cleartoship 0.7.0 → 0.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/ATTRIBUTION.md +115 -0
- package/LICENSES/gitleaks-MIT.txt +21 -0
- package/LICENSES/guardvibe-Apache-2.0.txt +191 -0
- package/LICENSES/guardvibe-NOTICE.txt +4 -0
- package/README.md +125 -25
- package/SECURITY.md +70 -0
- package/action.yml +80 -37
- package/dist/scanners/auth-helpers.d.ts +16 -0
- package/dist/scanners/auth-helpers.js +169 -0
- package/dist/scanners/community.js +49 -1
- package/dist/scanners/index.d.ts +2 -1
- package/dist/scanners/index.js +3 -1
- package/dist/scanners/logic.d.ts +2 -0
- package/dist/scanners/logic.js +226 -0
- package/dist/scanners/server-actions.js +171 -14
- package/dist/utils/modules.d.ts +16 -0
- package/dist/utils/modules.js +67 -0
- package/examples/security-cli.yml +42 -0
- package/examples/security.yml +7 -1
- package/package.json +4 -4
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
# Copy to .github/workflows/security.yml in your own repository.
|
|
2
|
+
#
|
|
3
|
+
# The CLI path: nothing but npm is involved, so it works on any CI and from any
|
|
4
|
+
# repository today. (The composite action in examples/security.yml is nicer —
|
|
5
|
+
# sticky PR comments, typed outputs — but it lives in a repository that is
|
|
6
|
+
# currently private, so `uses: murtazaozdemir/cleartoship@…` cannot resolve for
|
|
7
|
+
# anyone else yet.)
|
|
8
|
+
name: ClearToShip
|
|
9
|
+
|
|
10
|
+
on:
|
|
11
|
+
pull_request:
|
|
12
|
+
push:
|
|
13
|
+
branches: [main]
|
|
14
|
+
|
|
15
|
+
permissions:
|
|
16
|
+
contents: read
|
|
17
|
+
security-events: write # for the SARIF upload below
|
|
18
|
+
|
|
19
|
+
jobs:
|
|
20
|
+
preflight:
|
|
21
|
+
runs-on: ubuntu-latest
|
|
22
|
+
steps:
|
|
23
|
+
- uses: actions/checkout@v4
|
|
24
|
+
- uses: actions/setup-node@v4
|
|
25
|
+
with:
|
|
26
|
+
node-version: 20
|
|
27
|
+
|
|
28
|
+
# Write the report for the Security tab, and don't fail on this step —
|
|
29
|
+
# the gate is the second run, so a finding is visible in the UI even when
|
|
30
|
+
# it blocks the build.
|
|
31
|
+
- run: npx cleartoship --sarif -o cleartoship.sarif --fail-on=none
|
|
32
|
+
- uses: github/codeql-action/upload-sarif@v3
|
|
33
|
+
with:
|
|
34
|
+
sarif_file: cleartoship.sarif
|
|
35
|
+
|
|
36
|
+
# The gate. Registry and OSV answers are cached for 24h, so the second
|
|
37
|
+
# pass re-parses locally and makes no network calls.
|
|
38
|
+
- run: npx cleartoship --fail-on=critical
|
|
39
|
+
|
|
40
|
+
# Optional: put the human-readable report in the job summary.
|
|
41
|
+
- if: always()
|
|
42
|
+
run: npx cleartoship --markdown --fail-on=none >> "$GITHUB_STEP_SUMMARY"
|
package/examples/security.yml
CHANGED
|
@@ -1,4 +1,10 @@
|
|
|
1
1
|
# Copy to .github/workflows/security.yml in your own repository.
|
|
2
|
+
#
|
|
3
|
+
# NOTE: this file uses the composite action, which lives in the (currently
|
|
4
|
+
# private) cleartoship repository — `uses: murtazaozdemir/cleartoship@…` will
|
|
5
|
+
# fail with "Unable to resolve action" for anyone who cannot read that repo.
|
|
6
|
+
# Until it is public, use examples/security-cli.yml, which drives the published
|
|
7
|
+
# npm package and needs no access to anything.
|
|
2
8
|
name: ClearToShip
|
|
3
9
|
|
|
4
10
|
on:
|
|
@@ -16,7 +22,7 @@ jobs:
|
|
|
16
22
|
runs-on: ubuntu-latest
|
|
17
23
|
steps:
|
|
18
24
|
- uses: actions/checkout@v4
|
|
19
|
-
- uses: murtazaozdemir/cleartoship@v0.
|
|
25
|
+
- uses: murtazaozdemir/cleartoship@v0.9.0
|
|
20
26
|
with:
|
|
21
27
|
fail-on: critical # block the PR only on criticals
|
|
22
28
|
comment: true # post a summary comment on the PR
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cleartoship",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.9.0",
|
|
4
4
|
"description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"security",
|
|
@@ -30,7 +30,10 @@
|
|
|
30
30
|
"files": [
|
|
31
31
|
"dist",
|
|
32
32
|
"README.md",
|
|
33
|
+
"SECURITY.md",
|
|
33
34
|
"LICENSE",
|
|
35
|
+
"ATTRIBUTION.md",
|
|
36
|
+
"LICENSES",
|
|
34
37
|
"action.yml",
|
|
35
38
|
"examples"
|
|
36
39
|
],
|
|
@@ -55,9 +58,6 @@
|
|
|
55
58
|
"@types/node": "^22.5.0",
|
|
56
59
|
"typescript": "^5.6.0"
|
|
57
60
|
},
|
|
58
|
-
"optionalDependencies": {
|
|
59
|
-
"pg": "^8.13.0"
|
|
60
|
-
},
|
|
61
61
|
"repository": {
|
|
62
62
|
"type": "git",
|
|
63
63
|
"url": "git+https://github.com/murtazaozdemir/cleartoship.git"
|