fg-devkit 1.22.0 → 1.24.0

package/scripts/vuln-commit.mjs

@@ -1,142 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Git helper for security bumps: inspects staged package.json files, detects dependency
- * version changes vs HEAD, and creates a conventional commit with a vuln() message.
- *
- * Intended for use as a bin (fg-vuln-commit / fds-vuln-commit) or from a git hook after
- * staging lockfile/package.json changes. Requires a clean git invocation with staged changes.
- */
-
-import { execSync } from "node:child_process";
-
-/** Run a shell command and return stdout, or empty string on failure. */
-function run(command) {
-  try {
-    return execSync(command, { encoding: "utf8" }).trim();
-  } catch {
-    return "";
-  }
-}
-
-/** Run a shell command; throws on non-zero exit (stdio inherited). */
-function runOrThrow(command) {
-  return execSync(command, { encoding: "utf8", stdio: "inherit" });
-}
-
-function out(text = "") {
-  process.stdout.write(`${text}\n`);
-}
-
-/** Load JSON from a git object path (e.g. HEAD:package.json or :path for index). */
-function parseJsonAtRef(refPath) {
-  const raw = run(`git show ${refPath}`);
-  if (!raw) return null;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-
-function readStagedFile(path) {
-  return parseJsonAtRef(`:${path}`);
-}
-
-function readHeadFile(path) {
-  return parseJsonAtRef(`HEAD:${path}`);
-}
-
-/** Flatten all version-bearing sections from a package.json for diffing. */
-function collectDeps(pkgJson) {
-  if (!pkgJson) return {};
-  return {
-    ...(pkgJson.dependencies || {}),
-    ...(pkgJson.devDependencies || {}),
-    ...(pkgJson.peerDependencies || {}),
-    ...(pkgJson.optionalDependencies || {}),
-    ...(pkgJson.overrides || {}),
-    ...((pkgJson.pnpm && pkgJson.pnpm.overrides) || {}),
-  };
-}
-
-function normalize(version) {
-  if (typeof version !== "string") return version;
-  return version.trim();
-}
-
-function semverFrom(value) {
-  if (typeof value !== "string") return null;
-  const match = value.match(/(\d+\.\d+\.\d+)/);
-  return match ? match[1] : null;
-}
-
-/** Entry: diff staged package.json files against HEAD, then commit with a vuln-prefixed message. */
-function main() {
-  const stagedFiles = run("git diff --cached --name-only")
-    .split("\n")
-    .map((s) => s.trim())
-    .filter(Boolean);
-
-  const packageJsonPaths = stagedFiles.filter((p) => p.endsWith("package.json"));
-  if (packageJsonPaths.length === 0) {
-    out("No staged package.json changes found.");
-    process.exit(0);
-  }
-
-  const updates = [];
-
-  for (const path of packageJsonPaths) {
-    const stagedPkg = readStagedFile(path);
-    const headPkg = readHeadFile(path) || {};
-    if (!stagedPkg) continue;
-
-    const before = collectDeps(headPkg);
-    const after = collectDeps(stagedPkg);
-    const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
-
-    for (const name of keys) {
-      const oldV = normalize(before[name]);
-      const newV = normalize(after[name]);
-      if (oldV && newV && oldV !== newV) {
-        updates.push({ name, from: oldV, to: newV, path });
-      }
-    }
-  }
-
-  if (updates.length === 0) {
-    out("No staged dependency version changes found in package.json.");
-    process.exit(0);
-  }
-
-  out("Detected staged dependency updates:\n");
-  for (const u of updates) {
-    out(`- ${u.name}: ${u.from} -> ${u.to} (${u.path})`);
-  }
-
-  const commitMessage =
-    updates.length === 1
-      ? `vuln(${updates[0].name}@${semverFrom(updates[0].from) || updates[0].from}): bump to ${semverFrom(updates[0].to) || updates[0].to}`
-      : "vuln(): updated dependencies";
-  const commitBody =
-    updates.length > 1
-      ? `updated dependencies\n${updates.map((u) => `- ${u.name}: ${u.from} -> ${u.to}`).join("\n")}`
-      : "";
-
-  const hasStagedChanges = run("git diff --cached --name-only");
-  if (!hasStagedChanges) {
-    out("\nNo staged changes to commit.");
-    process.exit(1);
-  }
-
-  const escapedMessage = commitMessage.replace(/"/g, '\\"');
-  const escapedBody = commitBody.replace(/"/g, '\\"');
-  const commitCommand = commitBody
-    ? `git commit -m "${escapedMessage}" -m "${escapedBody}"`
-    : `git commit -m "${escapedMessage}"`;
-
-  out(`\nCreating commit:\n${commitMessage}\n`);
-  runOrThrow(commitCommand);
-}
-
-main();