codegate-ai 0.7.0 → 0.9.0

package/dist/config/suppression-policy.js

@@ -0,0 +1,146 @@
+function normalizeString(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function globToRegExp(glob) {
+    const pattern = normalizeString(glob)?.replaceAll("\\", "/");
+    if (!pattern) {
+        return /^$/;
+    }
+    let regex = "^";
+    for (let index = 0; index < pattern.length; index++) {
+        const char = pattern[index];
+        if (char === "*") {
+            if (pattern[index + 1] === "*") {
+                regex += ".*";
+                index++;
+            }
+            else {
+                regex += "[^/]*";
+            }
+            continue;
+        }
+        if (char === "?") {
+            regex += "[^/]";
+            continue;
+        }
+        regex += escapeRegExp(char);
+    }
+    regex += "$";
+    return new RegExp(regex);
+}
+function matchesGlob(value, glob) {
+    return globToRegExp(glob).test(value.replaceAll("\\", "/"));
+}
+function parseSuppressionLocation(value) {
+    const trimmed = normalizeString(value);
+    if (!trimmed) {
+        return null;
+    }
+    const pieces = trimmed.split(":");
+    if (pieces.length === 0 || pieces.length > 3) {
+        return null;
+    }
+    const [filePath, lineRaw, columnRaw] = pieces;
+    if (!filePath) {
+        return null;
+    }
+    const line = lineRaw !== undefined ? Number.parseInt(lineRaw, 10) : undefined;
+    const column = columnRaw !== undefined ? Number.parseInt(columnRaw, 10) : undefined;
+    if (lineRaw !== undefined && (!Number.isFinite(line) || (line ?? 0) < 1)) {
+        return null;
+    }
+    if (columnRaw !== undefined && (!Number.isFinite(column) || (column ?? 0) < 1)) {
+        return null;
+    }
+    return {
+        filePath: filePath.replaceAll("\\", "/"),
+        line,
+        column,
+    };
+}
+function matchesSuppressionRule(finding, rule) {
+    const ruleId = normalizeString(rule.rule_id);
+    if (ruleId && finding.rule_id !== ruleId) {
+        return false;
+    }
+    const filePath = normalizeString(rule.file_path);
+    if (filePath && !matchesGlob(finding.file_path, filePath)) {
+        return false;
+    }
+    const location = parseSuppressionLocation(rule.location ?? "");
+    if (location) {
+        const normalizedFindingPath = finding.file_path.replaceAll("\\", "/");
+        if (normalizedFindingPath !== location.filePath) {
+            return false;
+        }
+        if (typeof location.line === "number" &&
+            (typeof finding.location.line !== "number" || finding.location.line !== location.line)) {
+            return false;
+        }
+        if (typeof location.column === "number" &&
+            (typeof finding.location.column !== "number" || finding.location.column !== location.column)) {
+            return false;
+        }
+    }
+    const severity = rule.severity;
+    if (severity && finding.severity !== severity) {
+        return false;
+    }
+    const category = normalizeString(rule.category);
+    if (category && finding.category !== category) {
+        return false;
+    }
+    const cwe = normalizeString(rule.cwe);
+    if (cwe && finding.cwe !== cwe) {
+        return false;
+    }
+    const fingerprint = normalizeString(rule.fingerprint);
+    if (fingerprint && finding.fingerprint !== fingerprint) {
+        return false;
+    }
+    return true;
+}
+function matchesRulePolicyIgnore(finding, location) {
+    const parsed = parseSuppressionLocation(location);
+    if (!parsed) {
+        return false;
+    }
+    const normalizedFindingPath = finding.file_path.replaceAll("\\", "/");
+    if (normalizedFindingPath !== parsed.filePath) {
+        return false;
+    }
+    if (typeof parsed.line === "number" &&
+        (typeof finding.location.line !== "number" || finding.location.line !== parsed.line)) {
+        return false;
+    }
+    if (typeof parsed.column === "number" &&
+        (typeof finding.location.column !== "number" || finding.location.column !== parsed.column)) {
+        return false;
+    }
+    return true;
+}
+export function applySuppressionPolicy(findings, policy) {
+    const legacySuppressions = new Set((policy.suppress_findings ?? [])
+        .map((findingId) => normalizeString(findingId))
+        .filter((findingId) => findingId !== undefined));
+    const rules = policy.suppression_rules ?? [];
+    const rulePolicies = policy.rule_policies ?? {};
+    return findings.map((finding) => {
+        const ruleMatch = rules.some((rule) => matchesSuppressionRule(finding, rule));
+        const legacyMatch = legacySuppressions.has(finding.finding_id);
+        const rulePolicy = rulePolicies[finding.rule_id];
+        const ruleDisabled = rulePolicy?.disable === true;
+        const ruleIgnoreMatch = rulePolicy?.ignore?.some((location) => matchesRulePolicyIgnore(finding, location)) ?? false;
+        return {
+            ...finding,
+            suppressed: finding.suppressed || legacyMatch || ruleMatch || ruleDisabled || ruleIgnoreMatch,
+        };
+    });
+}

package/dist/config.d.ts

@@ -1,7 +1,16 @@
 import type { Finding } from "./types/finding.js";
 import type { CodeGateReport } from "./types/report.js";
+import { type RulePolicyMap, type SuppressionRule } from "./config/suppression-policy.js";
 export declare const OUTPUT_FORMATS: readonly ["terminal", "json", "sarif", "markdown", "html"];
 export type OutputFormat = (typeof OUTPUT_FORMATS)[number];
+export declare const SCAN_COLLECTION_MODES: readonly ["default", "project", "user", "explicit", "all"];
+export type ScanCollectionMode = (typeof SCAN_COLLECTION_MODES)[number];
+export declare const SCAN_COLLECTION_KINDS: readonly ["workflows", "actions", "dependabot"];
+export type ScanCollectionKind = (typeof SCAN_COLLECTION_KINDS)[number];
+export declare const PERSONAS: readonly ["regular", "pedantic", "auditor"];
+export type AuditPersona = (typeof PERSONAS)[number];
+export declare const RUNTIME_MODES: readonly ["offline", "online", "online-no-audits"];
+export type RuntimeMode = (typeof RUNTIME_MODES)[number];
 export declare const SEVERITY_THRESHOLDS: readonly ["critical", "high", "medium", "low", "info"];
 export type SeverityThreshold = (typeof SEVERITY_THRESHOLDS)[number];
 export interface TuiConfig {
@@ -14,6 +23,9 @@ export interface ToolDiscoveryConfig {
     agent_paths: Record<string, string>;
     skip_tools: string[];
 }
+export interface WorkflowAuditConfig {
+    enabled: boolean;
+}
 export interface CodeGateConfig {
     severity_threshold: SeverityThreshold;
     auto_proceed_below_threshold: boolean;
@@ -32,7 +44,18 @@ export interface CodeGateConfig {
     check_ide_settings: boolean;
     owasp_mapping: boolean;
     trusted_api_domains: string[];
+    rule_pack_paths?: string[];
+    allowed_rules?: string[];
+    skip_rules?: string[];
+    strict_collection?: boolean;
+    scan_collection_modes?: ScanCollectionMode[];
+    scan_collection_kinds?: ScanCollectionKind[];
+    rules?: RulePolicyMap;
+    persona?: AuditPersona;
+    runtime_mode?: RuntimeMode;
+    workflow_audits?: WorkflowAuditConfig;
     suppress_findings: string[];
+    suppression_rules?: SuppressionRule[];
 }
 export interface CliConfigOverrides {
     format?: OutputFormat;

package/dist/config.js

@@ -3,7 +3,12 @@ import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { parse as parseJsonc } from "jsonc-parser";
 import { applyReportSummary, computeExitCode as computeReportExitCode } from "./report-summary.js";
+import { applySuppressionPolicy, } from "./config/suppression-policy.js";
 export const OUTPUT_FORMATS = ["terminal", "json", "sarif", "markdown", "html"];
+export const SCAN_COLLECTION_MODES = ["default", "project", "user", "explicit", "all"];
+export const SCAN_COLLECTION_KINDS = ["workflows", "actions", "dependabot"];
+export const PERSONAS = ["regular", "pedantic", "auditor"];
+export const RUNTIME_MODES = ["offline", "online", "online-no-audits"];
 export const SEVERITY_THRESHOLDS = ["critical", "high", "medium", "low", "info"];
 export const DEFAULT_CONFIG = {
     severity_threshold: "high",
@@ -34,7 +39,16 @@ export const DEFAULT_CONFIG = {
     check_ide_settings: true,
     owasp_mapping: true,
     trusted_api_domains: [],
+    rule_pack_paths: [],
+    allowed_rules: [],
+    skip_rules: [],
+    strict_collection: false,
+    scan_collection_modes: ["default"],
+    persona: "regular",
+    runtime_mode: "offline",
+    workflow_audits: { enabled: false },
     suppress_findings: [],
+    suppression_rules: [],
 };
 function normalizeOutputFormat(value) {
     if (!value) {
@@ -55,6 +69,146 @@ function normalizeOptionalPath(value) {
     const trimmed = value.trim();
     return trimmed.length > 0 ? trimmed : undefined;
 }
+function normalizeCollectionMode(value) {
+    if (!value) {
+        return undefined;
+    }
+    return SCAN_COLLECTION_MODES.find((mode) => mode === value) ?? undefined;
+}
+function normalizeCollectionModes(values) {
+    if (!values) {
+        return undefined;
+    }
+    const normalized = [];
+    for (const value of values) {
+        const mode = normalizeCollectionMode(value);
+        if (!mode || normalized.includes(mode)) {
+            continue;
+        }
+        normalized.push(mode);
+    }
+    return normalized.length > 0 ? normalized : undefined;
+}
+function normalizeCollectionKind(value) {
+    if (!value) {
+        return undefined;
+    }
+    return SCAN_COLLECTION_KINDS.find((kind) => kind === value) ?? undefined;
+}
+function normalizeCollectionKinds(values) {
+    if (!values) {
+        return undefined;
+    }
+    const normalized = [];
+    for (const value of values) {
+        const kind = normalizeCollectionKind(value);
+        if (!kind || normalized.includes(kind)) {
+            continue;
+        }
+        normalized.push(kind);
+    }
+    return normalized.length > 0 ? normalized : undefined;
+}
+function isPlainObject(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeRulePolicyConfig(value) {
+    if (!isPlainObject(value)) {
+        return undefined;
+    }
+    const disable = typeof value.disable === "boolean" ? value.disable : undefined;
+    const ignoreRaw = value.ignore;
+    const ignore = Array.isArray(ignoreRaw) && ignoreRaw.length > 0
+        ? ignoreRaw
+            .filter((entry) => typeof entry === "string")
+            .map((entry) => entry.trim())
+            .filter((entry) => entry.length > 0)
+        : undefined;
+    const configRaw = value.config;
+    const config = isPlainObject(configRaw) ? { ...configRaw } : undefined;
+    if (disable === undefined && ignore === undefined && config === undefined) {
+        return undefined;
+    }
+    return {
+        disable,
+        ignore,
+        config,
+    };
+}
+function normalizeRulePolicyMap(rules) {
+    if (!rules || typeof rules !== "object") {
+        return undefined;
+    }
+    const normalized = {};
+    for (const [ruleId, value] of Object.entries(rules)) {
+        const key = ruleId.trim();
+        if (key.length === 0) {
+            continue;
+        }
+        const policy = normalizeRulePolicyConfig(value);
+        if (!policy) {
+            continue;
+        }
+        normalized[key] = policy;
+    }
+    return Object.keys(normalized).length > 0 ? normalized : undefined;
+}
+function mergeRulePolicyConfig(current, incoming) {
+    if (!current) {
+        if (!incoming) {
+            return undefined;
+        }
+        return {
+            disable: incoming.disable,
+            ignore: incoming.ignore ? [...incoming.ignore] : undefined,
+            config: incoming.config ? { ...incoming.config } : undefined,
+        };
+    }
+    if (!incoming) {
+        return {
+            disable: current.disable,
+            ignore: current.ignore ? [...current.ignore] : undefined,
+            config: current.config ? { ...current.config } : undefined,
+        };
+    }
+    return {
+        disable: incoming.disable ?? current.disable,
+        ignore: unique([
+            current.ignore,
+            incoming.ignore,
+        ]),
+        config: current.config || incoming.config
+            ? {
+                ...(current.config ?? {}),
+                ...(incoming.config ?? {}),
+            }
+            : undefined,
+    };
+}
+function mergeRulePolicyMaps(...maps) {
+    const merged = {};
+    for (const map of maps) {
+        if (!map) {
+            continue;
+        }
+        for (const [ruleId, policy] of Object.entries(map)) {
+            merged[ruleId] = mergeRulePolicyConfig(merged[ruleId], policy) ?? merged[ruleId];
+        }
+    }
+    return Object.keys(merged).length > 0 ? merged : undefined;
+}
+function normalizePersona(value) {
+    if (!value) {
+        return undefined;
+    }
+    return PERSONAS.find((persona) => persona === value) ?? undefined;
+}
+function normalizeRuntimeMode(value) {
+    if (!value) {
+        return undefined;
+    }
+    return RUNTIME_MODES.find((mode) => mode === value) ?? undefined;
+}
 function unique(values) {
     const merged = values.flatMap((entry) => entry ?? []);
     const seen = new Set();
@@ -163,22 +317,53 @@ export function resolveEffectiveConfig(options) {
             globalConfig.trusted_api_domains,
             projectConfig.trusted_api_domains,
         ]),
+        rule_pack_paths: unique([
+            DEFAULT_CONFIG.rule_pack_paths,
+            globalConfig.rule_pack_paths,
+            projectConfig.rule_pack_paths,
+        ]),
+        allowed_rules: unique([
+            DEFAULT_CONFIG.allowed_rules,
+            globalConfig.allowed_rules,
+            projectConfig.allowed_rules,
+        ]),
+        skip_rules: unique([
+            DEFAULT_CONFIG.skip_rules,
+            globalConfig.skip_rules,
+            projectConfig.skip_rules,
+        ]),
+        strict_collection: pickFirst(projectConfig.strict_collection, globalConfig.strict_collection, DEFAULT_CONFIG.strict_collection) ?? DEFAULT_CONFIG.strict_collection,
+        scan_collection_modes: pickFirst(normalizeCollectionModes(projectConfig.scan_collection_modes), normalizeCollectionModes(globalConfig.scan_collection_modes), DEFAULT_CONFIG.scan_collection_modes) ?? DEFAULT_CONFIG.scan_collection_modes,
+        scan_collection_kinds: pickFirst(normalizeCollectionKinds(projectConfig.scan_collection_kinds), normalizeCollectionKinds(globalConfig.scan_collection_kinds)) ?? undefined,
+        rules: mergeRulePolicyMaps(normalizeRulePolicyMap(globalConfig.rules), normalizeRulePolicyMap(projectConfig.rules)) ?? undefined,
+        persona: pickFirst(normalizePersona(projectConfig.persona), normalizePersona(globalConfig.persona), DEFAULT_CONFIG.persona) ?? DEFAULT_CONFIG.persona,
+        runtime_mode: pickFirst(normalizeRuntimeMode(projectConfig.runtime_mode), normalizeRuntimeMode(globalConfig.runtime_mode), DEFAULT_CONFIG.runtime_mode) ?? DEFAULT_CONFIG.runtime_mode,
+        workflow_audits: {
+            enabled: pickFirst(projectConfig.workflow_audits?.enabled, globalConfig.workflow_audits?.enabled, DEFAULT_CONFIG.workflow_audits?.enabled) ?? false,
+        },
         suppress_findings: unique([
             DEFAULT_CONFIG.suppress_findings,
             globalConfig.suppress_findings,
             projectConfig.suppress_findings,
         ]),
+        suppression_rules: [
+            ...(DEFAULT_CONFIG.suppression_rules ?? []),
+            ...(globalConfig.suppression_rules ?? []),
+            ...(projectConfig.suppression_rules ?? []),
+        ],
     };
 }
 export function computeExitCode(findings, threshold) {
     return computeReportExitCode(findings, threshold);
 }
 export function applyConfigPolicy(report, config) {
-    const suppressionSet = new Set(config.suppress_findings);
-    const findings = report.findings.map((finding) => ({
+    const findings = applySuppressionPolicy(report.findings, {
+        suppress_findings: config.suppress_findings,
+        suppression_rules: config.suppression_rules,
+        rule_policies: config.rules,
+    }).map((finding) => ({
         ...finding,
         owasp: config.owasp_mapping ? finding.owasp : [],
-        suppressed: finding.suppressed || suppressionSet.has(finding.finding_id),
     }));
     return applyReportSummary({
         ...report,

package/dist/layer2-static/action/parser.d.ts

@@ -0,0 +1,3 @@
+import type { ActionFacts } from "./types.js";
+export declare function isGitHubActionPath(path: string): boolean;
+export declare function extractActionFacts(parsed: unknown): ActionFacts | null;

package/dist/layer2-static/action/parser.js

@@ -0,0 +1,165 @@
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function asBoolean(value) {
+    return typeof value === "boolean" ? value : undefined;
+}
+function asStringRecord(value) {
+    const record = asRecord(value);
+    if (!record) {
+        return undefined;
+    }
+    const result = {};
+    for (const [key, entry] of Object.entries(record)) {
+        if (typeof entry === "string") {
+            result[key] = entry;
+        }
+    }
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+function asStringArray(value) {
+    if (!Array.isArray(value)) {
+        return undefined;
+    }
+    const result = value.filter((entry) => typeof entry === "string");
+    return result.length > 0 ? result : undefined;
+}
+function normalizeActionPath(value) {
+    return value.replaceAll("\\", "/");
+}
+export function isGitHubActionPath(path) {
+    return /(?:^|\/)action\.ya?ml$/iu.test(normalizeActionPath(path));
+}
+function extractStepFacts(step) {
+    const stepRecord = asRecord(step);
+    if (!stepRecord) {
+        return null;
+    }
+    const withEntries = asStringRecord(stepRecord.with);
+    const envEntries = asStringRecord(stepRecord.env);
+    const stepFacts = {
+        id: asString(stepRecord.id),
+        name: asString(stepRecord.name),
+        uses: asString(stepRecord.uses),
+        run: asString(stepRecord.run),
+        if: asString(stepRecord.if),
+        shell: asString(stepRecord.shell),
+        workingDirectory: asString(stepRecord["working-directory"]) ?? asString(stepRecord.workingDirectory),
+        with: withEntries,
+        env: envEntries,
+    };
+    if (!stepFacts.uses && !stepFacts.run) {
+        return null;
+    }
+    return stepFacts;
+}
+function extractInputs(value) {
+    const inputs = asRecord(value);
+    if (!inputs) {
+        return undefined;
+    }
+    const result = {};
+    for (const [name, inputValue] of Object.entries(inputs)) {
+        const inputRecord = asRecord(inputValue);
+        if (!inputRecord) {
+            continue;
+        }
+        const entry = {
+            description: asString(inputRecord.description),
+            required: asBoolean(inputRecord.required),
+            default: asString(inputRecord.default),
+            deprecationMessage: asString(inputRecord.deprecationMessage) ?? asString(inputRecord.deprecation_message),
+        };
+        if (entry.description !== undefined ||
+            entry.required !== undefined ||
+            entry.default !== undefined ||
+            entry.deprecationMessage !== undefined) {
+            result[name] = entry;
+        }
+    }
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+function extractOutputs(value) {
+    const outputs = asRecord(value);
+    if (!outputs) {
+        return undefined;
+    }
+    const result = {};
+    for (const [name, outputValue] of Object.entries(outputs)) {
+        const outputRecord = asRecord(outputValue);
+        if (!outputRecord) {
+            continue;
+        }
+        const entry = {
+            description: asString(outputRecord.description),
+            value: asString(outputRecord.value),
+        };
+        if (entry.description !== undefined || entry.value !== undefined) {
+            result[name] = entry;
+        }
+    }
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+function extractRuns(value) {
+    const runs = asRecord(value);
+    if (!runs) {
+        return undefined;
+    }
+    const stepsRaw = Array.isArray(runs.steps) ? runs.steps : [];
+    const steps = stepsRaw
+        .map((step) => extractStepFacts(step))
+        .filter((step) => step !== null);
+    const result = {
+        using: asString(runs.using),
+        main: asString(runs.main),
+        pre: asString(runs.pre),
+        post: asString(runs.post),
+        image: asString(runs.image),
+        args: asStringArray(runs.args),
+        steps: steps.length > 0 ? steps : undefined,
+    };
+    if (result.using === undefined &&
+        result.main === undefined &&
+        result.pre === undefined &&
+        result.post === undefined &&
+        result.image === undefined &&
+        result.args === undefined &&
+        result.steps === undefined) {
+        return undefined;
+    }
+    return result;
+}
+export function extractActionFacts(parsed) {
+    const root = asRecord(parsed);
+    if (!root) {
+        return null;
+    }
+    const runs = extractRuns(root.runs);
+    const inputs = extractInputs(root.inputs);
+    const outputs = extractOutputs(root.outputs);
+    const branding = asRecord(root.branding) ?? undefined;
+    if (runs === undefined &&
+        inputs === undefined &&
+        outputs === undefined &&
+        branding === undefined &&
+        asString(root.name) === undefined &&
+        asString(root.description) === undefined &&
+        asString(root.author) === undefined) {
+        return null;
+    }
+    return {
+        name: asString(root.name),
+        description: asString(root.description),
+        author: asString(root.author),
+        branding,
+        inputs,
+        outputs,
+        runs,
+    };
+}

package/dist/layer2-static/action/types.d.ts

@@ -0,0 +1,39 @@
+export interface ActionStepFacts {
+    id?: string;
+    name?: string;
+    uses?: string;
+    run?: string;
+    if?: string;
+    shell?: string;
+    workingDirectory?: string;
+    with?: Record<string, string>;
+    env?: Record<string, string>;
+}
+export interface ActionRunsFacts {
+    using?: string;
+    main?: string;
+    pre?: string;
+    post?: string;
+    image?: string;
+    args?: string[];
+    steps?: ActionStepFacts[];
+}
+export interface ActionInputFacts {
+    description?: string;
+    required?: boolean;
+    default?: string;
+    deprecationMessage?: string;
+}
+export interface ActionOutputFacts {
+    description?: string;
+    value?: string;
+}
+export interface ActionFacts {
+    name?: string;
+    description?: string;
+    author?: string;
+    branding?: Record<string, unknown>;
+    inputs?: Record<string, ActionInputFacts>;
+    outputs?: Record<string, ActionOutputFacts>;
+    runs?: ActionRunsFacts;
+}

package/dist/layer2-static/action/types.js

@@ -0,0 +1 @@
+export {};