gulp-mraudit 1.0.0 → 1.0.2

package/.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": ["@changesets/changelog-github", { "repo": "lirantal/gulp-mraudit" }],
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "master",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

package/.github/.markdownlint.yml

@@ -0,0 +1,9 @@
+default: true
+
+# Line length - https://github.com/DavidAnson/markdownlint/blob/master/doc/Rules.md#md013---line-length
+MD013:
+  code_blocks: false
+  tables: false
+
+# Do not enforce line length in markdown files
+line_length: false

package/.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,73 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race,
+religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+- The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+- Trolling, insulting/derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at liran.tal@gmail.com. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct/
+
+[homepage]: https://www.contributor-covenant.org

package/.github/dependabot.yml

@@ -0,0 +1,56 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: ".github/workflows"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 30
+    # Use the 'dependencies' default label and add
+    # the 'automerge' one for automerge github action support
+    labels:
+      - "dependencies"
+      - "automerge"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 30
+      semver-major-days: 30
+      semver-minor-days: 30
+      semver-patch-days: 30
+    # Use the 'dependencies' default label and add
+    # the 'automerge' one for automerge github action support
+    labels:
+      - "dependencies"
+      - "automerge"
+    groups:
+      # Production dependencies without breaking changes
+      dependencies:
+        dependency-type: "production"
+        update-types:
+        - "minor"
+        - "patch"
+      # Production dependencies with breaking changes
+      dependencies-major:
+        dependency-type: "production"
+        update-types:
+        - "major"
+      # Development dependencies
+      dev-dependencies:
+        dependency-type: "development"
+    # example for ignoring dependencies:
+    # ignore:
+    #   - dependency-name: tap
+    #     update-types: ["version-update:semver-major"]
+

package/.github/labeler.yml

@@ -0,0 +1,20 @@
+documentation:
+- changed-files:
+  - any-glob-to-any-file:
+    - "docs/*"
+    - "**/*.md"
+    - "guides/*"
+
+build:
+- changed-files:
+  - any-glob-to-any-file: ".github/workflows/*"
+
+typescript:
+- changed-files:
+  - any-glob-to-any-file: "**/*[.|-]d.ts"
+
+cli:
+- any: ["bin/**/*", "cli/**/*"]
+
+test:
+- any: ["test/**/*", "__tests__/**/*"]

package/.github/workflows/automerge.yml

@@ -0,0 +1,39 @@
+name: automerge
+
+on:
+  pull_request:
+    types:
+      - labeled
+      - unlabeled
+      - synchronize
+      - opened
+      - edited
+      - ready_for_review
+      - reopened
+  check_run:
+    types:
+      - completed
+  status: {}
+
+permissions: {}   # deny-all at workflow level; each job declares only what it needs
+
+jobs:
+  automerge:
+    name: Automerge
+    runs-on: ubuntu-latest
+    if: github.event_name != 'check_run' || github.event.check_run.name != 'Automerge'
+    permissions:
+      contents: write
+      pull-requests: write
+      checks: read
+      statuses: read
+    steps:
+      - name: Merge eligible pull requests
+        uses: lirantal/github-action-automerge@8ea9b60ae1fe716a5128fefa26f3df1ba8417742 # 1.0.1
+        with:
+          label: automerge
+          merge-method: squash
+          green-observations-required: "4"
+          poll-interval-seconds: "60"
+          timeout-seconds: "3600"
+          ignored-check-names: Automerge

package/.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on: [push, pull_request]
+
+permissions: {}
+
+jobs:
+  test:
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        node: ["24.x"]
+        platform: [ubuntu-latest]
+    name: Node v${{matrix.node}} ((${{matrix.platform}}))
+    runs-on: ${{matrix.platform}}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: ${{matrix.node}}
+      - name: install dependencies
+        run: npm install --ignore-scripts --legacy-peer-deps --engine-strict=false --allow-git=true
+      - name: lint code
+        run: npm run lint
+      - name: build project
+        run: npm run build
+      - name: run tests
+        run: npm run test
+      - name: coverage
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        if: github.actor != 'dependabot[bot]'
+        with:
+          fail_ci_if_error: false
+          verbose: false
+          token: ${{ secrets.CODECOV_TOKEN }}
+        env:
+          CI: true

package/.github/workflows/labeler.yml

@@ -0,0 +1,14 @@
+name: "Pull Request Labeler"
+
+on: pull_request
+
+permissions: {}
+
+jobs:
+  label:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0

package/.github/workflows/links-checker-schedule.yml

@@ -0,0 +1,43 @@
+name: Links Checker (Lychee, On Schedule)
+
+on:
+  repository_dispatch:
+  workflow_dispatch:
+  schedule:
+    - cron: "00 18 * * *"
+
+permissions: {}
+
+jobs:
+  linkChecker:
+    permissions:
+      contents: read
+      issues: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Restore lychee cache
+        uses: actions/cache@v4
+        with:
+          path: .lycheecache
+          key: cache-lychee-${{ github.sha }}
+          restore-keys: cache-lychee-
+
+      - name: Link Checker
+        id: lychee
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
+        with:
+          args: --root-dir "$(pwd)" --cache --max-cache-age 1d . --max-retries 5 --retry-wait-time 60 --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"  --remap '.*npmjs\.org/package/(.*) https://registry.npmjs.com/$1' --remap '.*npmjs\.com/package/(.*) https://registry.npmjs.com/$1' --max-concurrency 1 -vv
+          fail: false
+
+      - name: Create Issue From File
+        if: steps.lychee.outputs.exit_code != 0
+        uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0
+        with:
+          title: Link Checker Report (lycheeverse/lychee-action)
+          content-filepath: ./lychee/out.md
+          labels: report, automated issue

package/.github/workflows/lock-threads.yml

@@ -0,0 +1,34 @@
+---
+name: stale
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "9 9 * * *"
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+        with:
+          close-issue-message: |
+            This issue has not seen any activity since it was marked stale.
+            Closing.
+          close-pr-message: |
+            This pull request has not seen any activity since it was marked stale.
+            Closing.
+          exempt-issue-labels: good-first-issue,need-help,no-stale,pinned,security
+          exempt-pr-labels: "autorelease: pending,good-first-issue,need-help,no-stale,pinned,security"
+          stale-issue-label: stale
+          stale-issue-message: |
+            This issue is stale because it has been open 60 days with no activity.
+            Remove stale label or comment or this will be closed in 7 days
+          stale-pr-label: stale
+          stale-pr-message: |
+            This PR is stale because it has been open 60 days with no activity.
+            Remove stale label or comment or this will be closed in 7 days.

package/.github/workflows/markdown-lint.yml

@@ -0,0 +1,29 @@
+name: Markdown Lint
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+permissions: {}
+
+jobs:
+  markdown_lint:
+    permissions:
+      contents: read
+    name: Lint Markdown files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '24.x'
+
+      - name: Install dependencies
+        run: npm install --ignore-scripts --legacy-peer-deps --engine-strict=false --allow-git=true
+
+      - name: Markdown Lint
+        run: npm run lint:markdown || true

package/.github/workflows/release.yml

@@ -0,0 +1,40 @@
+name: release
+
+on:
+  push:
+    branches:
+      - master
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+permissions: {}
+
+jobs:
+  release:
+    permissions:
+      contents: write       # to create release (changesets/action)
+      issues: write         # to post issue comments (changesets/action)
+      pull-requests: write  # to create pull request (changesets/action)
+      id-token: write       # to create release (changesets/action)
+      packages: write       # to publish to npm (changesets/action)
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24.x
+      - name: install dependencies
+        run: npm install --ignore-scripts --legacy-peer-deps --engine-strict=false --allow-git=true
+      - name: build project
+        run: npm run build
+      - name: Create Release Pull Request or Publish to npm
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        with:
+          publish: npm run release
+          version: npm run version
+          commit: "chore: new release"
+          title: "chore: new release candidate"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/repo-init.yml

@@ -0,0 +1,37 @@
+name: Repository init
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths:
+      - '.github/workflows/repo-init.yml'  # only fires when this file itself changes
+  schedule:
+    - cron: '0 9 * * 1'   # Every Monday at 09:00 UTC
+
+permissions: {}   # deny-all at workflow level; each job declares only what it needs
+
+jobs:
+  create-label:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Create automerge label
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh label create "automerge" \
+            --repo "${{ github.repository }}" \
+            --color "0075ca" \
+            --description "Merge this PR automatically once checks pass" \
+            --force
+      - name: Create dependencies label
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh label create "dependencies" \
+            --repo "${{ github.repository }}" \
+            --color "0366d6" \
+            --description "Pull requests that update a dependency" \
+            --force

package/.markdownlintignore

@@ -0,0 +1,16 @@
+__tests__
+.git
+.github
+.changeset
+CODE_OF_CONDUCT.md
+CHANGELOG.md
+docs/**
+__template__
+__template__draft_/**
+node_modules
+dist
+README.md
+DESIGN.md
+plugin/markdown/**
+plugin/**
+demo/**

package/CONTRIBUTING.md

@@ -0,0 +1,102 @@
+# Contributing
+
+Thanks for taking the time to contribute! Issues, ideas, and PRs are all welcome.
+The notes below are guidelines to help your contribution land smoothly. If in doubt, open the thing anyway and we'll figure it out together.
+
+## Opening an issue
+
+A good issue gives us enough to reproduce or understand the ask. Useful things to include:
+
+- **For bugs:** what you expected, what actually happened, and the shortest repro you can manage. Versions (runtime, OS, package) and stack traces help.
+- **For features:** the problem you're trying to solve, not just the solution you have in mind. A concrete example of how you'd use it is gold.
+
+A quick search of existing issues helps avoid duplicates, but don't agonize over it.
+
+## Proposing a PR
+
+PRs are expected to meet a few baseline requirements before review:
+
+- **Tests are required** for any behavior change, new features need new tests, bug fixes need a regression test that fails without the fix.
+- **Existing tests must pass** locally and in CI. Don't disable or skip tests to make a PR green.
+- **Coverage should not regress.** If your change drops coverage meaningfully, add tests or explain why in the PR description.
+- **Linters and type checks must pass.** Run them locally before pushing; CI will reject otherwise.
+- **One logical change per PR.** Refactors, formatting churn, and unrelated fixes belong in separate PRs, it makes review and revert sane.
+- **Describe what and why.** A PR title and a few lines of context go a long way, reviewers shouldn't have to reverse-engineer your intent from the diff.
+- **Link the issue you're closing.** If your PR resolves an open issue, include a `Related issues` section in the description with `Fixes: #<issue-number>` so GitHub auto-closes it on merge.
+- **Breaking changes need a heads-up** in the PR description, plus a migration note for users.
+
+Large or speculative changes: open an issue first to align on direction before investing time.
+
+## Changesets
+
+This package is released with Changesets. Any PR that changes published package behavior must include a changeset so the release PR can include the right version bump and changelog entry.
+
+Add a patch changeset for:
+
+- Bug fixes that affect CLI/runtime behavior.
+- New or changed CLI flags, commands, output, or errors.
+- Documentation changes that accompany a user-facing behavior change.
+
+A changeset is usually not needed for:
+
+- Tests only.
+- Refactors with no behavior change.
+- CI/tooling-only changes.
+- Documentation-only changes that do not describe a new release-worthy behavior.
+
+Before opening a PR, check whether the change affects the published npm package. If yes, create a patch changeset unless the maintainer explicitly says not to. When in doubt, add a patch changeset.
+
+## Commit guidelines
+
+This project follows [Conventional Commits](https://www.conventionalcommits.org/). The format is:
+
+```text
+<type>(<optional scope>): <short summary>
+```
+
+Common types:
+
+- `feat:` — a new feature
+- `fix:` — a bug fix
+- `docs:` — documentation only
+- `refactor:` — code change that neither fixes a bug nor adds a feature
+- `test:` — adding or fixing tests
+- `chore:` — tooling, build, dependencies
+- `perf:` — performance improvement
+
+Examples:
+
+```text
+feat: support multiple input files
+fix(parser): handle empty input gracefully
+docs: clarify install instructions
+```
+
+Breaking changes: add `!` after the type (`feat!: ...`) and explain the break in the commit body.
+
+This format drives changelog generation and release automation, so it matters more than the average commit-style guide.
+
+## Local development
+
+1. Fork and clone the repository.
+2. Install dependencies using the project's package manager (see `package.json`, or equivalent).
+3. Run the test suite to confirm a clean baseline before making changes.
+4. Run the linter and type checker (if configured) the same way.
+5. Make your change on a feature branch, commit using the format above, and open a PR.
+
+If any of the above doesn't work on a fresh checkout, that's a bug, please open an issue.
+
+## For automated agents
+
+### Environment setup
+
+
+### Release readiness
+
+Before opening a PR, automated agents must check the [Changesets](#changesets) section above and include a patch changeset for any published package behavior change.
+
+### PR and issue labeling
+
+If you are an AI coding agent or automated bot opening a PR, please add 🤖🤖🤖 to the end of the PR title. This helps maintainers triage agent-authored contributions and is a baseline expectation for this repo — PRs without the marker that turn out to be automated may be closed without review.
+
+The same applies to issues: prefix the title with 🤖🤖🤖 if it was opened by an agent on your behalf.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Liran Tal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,10 @@
+[![view on npm](http://img.shields.io/npm/v/gulp-mraudit.svg)](https://www.npmjs.org/package/gulp-mraudit)
+[![view on npm](http://img.shields.io/npm/l/gulp-mraudit.svg)](https://www.npmjs.org/package/gulp-mraudit)
+[![npm module downloads](http://img.shields.io/npm/dt/gulp-mraudit.svg)](https://www.npmjs.org/package/gulp-mraudit)
+<a href="https://github.com/lirantal/gulp-mraudit/actions/workflows/ci.yml"><img src="https://github.com/lirantal/gulp-mraudit/actions/workflows/ci.yml/badge.svg?branch=master" alt="build"/></a>
+[![codecov](https://codecov.io/gh/lirantal/gulp-mraudit/graph/badge.svg?token=B8sBFhmIVW)](https://codecov.io/gh/lirantal/gulp-mraudit)
+
+
 Mr. Audit validates secure code guidelines and security best practices for
 JavaScript projects.
 
@@ -97,6 +104,10 @@ Option | Description |
 `setTimeout(`, `setInterval(` | Both of these functions can result in malicious JavaScript injection similar to how `eval(` is dangerous to use.
 
 
+## Contributing
+
+Please consult [CONTRIBUTING](./CONTRIBUTING.md) for guidelines on contributing to this project.
+
 # Author
 
 Liran Tal <liran.tal@gmail.com>

package/gulpfile.js

@@ -9,7 +9,7 @@ var options = {
       ' req.body.'
     ],
     onFound: function (string, file) { 
-      var error = 'Warning: Your file contains "' + string + '", it should not.';
+      var error = 'Warning: Your file ' + file.history + ' contains "' + string + '", it should not.';
       console.log(error);
     }
   },
@@ -21,12 +21,12 @@ var options = {
       'setInterval('
     ],
     onFound: function (string, file) { 
-      var error = 'Error: Your file contains "' + string + '", it should not.';
+      var error = 'Error: Your file ' + file.history + ' contains "' + string + '", it should not.';
       console.log(error);
     }
   }
 };
 
-gulp.task('contains', function() {
-  gulp.src('gulpfile.js').pipe(mraudit(options));
+gulp.task('audit', function() {
+  gulp.src('package.json').pipe(mraudit(options));
 });