fg-devkit 1.20.2 → 1.21.1

package/scripts/sync-dependency-check-suppressions-commit.mjs

@@ -1,22 +1,47 @@
 #!/usr/bin/env node
 /**
- * Copy dependency-check-suppressions.xml into the consumer repo and auto-commit.
+ * Write dependency-check-suppressions.xml into the consumer repo and auto-commit.
+ *
+ * Only the active <suppress> entries from fg-devkit's shared file that match a finding
+ * `pnpm audit` still reports in this repo are written, so OWASP Dependency-Check accepts
+ * exactly the risks this repo has. Pass --all to copy the whole shared file instead.
  *
  * Usage:
- *   node node_modules/fg-devkit/scripts/sync-dependency-check-suppressions-commit.mjs
- *   pnpm exec fg-devkit sync-dependency-check-suppressions-commit
+ *   node node_modules/fg-devkit/scripts/sync-dependency-check-suppressions-commit.mjs [--all]
+ *   pnpm exec fg-devkit sync-dependency-check-suppressions-commit [--all]
  */
 
 import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { spawnSync } from 'node:child_process'
+import { parseArgs } from 'node:util'
+import { filterSuppressions, normalizeAdvisories, parseAuditJson, parseSuppressions } from './audit-fix-plan.mjs'
 
+const TAG = '[sync-dependency-check-suppressions]'
 const FILE_NAME = 'dependency-check-suppressions.xml'
 const COMMIT_MESSAGE = 'chore(repo): sync dependency-check suppressions'
 const projectRoot = process.cwd()
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 
+const { values: args } = parseArgs({
+  options: {
+    all: { type: 'boolean', default: false },
+    help: { type: 'boolean', short: 'h', default: false },
+  },
+  strict: true,
+})
+
+if (args.help) {
+  console.log(`Usage: pnpm exec fg-devkit sync-dependency-check-suppressions-commit [--all]
+
+Writes ${FILE_NAME} with the entries from fg-devkit that match findings
+pnpm audit reports in this repo, and auto-commits it.
+
+  --all   Copy every entry from fg-devkit's shared file (no pnpm audit)`)
+  process.exit(0)
+}
+
 function findFgDevkitPackageRoot() {
   const candidates = [
     path.resolve(scriptDir, '..'),
@@ -31,15 +56,15 @@ function findFgDevkitPackageRoot() {
   return null
 }
 
-function runGit(args, options = {}) {
-  const result = spawnSync('git', args, {
+function runGit(gitArgs, options = {}) {
+  const result = spawnSync('git', gitArgs, {
     stdio: options.capture ? 'pipe' : 'inherit',
     encoding: options.capture ? 'utf8' : undefined,
     cwd: projectRoot,
     env: process.env,
   })
   if (result.error) {
-    console.error('[sync-dependency-check-suppressions]', result.error.message)
+    console.error(TAG, result.error.message)
     return { status: 1, stdout: '' }
   }
   return { status: result.status ?? 1, stdout: result.stdout ?? '' }
@@ -56,30 +81,69 @@ function fileDiffersFromHead(filePath) {
   return diff.status !== 0
 }
 
+/** GHSA ids `pnpm audit` reports in this repo. Exits on audit failure so nothing is written blindly. */
+function reportedGhsas() {
+  const result = spawnSync('pnpm', ['audit', '--json'], {
+    cwd: projectRoot,
+    env: process.env,
+    encoding: 'utf8',
+    maxBuffer: 50 * 1024 * 1024,
+  })
+  if (result.error || (result.status !== 0 && result.status !== 1)) {
+    console.error(`${TAG} pnpm audit failed, ${FILE_NAME} was not changed.`)
+    console.error((result.error?.message ?? result.stderr ?? result.stdout ?? '').trim())
+    process.exit(1)
+  }
+  return new Set(normalizeAdvisories(parseAuditJson(result.stdout)).map((advisory) => advisory.ghsa))
+}
+
 const fgRoot = findFgDevkitPackageRoot()
 if (!fgRoot) {
-  console.error(
-    '[sync-dependency-check-suppressions] Could not find fg-devkit (install fg-devkit or a package that bundles it, e.g. fds-vue-core).',
-  )
+  console.error(`${TAG} Could not find fg-devkit (install fg-devkit or a package that bundles it, e.g. fds-vue-core).`)
   process.exit(1)
 }
 
 const sourcePath = path.join(fgRoot, 'configs', FILE_NAME)
 if (!fs.existsSync(sourcePath)) {
-  console.error(`[sync-dependency-check-suppressions] Missing template: ${sourcePath}`)
+  console.error(`${TAG} Missing template: ${sourcePath}`)
   process.exit(1)
 }
 
-fs.copyFileSync(sourcePath, path.join(projectRoot, FILE_NAME))
-console.log(`[sync-dependency-check-suppressions] Updated ${FILE_NAME}.`)
+const shared = fs.readFileSync(sourcePath, 'utf8')
+const targetPath = path.join(projectRoot, FILE_NAME)
+let content = shared
+
+if (!args.all) {
+  console.log(`${TAG} Running pnpm audit to find the entries that apply to this repo…`)
+  const reported = reportedGhsas()
+  const now = Date.now()
+  const kept = parseSuppressions(shared, now).filter(
+    (entry) => entry.active && entry.ghsas.some((ghsa) => reported.has(ghsa)),
+  )
+  content = filterSuppressions(shared, reported, now)
+
+  if (kept.length === 0 && !fs.existsSync(targetPath)) {
+    console.log(`${TAG} No shared suppression applies to this repo. ${FILE_NAME} not created.`)
+    process.exit(0)
+  }
+  const keptIds = kept.flatMap((entry) => entry.ghsas).filter((ghsa) => reported.has(ghsa))
+  console.log(
+    kept.length > 0
+      ? `${TAG} Keeping ${kept.length} entr${kept.length === 1 ? 'y' : 'ies'}: ${keptIds.join(', ')}`
+      : `${TAG} No shared suppression applies to this repo. Writing ${FILE_NAME} without entries.`,
+  )
+}
+
+fs.writeFileSync(targetPath, content)
+console.log(`${TAG} Updated ${FILE_NAME}.`)
 
 if (!fileDiffersFromHead(FILE_NAME)) {
-  console.log('[sync-dependency-check-suppressions] No changes to commit.')
+  console.log(`${TAG} No changes to commit.`)
   process.exit(0)
 }
 
 const stage = runGit(['add', '--', FILE_NAME])
 if (stage.status !== 0) process.exit(stage.status)
 
-console.log(`[sync-dependency-check-suppressions] Auto-committing: ${COMMIT_MESSAGE}`)
+console.log(`${TAG} Auto-committing: ${COMMIT_MESSAGE}`)
 process.exit(runGit(['commit', '-m', COMMIT_MESSAGE]).status)