dependfix 0.0.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +59 -78
- package/dist/bin.d.mts +1 -0
- package/dist/bin.mjs +14 -0
- package/dist/bin.mjs.map +1 -0
- package/dist/index.d.mts +1458 -7
- package/dist/index.mjs +17 -38
- package/dist/index.mjs.map +1 -1
- package/dist/runner.mjs +7402 -0
- package/dist/runner.mjs.map +1 -0
- package/package.json +55 -67
- package/dist/index.cjs +0 -35
- package/dist/index.cjs.map +0 -1
- package/dist/index.d.cts +0 -12
package/README.md
CHANGED
|
@@ -1,108 +1,89 @@
|
|
|
1
|
-
|
|
2
|
-
<p>
|
|
3
|
-
<a href="https://www.npmjs.com/package/dependfix" target="_blank">
|
|
4
|
-
<img alt="Version" src="https://img.shields.io/npm/v/dependfix.svg">
|
|
5
|
-
</a>
|
|
6
|
-
<a href="https://www.npmjs.com/package/dependfix" target="_blank">
|
|
7
|
-
<img alt="npm downloads" src="https://img.shields.io/npm/dt/dependfix?label=npm%20downloads&color=yellow">
|
|
8
|
-
</a>
|
|
9
|
-
<img alt="Version" src="https://img.shields.io/github/package-json/v/CaoMeiYouRen/dependfix.svg" />
|
|
10
|
-
<a href="https://github.com/CaoMeiYouRen/dependfix/actions?query=workflow%3ARelease" target="_blank">
|
|
11
|
-
<img alt="GitHub Workflow Status" src="https://img.shields.io/github/actions/workflow/status/CaoMeiYouRen/dependfix/release.yml?branch=master">
|
|
12
|
-
</a>
|
|
13
|
-
<img src="https://img.shields.io/node/v/dependfix" />
|
|
14
|
-
<a href="https://github.com/CaoMeiYouRen/dependfix#readme" target="_blank">
|
|
15
|
-
<img alt="Documentation" src="https://img.shields.io/badge/documentation-yes-brightgreen.svg" />
|
|
16
|
-
</a>
|
|
17
|
-
<a href="https://github.com/CaoMeiYouRen/dependfix/graphs/commit-activity" target="_blank">
|
|
18
|
-
<img alt="Maintenance" src="https://img.shields.io/badge/Maintained%3F-yes-green.svg" />
|
|
19
|
-
</a>
|
|
20
|
-
<a href="https://github.com/CaoMeiYouRen/dependfix/blob/master/LICENSE" target="_blank">
|
|
21
|
-
<img alt="License: MIT" src="https://img.shields.io/github/license/CaoMeiYouRen/dependfix?color=yellow" />
|
|
22
|
-
</a>
|
|
23
|
-
</p>
|
|
1
|
+
# dependfix
|
|
24
2
|
|
|
3
|
+
> 自动化处理 GitHub Dependabot / Code Scanning 安全告警的 CLI 工具。
|
|
25
4
|
|
|
26
|
-
|
|
5
|
+
## 安装
|
|
27
6
|
|
|
28
|
-
|
|
7
|
+
```bash
|
|
8
|
+
# 全局安装
|
|
9
|
+
pnpm add -g dependfix
|
|
29
10
|
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
## 📦 依赖要求
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
- node >=20
|
|
37
|
-
|
|
38
|
-
## 🚀 安装
|
|
39
|
-
|
|
40
|
-
```sh
|
|
41
|
-
npm install dependfix
|
|
42
|
-
```
|
|
43
|
-
|
|
44
|
-
## 👨💻 使用
|
|
45
|
-
|
|
46
|
-
```sh
|
|
47
|
-
npm run start
|
|
11
|
+
# 或直接运行（无需安装）
|
|
12
|
+
npx dependfix report-only --repo owner/repo --github-token $GITHUB_TOKEN
|
|
48
13
|
```
|
|
49
14
|
|
|
50
|
-
##
|
|
15
|
+
## 命令
|
|
51
16
|
|
|
52
|
-
|
|
53
|
-
npm run dev
|
|
54
|
-
```
|
|
17
|
+
### `report-only` — 查看告警（默认）
|
|
55
18
|
|
|
56
|
-
|
|
19
|
+
拉取告警并生成 Markdown + JSON 双格式报告，不修改任何文件。
|
|
57
20
|
|
|
58
|
-
```
|
|
59
|
-
|
|
21
|
+
```bash
|
|
22
|
+
dependfix report-only --repo owner/repo --github-token $GITHUB_TOKEN
|
|
60
23
|
```
|
|
61
24
|
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
```sh
|
|
65
|
-
npm run lint
|
|
66
|
-
```
|
|
25
|
+
### `fix` — 修复告警
|
|
67
26
|
|
|
68
|
-
|
|
27
|
+
执行依赖升级、lockfile 修复和验证（lint / build），修改仅限本地文件，不创建分支或 PR。
|
|
69
28
|
|
|
70
|
-
```
|
|
71
|
-
|
|
29
|
+
```bash
|
|
30
|
+
dependfix fix --repo owner/repo --github-token $GITHUB_TOKEN --severity-threshold high
|
|
72
31
|
```
|
|
73
32
|
|
|
33
|
+
### `fix-and-pr` — 修复并创建 PR
|
|
74
34
|
|
|
75
|
-
|
|
35
|
+
执行完整修复流程后，自动创建修复分支、提交变更、推送并创建 Pull Request。
|
|
76
36
|
|
|
37
|
+
```bash
|
|
38
|
+
dependfix fix-and-pr --repo owner/repo --github-token $GITHUB_TOKEN
|
|
39
|
+
```
|
|
77
40
|
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
* Website: [https://blog.cmyr.ltd/](https://blog.cmyr.ltd/)
|
|
81
|
-
|
|
82
|
-
* GitHub: [@CaoMeiYouRen](https://github.com/CaoMeiYouRen)
|
|
41
|
+
> 需要 `GITHUB_TOKEN` 具备 `contents: write` 和 `pull-requests: write` 权限。
|
|
83
42
|
|
|
43
|
+
## CLI 参数
|
|
84
44
|
|
|
85
|
-
|
|
45
|
+
| 参数 | 别名 | 说明 | 默认 |
|
|
46
|
+
|:-----|:-----|:-----|:-----|
|
|
47
|
+
| `mode` | （位置参数） | 运行模式：`report-only` / `fix` / `fix-and-pr` | `report-only` |
|
|
48
|
+
| `--repo` | `-r`, `--repository`, `--repositories` | 目标仓库（`owner/repo`），逗号分隔 | — |
|
|
49
|
+
| `--repos-file` | — | 从文件读取仓库列表（每行一个 `owner/repo`） | — |
|
|
50
|
+
| `--github-token` | — | GitHub Personal Access Token | `GITHUB_TOKEN` 环境变量 |
|
|
51
|
+
| `--severity-threshold` | — | 严重级别：`critical` / `high` / `medium` / `all` | `high` |
|
|
52
|
+
| `--dry-run` | — | 试运行模式，不实际写入文件 | `false` |
|
|
53
|
+
| `--create-pr` | — | 创建 Pull Request（`fix-and-pr` 模式自动启用） | `false` |
|
|
54
|
+
| `--commit` | — | 修复完成后在本地当前分支直接提交（仅 `fix` 模式；不推送、不创建 PR） | `false` |
|
|
55
|
+
| `--max-alerts-per-repository` | — | 每仓库最大告警处理数 | `20` |
|
|
56
|
+
| `--commands` | — | 自定义验证命令（逗号分隔），覆盖默认的 `install/lint/build` | — |
|
|
57
|
+
| `--verbose` | — | 详细日志输出 | `false` |
|
|
86
58
|
|
|
87
|
-
|
|
59
|
+
### 环境变量
|
|
88
60
|
|
|
89
|
-
|
|
61
|
+
| 环境变量 | 说明 |
|
|
62
|
+
|:---------|:-----|
|
|
63
|
+
| `GITHUB_TOKEN` | GitHub 认证 Token |
|
|
90
64
|
|
|
91
|
-
|
|
65
|
+
## 程序化调用
|
|
92
66
|
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
</a>
|
|
67
|
+
```ts
|
|
68
|
+
import { DependfixApp, runCli } from 'dependfix'
|
|
96
69
|
|
|
70
|
+
// 解析 CLI 参数
|
|
71
|
+
const { config } = runCli(process.argv.slice(2))
|
|
97
72
|
|
|
98
|
-
|
|
73
|
+
// 程序化执行
|
|
74
|
+
const app = new DependfixApp({ config, verbose: true })
|
|
75
|
+
const { result, exitCode } = await app.run()
|
|
76
|
+
```
|
|
99
77
|
|
|
100
|
-
|
|
78
|
+
## 修复流程
|
|
101
79
|
|
|
102
|
-
|
|
80
|
+
1. **拉取告警** — 通过 GitHub API 获取 Dependabot alerts
|
|
81
|
+
2. **过滤排序** — 按严重级别过滤、优先级排序、数量限制
|
|
82
|
+
3. **依赖升级** — `pnpm update <package>` 升级到推荐版本
|
|
83
|
+
4. **lockfile 修复** — 检测并修复 `pnpm frozen-lockfile` 问题
|
|
84
|
+
5. **验证** — 执行 `pnpm install --frozen-lockfile` → `pnpm lint` → `pnpm build`
|
|
85
|
+
6. **分支与 PR** — `fix-and-pr` 模式下，创建分支、commit、push、PR
|
|
103
86
|
|
|
104
|
-
|
|
105
|
-
This project is [MIT](https://github.com/CaoMeiYouRen/dependfix/blob/master/LICENSE) licensed.
|
|
87
|
+
## 相关包
|
|
106
88
|
|
|
107
|
-
|
|
108
|
-
_This README was generated with ❤️ by [cmyr-template-cli](https://github.com/CaoMeiYouRen/cmyr-template-cli)_
|
|
89
|
+
- [@dependfix/core](../core/README.md) — 核心领域模型库（本包依赖）
|
package/dist/bin.d.mts
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export {}
|
package/dist/bin.mjs
ADDED
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
import { r as runDependfixMain } from "./runner.mjs";
|
|
3
|
+
import { toAppError } from "@dependfix/core";
|
|
4
|
+
|
|
5
|
+
//#region src/bin.ts
|
|
6
|
+
runDependfixMain().catch((error) => {
|
|
7
|
+
const appError = toAppError(error, "CLI_EXECUTION_FAILED");
|
|
8
|
+
console.error(appError.message);
|
|
9
|
+
process.exitCode = 1;
|
|
10
|
+
});
|
|
11
|
+
|
|
12
|
+
//#endregion
|
|
13
|
+
export { };
|
|
14
|
+
//# sourceMappingURL=bin.mjs.map
|
package/dist/bin.mjs.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"bin.mjs","names":[],"sources":["../src/bin.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { toAppError } from '@dependfix/core'\nimport { runDependfixMain } from './cli/runner'\n\nvoid runDependfixMain().catch((error: unknown) => {\n const appError = toAppError(error, 'CLI_EXECUTION_FAILED')\n console.error(appError.message)\n process.exitCode = 1\n})\n"],"mappings":";;;;;AAIK,iBAAiB,CAAC,CAAC,OAAO,UAAmB;CAC9C,MAAM,WAAW,WAAW,OAAO,sBAAsB;CACzD,QAAQ,MAAM,SAAS,OAAO;CAC9B,QAAQ,WAAW;AACvB,CAAC"}
|