
+
run: |
|
|
61
|
+
npm safe-chain-verify
|
|
62
|
+
! npm install safe-chain-test
|
|
63
|
+
|
|
64
|
+
- name: Install dependencies
|
|
65
|
+
run: npm ci
|
|
66
|
+
|
|
67
|
+
- name: Run Snyk to check for vulnerabilities
|
|
68
|
+
uses: snyk/actions/node@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
|
|
69
|
+
# https://github.com/snyk/actions/releases
|
|
70
|
+
env:
|
|
71
|
+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
|
72
|
+
|
|
73
|
+
- name: Check line endings
|
|
74
|
+
uses: fernandrone/linelint@7907a5dca0c28ea7dd05c6d8d8cacded713aca11 # 0.0.6
|
|
75
|
+
# https://github.com/fernandrone/linelint/releases
|
|
76
|
+
|
|
77
|
+
- name: Check EOL
|
|
78
|
+
uses: AODocs/check-eol@88fd9052e8ea211254a4de371011026603a329dc # v1.1
|
|
79
|
+
# https://github.com/AODocs/check-eol/releases
|
|
80
|
+
|
|
81
|
+
- name: Lint
|
|
82
|
+
run: ./node_modules/.bin/eslint '*.js' 'test/*.js'
|
|
83
|
+
|
|
84
|
+
- name: Run tests with coverage
|
|
85
|
+
run: ./node_modules/.bin/nyc npm test
|
|
86
|
+
|
|
87
|
+
- name: Generate coverage report
|
|
88
|
+
run: ./node_modules/.bin/nyc report --reporter=text-lcov > coverage.lcov
|
|
89
|
+
|
|
90
|
+
- name: Upload coverage to Codecov
|
|
91
|
+
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
|
|
92
|
+
# https://github.com/codecov/codecov-action/releases
|
|
93
|
+
with:
|
|
94
|
+
fail_ci_if_error: true
|
|
95
|
+
env:
|
|
96
|
+
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|
|
@@ -0,0 +1,55 @@
|
|
|
1
|
+
name: Scorecard supply-chain security
|
|
2
|
+
on:
|
|
3
|
+
# For Branch-Protection check. Only the default branch is supported. See
|
|
4
|
+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
|
|
5
|
+
branch_protection_rule:
|
|
6
|
+
# To guarantee Maintained check is occasionally updated. See
|
|
7
|
+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
|
|
8
|
+
schedule:
|
|
9
|
+
- cron: '32 5 * * 0'
|
|
10
|
+
push:
|
|
11
|
+
branches: [ "main" ]
|
|
12
|
+
|
|
13
|
+
concurrency:
|
|
14
|
+
group: ${{ github.workflow }}-${{ github.ref }}
|
|
15
|
+
cancel-in-progress: true
|
|
16
|
+
|
|
17
|
+
# Declare default permissions as read only.
|
|
18
|
+
permissions: {}
|
|
19
|
+
|
|
20
|
+
jobs:
|
|
21
|
+
analysis:
|
|
22
|
+
name: Scorecard analysis
|
|
23
|
+
runs-on: ubuntu-latest
|
|
24
|
+
# `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
|
|
25
|
+
if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
|
|
26
|
+
permissions:
|
|
27
|
+
security-events: write # Needed to upload the results to code-scanning dashboard.
|
|
28
|
+
id-token: write # Needed to publish results and get a badge (see publish_results below).
|
|
29
|
+
|
|
30
|
+
steps:
|
|
31
|
+
- name: Checkout code
|
|
32
|
+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
33
|
+
with:
|
|
34
|
+
persist-credentials: false
|
|
35
|
+
|
|
36
|
+
- name: Run analysis
|
|
37
|
+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
|
|
38
|
+
with:
|
|
39
|
+
results_file: results.sarif
|
|
40
|
+
results_format: sarif
|
|
41
|
+
publish_results: true
|
|
42
|
+
|
|
43
|
+
- name: Upload artifacts
|
|
44
|
+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
45
|
+
# https://github.com/actions/upload-artifact/releases
|
|
46
|
+
with:
|
|
47
|
+
name: SARIF file
|
|
48
|
+
path: results.sarif
|
|
49
|
+
retention-days: 5
|
|
50
|
+
|
|
51
|
+
- name: Upload to code-scanning
|
|
52
|
+
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
|
|
53
|
+
# https://github.com/github/codeql-action/releases
|
|
54
|
+
with:
|
|
55
|
+
sarif_file: results.sarif
|
package/.linelint.yml
ADDED
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
# list of paths to ignore, uses gitignore syntaxes (executes before any rule)
|
|
2
|
+
ignore:
|
|
3
|
+
- node_modules/
|
|
4
|
+
rules:
|
|
5
|
+
# checks if file ends in a newline character
|
|
6
|
+
end-of-file:
|
|
7
|
+
# set to true to enable this rule
|
|
8
|
+
enable: true
|
|
9
|
+
# if true also checks if file ends in a single newline character
|
|
10
|
+
single-new-line: true
|
package/LICENSE
CHANGED
|
@@ -1,22 +1,21 @@
|
|
|
1
|
-
MIT License
|
|
2
|
-
|
|
3
|
-
Copyright (c) 2019 Henrik Gemal
|
|
4
|
-
|
|
5
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
-
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
-
in the Software without restriction, including without limitation the rights
|
|
8
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
-
furnished to do so, subject to the following conditions:
|
|
11
|
-
|
|
12
|
-
The above copyright notice and this permission notice shall be included in all
|
|
13
|
-
copies or substantial portions of the Software.
|
|
14
|
-
|
|
15
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
-
SOFTWARE.
|
|
22
|
-
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2019 Henrik Gemal
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
CHANGED
|
@@ -1,46 +1,42 @@
|
|
|
1
|
-
# check-package-lock
|
|
2
|
-
Checks the package-lock.json file for http:// links
|
|
3
|
-
|
|
4
|
-
## What does it do?
|
|
5
|
-
check-package-lock can check if the package-lock.json file contain insecure http:// links
|
|
6
|
-
|
|
7
|
-
## Usage
|
|
8
|
-
To check the package-lock.json file in the current folder:
|
|
9
|
-
```
|
|
10
|
-
npm install -g check-package-lock
|
|
11
|
-
check-package-lock
|
|
12
|
-
```
|
|
13
|
-
|
|
14
|
-
To check the package-lock.json file in another folder:
|
|
15
|
-
```
|
|
16
|
-
npm install -g check-package-lock
|
|
17
|
-
check-package-lock --folder 'nodefolder'
|
|
18
|
-
```
|
|
19
|
-
|
|
20
|
-
## Exit codes
|
|
21
|
-
```
|
|
22
|
-
0 = No errors
|
|
23
|
-
1 = Errors were founds in the package-lock.json files
|
|
24
|
-
2 = package-lock.json was not found
|
|
25
|
-
3 = Folder specified does not exists
|
|
26
|
-
4 = Folder specified is not a folder
|
|
27
|
-
```
|
|
28
|
-
|
|
29
|
-
## CI - Continuous Integration
|
|
30
|
-
check-package-lock can be used in CI environments to check your package-lock.json file before merging a pull request
|
|
31
|
-
|
|
32
|
-
## Badges
|
|
33
|
-
|
|
34
|
-
[](https://www.codefactor.io/repository/github/gemal/node-check-package-lock)
|
|
45
|
-
|
|
46
|
-
[](https://deepscan.io/dashboard#view=project&tid=14204&pid=17307&bid=392368)
|
|
1
|
+
# check-package-lock
|
|
2
|
+
Checks the package-lock.json file for http:// links
|
|
3
|
+
|
|
4
|
+
## What does it do?
|
|
5
|
+
check-package-lock can check if the package-lock.json file contain insecure http:// links
|
|
6
|
+
|
|
7
|
+
## Usage
|
|
8
|
+
To check the package-lock.json file in the current folder:
|
|
9
|
+
```
|
|
10
|
+
npm install -g check-package-lock
|
|
11
|
+
check-package-lock
|
|
12
|
+
```
|
|
13
|
+
|
|
14
|
+
To check the package-lock.json file in another folder:
|
|
15
|
+
```
|
|
16
|
+
npm install -g check-package-lock
|
|
17
|
+
check-package-lock --folder 'nodefolder'
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
## Exit codes
|
|
21
|
+
```
|
|
22
|
+
0 = No errors
|
|
23
|
+
1 = Errors were founds in the package-lock.json files
|
|
24
|
+
2 = package-lock.json was not found
|
|
25
|
+
3 = Folder specified does not exists
|
|
26
|
+
4 = Folder specified is not a folder
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
## CI - Continuous Integration
|
|
30
|
+
check-package-lock can be used in CI environments to check your package-lock.json file before merging a pull request
|
|
31
|
+
|
|
32
|
+
## Badges
|
|
33
|
+
|
|
34
|
+
[](https://codecov.io/gh/gemal/node-check-package-lock)
|
|
35
|
+
|
|
36
|
+
[](https://github.styleci.io/repos/183420925)
|
|
37
|
+
|
|
38
|
+
[](https://snyk.io/test/github/gemal/node-check-package-lock)
|
|
39
|
+
|
|
40
|
+
[](https://www.codefactor.io/repository/github/gemal/node-check-package-lock)
|
|
41
|
+
|
|
42
|
+
[](https://deepscan.io/dashboard#view=project&tid=14204&pid=17307&bid=392368)
|
package/index.js
CHANGED
|
@@ -1,68 +1,49 @@
|
|
|
1
|
-
#!/usr/bin/env node
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
import
|
|
6
|
-
import
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
const
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
console.log(
|
|
40
|
-
|
|
41
|
-
}
|
|
42
|
-
}
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
.
|
|
49
|
-
|
|
50
|
-
const options = program.opts();
|
|
51
|
-
if (options.folder) {
|
|
52
|
-
if (fs.existsSync(options.folder)) {
|
|
53
|
-
const stats = fs.statSync(options.folder);
|
|
54
|
-
if (stats.isDirectory()) {
|
|
55
|
-
const err = checkFolder();
|
|
56
|
-
process.exitCode = err;
|
|
57
|
-
} else {
|
|
58
|
-
console.log('Oops! Folder is not a real folder: ' + options.folder);
|
|
59
|
-
process.exitCode = 4;
|
|
60
|
-
}
|
|
61
|
-
} else {
|
|
62
|
-
console.log('Oops! Folder does not exist: ' + options.folder);
|
|
63
|
-
process.exitCode = 3;
|
|
64
|
-
}
|
|
65
|
-
} else {
|
|
66
|
-
const err = checkFolder();
|
|
67
|
-
process.exitCode = err;
|
|
68
|
-
}
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
|
|
3
|
+
import fs from 'node:fs';
|
|
4
|
+
import path from 'node:path';
|
|
5
|
+
import { program } from 'commander';
|
|
6
|
+
import { fileURLToPath } from 'node:url';
|
|
7
|
+
|
|
8
|
+
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
9
|
+
|
|
10
|
+
function checkFolder(folder) {
|
|
11
|
+
const packPath = folder ? path.join(folder, 'package-lock.json') : 'package-lock.json';
|
|
12
|
+
if (!fs.existsSync(packPath)) {
|
|
13
|
+
console.log(`${packPath} does not exist`);
|
|
14
|
+
return 2;
|
|
15
|
+
}
|
|
16
|
+
const filecontent = fs.readFileSync(packPath, { encoding: 'utf-8' });
|
|
17
|
+
if (/"http:\/\/registry\.npmjs\.org[/"']/.test(filecontent)) {
|
|
18
|
+
console.log(`${packPath} is NOT OK. It contains references to http://registry.npmjs.org`);
|
|
19
|
+
console.log('In order to fix this do:');
|
|
20
|
+
console.log('- Delete the package-lock.json file');
|
|
21
|
+
console.log('- Delete the node_modules folder');
|
|
22
|
+
console.log('- Run <npm cache clean --force>');
|
|
23
|
+
console.log('- Run <npm install>');
|
|
24
|
+
return 1;
|
|
25
|
+
}
|
|
26
|
+
console.log(`${packPath} is OK`);
|
|
27
|
+
return 0;
|
|
28
|
+
}
|
|
29
|
+
|
|
30
|
+
program
|
|
31
|
+
.version(JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'))).version)
|
|
32
|
+
.description('Checks the package-lock.json file for http:// links')
|
|
33
|
+
.option('-f, --folder <folder>', 'Folder with package-lock.json file')
|
|
34
|
+
.parse(process.argv);
|
|
35
|
+
|
|
36
|
+
const options = program.opts();
|
|
37
|
+
if (options.folder) {
|
|
38
|
+
if (!fs.existsSync(options.folder)) {
|
|
39
|
+
console.log(`Oops! Folder does not exist: ${options.folder}`);
|
|
40
|
+
process.exitCode = 3;
|
|
41
|
+
} else if (!fs.statSync(options.folder).isDirectory()) {
|
|
42
|
+
console.log(`Oops! Folder is not a real folder: ${options.folder}`);
|
|
43
|
+
process.exitCode = 4;
|
|
44
|
+
} else {
|
|
45
|
+
process.exitCode = checkFolder(options.folder);
|
|
46
|
+
}
|
|
47
|
+
} else {
|
|
48
|
+
process.exitCode = checkFolder();
|
|
49
|
+
}
|
package/package.json
CHANGED
|
@@ -1,49 +1,47 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "check-package-lock",
|
|
3
|
-
"version": "1.
|
|
4
|
-
"description": "Checks the package-lock.json file for insecure http:// links",
|
|
5
|
-
"main": "index.js",
|
|
6
|
-
"repository": {
|
|
7
|
-
"type": "git",
|
|
8
|
-
"url": "https://github.com/gemal/node-check-package-lock"
|
|
9
|
-
},
|
|
10
|
-
"scripts": {
|
|
11
|
-
"test": "mocha"
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
"
|
|
15
|
-
"
|
|
16
|
-
"
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
"package
|
|
25
|
-
"
|
|
26
|
-
"
|
|
27
|
-
"
|
|
28
|
-
"
|
|
29
|
-
"
|
|
30
|
-
"
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
"
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
"
|
|
39
|
-
"
|
|
40
|
-
"
|
|
41
|
-
"eslint": "^
|
|
42
|
-
"expect": "^
|
|
43
|
-
"globals": "^
|
|
44
|
-
"
|
|
45
|
-
"
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
}
|
|
49
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "check-package-lock",
|
|
3
|
+
"version": "1.13.0",
|
|
4
|
+
"description": "Checks the package-lock.json file for insecure http:// links",
|
|
5
|
+
"main": "index.js",
|
|
6
|
+
"repository": {
|
|
7
|
+
"type": "git",
|
|
8
|
+
"url": "https://github.com/gemal/node-check-package-lock.git"
|
|
9
|
+
},
|
|
10
|
+
"scripts": {
|
|
11
|
+
"test": "mocha",
|
|
12
|
+
"eslint": "eslint *.js test/*.js"
|
|
13
|
+
},
|
|
14
|
+
"type": "module",
|
|
15
|
+
"author": "Henrik Gemal <henrik@gemal.dk> (https://gemal.dk/)",
|
|
16
|
+
"license": "MIT",
|
|
17
|
+
"bin": {
|
|
18
|
+
"check-package-lock": "index.js"
|
|
19
|
+
},
|
|
20
|
+
"bugs": {
|
|
21
|
+
"url": "https://github.com/gemal/node-check-package-lock/issues"
|
|
22
|
+
},
|
|
23
|
+
"keywords": [
|
|
24
|
+
"package",
|
|
25
|
+
"package-lock",
|
|
26
|
+
"check",
|
|
27
|
+
"cli",
|
|
28
|
+
"lock",
|
|
29
|
+
"http",
|
|
30
|
+
"automate",
|
|
31
|
+
"ci"
|
|
32
|
+
],
|
|
33
|
+
"homepage": "https://github.com/gemal/node-check-package-lock",
|
|
34
|
+
"dependencies": {
|
|
35
|
+
"commander": "^15.0.0"
|
|
36
|
+
},
|
|
37
|
+
"devDependencies": {
|
|
38
|
+
"@eslint/js": "^10.0.1",
|
|
39
|
+
"chai": "^6.2.2",
|
|
40
|
+
"child_process": "^1.0.2",
|
|
41
|
+
"eslint": "^10.5.0",
|
|
42
|
+
"expect": "^30.4.1",
|
|
43
|
+
"globals": "^17.6.0",
|
|
44
|
+
"mocha": "^11.7.6",
|
|
45
|
+
"nyc": "^18.0.0"
|
|
46
|
+
}
|
|
47
|
+
}
|
package/renovate.json
ADDED
package/test/index.js
CHANGED
|
@@ -1,56 +1,52 @@
|
|
|
1
|
-
import { expect } from 'chai';
|
|
2
|
-
import path from 'path';
|
|
3
|
-
import { exec } from
|
|
4
|
-
import { fileURLToPath } from 'url';
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
}
|
|
24
|
-
|
|
25
|
-
it('should exit
|
|
26
|
-
runTest(['--folder', 'test/
|
|
27
|
-
});
|
|
28
|
-
|
|
29
|
-
it('should exit 0 having no problems', function(done) {
|
|
30
|
-
runTest(['--folder', 'test/test2'], 0, /package-lock.json is OK/, done);
|
|
31
|
-
});
|
|
32
|
-
|
|
33
|
-
it('should exit 0 having no problems
|
|
34
|
-
runTest([
|
|
35
|
-
});
|
|
36
|
-
|
|
37
|
-
it('should exit
|
|
38
|
-
runTest([],
|
|
39
|
-
});
|
|
40
|
-
|
|
41
|
-
it('should exit
|
|
42
|
-
runTest(['--folder', 'test
|
|
43
|
-
});
|
|
44
|
-
|
|
45
|
-
it('should exit
|
|
46
|
-
runTest(['--folder', '
|
|
47
|
-
});
|
|
48
|
-
|
|
49
|
-
it('should exit
|
|
50
|
-
runTest(['--folder', '
|
|
51
|
-
});
|
|
52
|
-
|
|
53
|
-
it('should exit 4 if folder is not a folder', function(done) {
|
|
54
|
-
runTest(['--folder', 'test/index.js'], 4, /Oops! Folder is not a real folder: test\/index.js\n/, done);
|
|
55
|
-
});
|
|
56
|
-
});
|
|
1
|
+
import { expect } from 'chai';
|
|
2
|
+
import path from 'node:path';
|
|
3
|
+
import { exec } from 'node:child_process';
|
|
4
|
+
import { fileURLToPath } from 'node:url';
|
|
5
|
+
|
|
6
|
+
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
7
|
+
|
|
8
|
+
describe('index.js', function() {
|
|
9
|
+
this.timeout(8000);
|
|
10
|
+
|
|
11
|
+
function runTest(args, expectedExitCode, expectedOutput, done) {
|
|
12
|
+
const command = `node ${path.join(__dirname, '../index.js')} ${args.join(' ')}`;
|
|
13
|
+
exec(command, { cwd: path.join(__dirname, '../') }, (error, stdout) => {
|
|
14
|
+
const exitCode = error ? error.code : 0;
|
|
15
|
+
expect(exitCode).to.equal(expectedExitCode);
|
|
16
|
+
expect(stdout).to.match(expectedOutput);
|
|
17
|
+
done();
|
|
18
|
+
});
|
|
19
|
+
}
|
|
20
|
+
|
|
21
|
+
it('should exit 1 having problems in test1', function(done) {
|
|
22
|
+
runTest(['--folder', 'test/test1'], 1, /package-lock.json is NOT OK/, done);
|
|
23
|
+
});
|
|
24
|
+
|
|
25
|
+
it('should exit 0 having no problems', function(done) {
|
|
26
|
+
runTest(['--folder', 'test/test2'], 0, /package-lock.json is OK/, done);
|
|
27
|
+
});
|
|
28
|
+
|
|
29
|
+
it('should exit 0 having no problems with slash', function(done) {
|
|
30
|
+
runTest(['--folder', 'test/test2/'], 0, /package-lock.json is OK/, done);
|
|
31
|
+
});
|
|
32
|
+
|
|
33
|
+
it('should exit 0 having no problems without folder', function(done) {
|
|
34
|
+
runTest([], 0, /package-lock.json is OK/, done);
|
|
35
|
+
});
|
|
36
|
+
|
|
37
|
+
it('should exit 1 having problems in test3', function(done) {
|
|
38
|
+
runTest(['--folder', 'test/test3'], 1, /package-lock.json is NOT OK/, done);
|
|
39
|
+
});
|
|
40
|
+
|
|
41
|
+
it('should exit 2 having problems with no file', function(done) {
|
|
42
|
+
runTest(['--folder', 'test'], 2, /package-lock.json does not exist/, done);
|
|
43
|
+
});
|
|
44
|
+
|
|
45
|
+
it('should exit 3 if folder does not exist', function(done) {
|
|
46
|
+
runTest(['--folder', '404'], 3, /Oops! Folder does not exist: 404/, done);
|
|
47
|
+
});
|
|
48
|
+
|
|
49
|
+
it('should exit 4 if folder is not a folder', function(done) {
|
|
50
|
+
runTest(['--folder', 'test/index.js'], 4, /Oops! Folder is not a real folder: test\/index.js/, done);
|
|
51
|
+
});
|
|
52
|
+
});
|
package/.circleci/config.yml
DELETED
|
@@ -1,47 +0,0 @@
|
|
|
1
|
-
version: 2
|
|
2
|
-
jobs:
|
|
3
|
-
build:
|
|
4
|
-
docker:
|
|
5
|
-
# Use node image
|
|
6
|
-
- image: cimg/node:lts
|
|
7
|
-
|
|
8
|
-
# code folder
|
|
9
|
-
working_directory: ~/repo
|
|
10
|
-
|
|
11
|
-
steps:
|
|
12
|
-
# check out code
|
|
13
|
-
- checkout
|
|
14
|
-
|
|
15
|
-
# restore cache dependencies
|
|
16
|
-
- restore_cache:
|
|
17
|
-
keys:
|
|
18
|
-
- v1-dependencies-{{ checksum "package.json" }}
|
|
19
|
-
# fallback to using the latest cache if no exact match is found
|
|
20
|
-
- v1-dependencies-
|
|
21
|
-
|
|
22
|
-
# install and cache packages
|
|
23
|
-
- run: npm install
|
|
24
|
-
- save_cache:
|
|
25
|
-
paths:
|
|
26
|
-
- node_modules
|
|
27
|
-
key: v1-dependencies-{{ checksum "package.json" }}
|
|
28
|
-
|
|
29
|
-
# audit the packages
|
|
30
|
-
- run: npm audit
|
|
31
|
-
- run: npm ls
|
|
32
|
-
|
|
33
|
-
# security test
|
|
34
|
-
- run: ./node_modules/.bin/snyk test
|
|
35
|
-
|
|
36
|
-
# correct line endings
|
|
37
|
-
- run: find ./ -path ./node_modules -prune -o -name '*.css' -o -name '*.json' -o -name '*.md' -o -name '*.js' -o -name '*.yml' | xargs ./node_modules/.bin/lintspaces --endofline 'lf' --newline --trailingspaces --verbose
|
|
38
|
-
|
|
39
|
-
# lint
|
|
40
|
-
- run: ./node_modules/.bin/eslint '*.js' 'test/*.js'
|
|
41
|
-
|
|
42
|
-
# run tests
|
|
43
|
-
- run: ./node_modules/.bin/nyc npm test
|
|
44
|
-
|
|
45
|
-
# upload code coverage
|
|
46
|
-
- run: ./node_modules/.bin/nyc report --reporter=text-lcov > coverage.lcov
|
|
47
|
-
- run: ./node_modules/.bin/codecov
|
package/.eslintrc.json
DELETED
|
@@ -1,20 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"env": {
|
|
3
|
-
"es6": true,
|
|
4
|
-
"node": true
|
|
5
|
-
},
|
|
6
|
-
"extends": ["eslint:recommended", "google"],
|
|
7
|
-
"globals": {
|
|
8
|
-
"Atomics": "readonly",
|
|
9
|
-
"SharedArrayBuffer": "readonly",
|
|
10
|
-
"it": true,
|
|
11
|
-
"describe": true
|
|
12
|
-
},
|
|
13
|
-
"parserOptions": {
|
|
14
|
-
"ecmaVersion": 2018
|
|
15
|
-
},
|
|
16
|
-
"rules": {
|
|
17
|
-
"max-len": ["error", {"code": 120}],
|
|
18
|
-
"indent": ["error", 4]
|
|
19
|
-
}
|
|
20
|
-
}
|