fullshield 2.2.0 → 2.4.0

package/dist/workspaces.js

@@ -1,2 +1,3 @@
-import {existsSync,readFileSync}from'fs';import {join}from'path';function k(s,i={}){if(!i.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM!=="1")return [];let e=join(s,"package.json");if(!existsSync(e))return [];try{let r=JSON.parse(readFileSync(e,"utf8"));if(Array.isArray(r.workspaces))return r.workspaces;if(Array.isArray(r.workspaces?.packages))return r.workspaces.packages}catch{return []}let t=join(s,"pnpm-workspace.yaml");return existsSync(t)?readFileSync(t,"utf8").split(`
-`).map(r=>r.replace(/^-+\s*/,"").trim()).filter(r=>r.length>0&&!r.startsWith("packages:")):[]}export{k as listWorkspaces};
+import {existsSync,readFileSync,readdirSync}from'fs';import {join}from'path';function p(t){let e=join(t,"package.json");if(!existsSync(e))return [];try{let r=JSON.parse(readFileSync(e,"utf8"));if(Array.isArray(r.workspaces))return r.workspaces.filter(n=>typeof n=="string");if(Array.isArray(r.workspaces?.packages))return r.workspaces.packages.filter(n=>typeof n=="string")}catch{return []}let s=join(t,"pnpm-workspace.yaml");return existsSync(s)?readFileSync(s,"utf8").split(`
+`).map(r=>r.replace(/^-+\s*/,"").trim()).filter(r=>r.length>0&&!r.startsWith("packages:")):[]}function g(t,e){let s=e.replace(/\\/g,"/").replace(/^\.\//,"");if(!s.includes("*"))return [s];let r=s.indexOf("/*");if(r<0)return [];let n=s.slice(0,r);try{return readdirSync(join(t,n),{withFileTypes:!0}).filter(i=>i.isDirectory()).map(i=>`${n}/${i.name}`).sort()}catch{return []}}function m(t){let e=new Set;for(let s of p(t))for(let r of g(t,s))r!==""&&r!=="."&&e.add(r);return e.size>1}function k(t,e={}){return !e.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM!=="1"?[]:p(t)}
+export{m as isMultiWorkspaceProject,k as listWorkspaces};

package/models/index.json

@@ -1,5 +1,5 @@
 {
-  "fullshieldVersion": "2.2.0",
+  "fullshieldVersion": "2.4.0",
   "entries": [
     {
       "package": "express",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",

package/templates/action/action.yml

@@ -0,0 +1,71 @@
+name: 'FullShield Scan'
+description: >-
+  Run fullshield scan, upload SARIF to code scanning, and optionally cache the
+  baseline. Does not post a pull-request comment, open issues, or phone home.
+branding:
+  icon: shield
+  color: blue
+inputs:
+  version:
+    description: 'Pinned fullshield npm version'
+    required: false
+    default: '2.4.0'
+  fail-on:
+    description: 'Minimum severity that fails the job'
+    required: false
+    default: 'high'
+  working-directory:
+    description: 'Directory to scan'
+    required: false
+    default: '.'
+  sarif-file:
+    description: 'SARIF output path'
+    required: false
+    default: 'fullshield.sarif'
+  baseline-path:
+    description: 'Baseline file path to cache'
+    required: false
+    default: '.fullshield-baseline.json'
+  cache-baseline:
+    description: 'Cache the baseline file between runs'
+    required: false
+    default: 'true'
+  upload-sarif:
+    description: 'Upload SARIF to GitHub code scanning when permissions allow'
+    required: false
+    default: 'true'
+  args:
+    description: 'Extra arguments appended to fullshield scan'
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@v7
+      with:
+        node-version: '22'
+    - name: Install fullshield@2.4.0
+      shell: bash
+      run: npm install --global fullshield@${{ inputs.version }}
+    - name: Cache FullShield baseline
+      if: inputs.cache-baseline == 'true'
+      uses: actions/cache@v4
+      with:
+        path: ${{ inputs.working-directory }}/${{ inputs.baseline-path }}
+        key: fullshield-baseline-${{ runner.os }}-${{ hashFiles(format('{0}/package-lock.json', inputs.working-directory), format('{0}/pnpm-lock.yaml', inputs.working-directory), format('{0}/yarn.lock', inputs.working-directory)) }}
+        restore-keys: |
+          fullshield-baseline-${{ runner.os }}-
+    - name: Scan
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: >
+        fullshield scan
+        --sarif "${{ inputs.sarif-file }}"
+        --fail-on "${{ inputs.fail-on }}"
+        ${{ inputs.args }}
+    - name: Upload SARIF
+      if: always() && inputs.upload-sarif == 'true'
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: ${{ inputs.working-directory }}/${{ inputs.sarif-file }}

package/templates/fullshield.config.recommended.json

@@ -0,0 +1,8 @@
+{
+  "profile": "recommended",
+  "modules": ["deps", "secrets", "sast", "config"],
+  "failOn": "high",
+  "ignore": ["dist/**", "**/*.test.ts"],
+  "baseline": ".fullshield-baseline.json",
+  "notify": { "slackWebhookEnv": "FULLSHIELD_SLACK_WEBHOOK" }
+}

package/templates/github-workflow-action.yml

@@ -0,0 +1,21 @@
+name: FullShield
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+  security-events: write
+jobs:
+  scan:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      # Pin this Action by commit SHA in your repo after copying templates/action/.
+      # Example Marketplace ref once published: kathanp/fullshield-action@<sha>
+      - uses: ./templates/action
+        with:
+          version: '2.4.0'
+          fail-on: high
+          cache-baseline: 'true'
+          upload-sarif: 'true'

package/templates/policy/fullshield.policy.json

@@ -0,0 +1,8 @@
+{
+  "requiredModules": ["secrets", "deps", "sast", "config"],
+  "failOn": {
+    "main": "critical",
+    "*": "high"
+  },
+  "exceptions": []
+}