putitoutthere 0.1.30 → 0.1.32
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +12 -1
- package/dist/cli.js.map +1 -1
- package/dist/doctor.d.ts +24 -0
- package/dist/doctor.d.ts.map +1 -1
- package/dist/doctor.js +45 -0
- package/dist/doctor.js.map +1 -1
- package/dist/env.d.ts +15 -0
- package/dist/env.d.ts.map +1 -1
- package/dist/env.js +81 -0
- package/dist/env.js.map +1 -1
- package/dist/handlers/crates.d.ts.map +1 -1
- package/dist/handlers/crates.js +6 -5
- package/dist/handlers/crates.js.map +1 -1
- package/dist/handlers/npm-platform.d.ts.map +1 -1
- package/dist/handlers/npm-platform.js +3 -2
- package/dist/handlers/npm-platform.js.map +1 -1
- package/dist/handlers/npm.d.ts.map +1 -1
- package/dist/handlers/npm.js +4 -5
- package/dist/handlers/npm.js.map +1 -1
- package/dist/handlers/pypi.js +5 -5
- package/dist/handlers/pypi.js.map +1 -1
- package/dist/log.d.ts +34 -6
- package/dist/log.d.ts.map +1 -1
- package/dist/log.js +84 -19
- package/dist/log.js.map +1 -1
- package/dist/oidc-policy.d.ts +102 -0
- package/dist/oidc-policy.d.ts.map +1 -0
- package/dist/oidc-policy.js +289 -0
- package/dist/oidc-policy.js.map +1 -0
- package/dist/token.d.ts +9 -1
- package/dist/token.d.ts.map +1 -1
- package/dist/token.js +6 -1
- package/dist/token.js.map +1 -1
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pypi.js","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"pypi.js","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC,KAAK,UAAU,eAAe,CAC5B,GAAoC,EACpC,OAAe,EACf,IAAS;IAET,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,GAAG,QAAQ,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;KACtC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,cAAc,CAAC,gBAAgB,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yFAAyF;IACzF,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAoC,EACpC,OAAe,EACf,GAAQ;IAER,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACvD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,6EAA6E;IAC7E,sEAAsE;IACtE,6EAA6E;IAC7E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,aAAa,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,OAAO,GAAI,MAA8C,EAAE,OAAO,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,uGAAuG,CACxG,CACF,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,GAAG,GAAG,4GAA4G,CACnH,CAAC;QACF,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CAAC,GAAY,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAkD,EAClD,OAAe,EACf,GAAQ;IAER,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,aAAa,IAAI,uBAAuB,EAAE,CACjG,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,6DAA6D;IAC7D,mEAAmE;IACnE,yDAAyD;IACzD,oBAAoB;IACpB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,SAAS,IAAI,aAAa,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb;YACE,kCAAkC;YAClC,gDAAgD;YAChD,2HAA2H;YAC3H,kEAAkE;YAClE,eAAe;YACf,4EAA4E;SAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,SAAS,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,yCAAyC,CAC3G,CAAC;IAEF,IAAI,CAAC;QACH,YAAY,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,GAAG,KAAK,CAAC,EAAE;YACzF,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,gEAAgE;YAChE,YAAY;YACZ,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC/B,cAAc,EAAE,WAAW;gBAC3B,cAAc,EAAE,KAAK;aACtB,CAAC;YACF,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,GAAG,QAAQ,YAAY,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG;KAC3D,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,SAAS,WAAW,CAAC,GAAoC;IACvD,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,GAAQ;IACnC,MAAM,MAAM,GACV,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACrD,MAAM,QAAQ,GACZ,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAChD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE;QACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,EAAE,EAAE;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,uCAAuC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAuB,CAAC;IACpE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,oBAAoB,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuB,CAAC;IAC9D,OAAO,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,OAAe;IACrE,MAAM,EAAE,GAAG,uDAAuD,CAAC;IACnE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAwD,CAAC;IAC9F,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,OAA8B;IACnE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAe,EAAE,aAAiC;IAC1E,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC;YAAE,SAAS;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACvC,4EAA4E;QAC5E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QAC3C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAY;IAC3B,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,eAAyC;IACtD,YAAY,EAAE,gBAA2C;IACzD,OAAO,EAAE,WAAiC;CAC3C,CAAC"}
|
package/dist/log.d.ts
CHANGED
|
@@ -4,24 +4,50 @@
|
|
|
4
4
|
* JSON-per-line output in CI; human-readable text in TTYs. Every emitted
|
|
5
5
|
* line is passed through a redactor that replaces any occurrence of a
|
|
6
6
|
* known-secret env value (keys matching *TOKEN* / *SECRET* / *PASSWORD*
|
|
7
|
-
* / *KEY*, case-insensitive) with `[REDACTED:<digest>]`,
|
|
8
|
-
* is a stable 8-hex-char SHA-256 prefix (#134).
|
|
9
|
-
* rotated tokens across log lines without ever
|
|
7
|
+
* / *KEY* / *PASS* / *PAT*, case-insensitive) with `[REDACTED:<digest>]`,
|
|
8
|
+
* where `<digest>` is a stable 8-hex-char SHA-256 prefix (#134).
|
|
9
|
+
* Operators can correlate rotated tokens across log lines without ever
|
|
10
|
+
* seeing the value.
|
|
10
11
|
*
|
|
11
12
|
* Substring redaction (rather than Pino-style field-path redaction) is
|
|
12
13
|
* deliberate: handlers capture child-process stdout/stderr and feed it
|
|
13
14
|
* through the logger. A token leaked inside that stream must not escape
|
|
14
15
|
* to CI logs regardless of which field it ended up in.
|
|
15
16
|
*
|
|
17
|
+
* Sources scanned:
|
|
18
|
+
* - `process.env` (always)
|
|
19
|
+
* - any additional `envSources` passed to `createLogger` (#136), so
|
|
20
|
+
* credentials injected into a per-call `ctx.env` object (rather than
|
|
21
|
+
* the process env) are redacted too.
|
|
22
|
+
*
|
|
23
|
+
* Performance (#141): the redaction set is cached per-source object by
|
|
24
|
+
* identity in a WeakMap, keyed by a cheap content signature. Back-to-back
|
|
25
|
+
* log calls re-use the cached entries; env is re-walked only when a
|
|
26
|
+
* source object's size/contents change.
|
|
27
|
+
*
|
|
28
|
+
* Length floor (#137): values shorter than 8 chars are skipped even when
|
|
29
|
+
* their env-var name matches a known-secret pattern. Real registry
|
|
30
|
+
* tokens comfortably clear this; short values (`CI=1`, a boolean flag)
|
|
31
|
+
* cause far more harm by mangling every occurrence of that character in
|
|
32
|
+
* the log stream than they are worth defending as credentials.
|
|
33
|
+
*
|
|
16
34
|
* Issue #11. Plan: §22.2, §22.5.
|
|
17
35
|
*/
|
|
18
36
|
import type { Writable } from 'node:stream';
|
|
19
37
|
import type { Logger } from './types.js';
|
|
20
38
|
export type Level = 'debug' | 'info' | 'warn' | 'error';
|
|
39
|
+
export type EnvSource = Record<string, string | undefined>;
|
|
21
40
|
export interface LoggerOptions {
|
|
22
41
|
stream?: Writable;
|
|
23
42
|
pretty?: boolean;
|
|
24
43
|
level?: Level;
|
|
44
|
+
/**
|
|
45
|
+
* Additional env-like objects to scan for secrets, alongside
|
|
46
|
+
* `process.env`. Credentials are frequently injected into `ctx.env`
|
|
47
|
+
* rather than the process env (#136), so callers can pass `ctx.env`
|
|
48
|
+
* here to make the redactor see them.
|
|
49
|
+
*/
|
|
50
|
+
envSources?: readonly EnvSource[];
|
|
25
51
|
}
|
|
26
52
|
export declare function createLogger(opts?: LoggerOptions): Logger;
|
|
27
53
|
/**
|
|
@@ -29,8 +55,10 @@ export declare function createLogger(opts?: LoggerOptions): Logger;
|
|
|
29
55
|
* `[REDACTED:<digest>]` where `<digest>` is a stable 8-hex-char
|
|
30
56
|
* SHA-256 prefix of the token. Operators can correlate rotated
|
|
31
57
|
* tokens across log lines without ever seeing the value itself.
|
|
32
|
-
*
|
|
33
|
-
*
|
|
58
|
+
*
|
|
59
|
+
* Sources default to `[process.env]`. Callers (e.g. `createLogger`)
|
|
60
|
+
* pass additional per-ctx env objects so credentials that never touched
|
|
61
|
+
* `process.env` still redact (#136).
|
|
34
62
|
*/
|
|
35
|
-
export declare function redact(s: string): string;
|
|
63
|
+
export declare function redact(s: string, sources?: readonly EnvSource[]): string;
|
|
36
64
|
//# sourceMappingURL=log.d.ts.map
|
package/dist/log.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AASxD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CACnC;AAED,wBAAgB,YAAY,CAAC,IAAI,GAAE,aAAkB,GAAG,MAAM,CAyB7D;AAsFD;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CACpB,CAAC,EAAE,MAAM,EACT,OAAO,GAAE,SAAS,SAAS,EAA+B,GACzD,MAAM,CAYR"}
|
package/dist/log.js
CHANGED
|
@@ -4,15 +4,33 @@
|
|
|
4
4
|
* JSON-per-line output in CI; human-readable text in TTYs. Every emitted
|
|
5
5
|
* line is passed through a redactor that replaces any occurrence of a
|
|
6
6
|
* known-secret env value (keys matching *TOKEN* / *SECRET* / *PASSWORD*
|
|
7
|
-
* / *KEY*, case-insensitive) with `[REDACTED:<digest>]`,
|
|
8
|
-
* is a stable 8-hex-char SHA-256 prefix (#134).
|
|
9
|
-
* rotated tokens across log lines without ever
|
|
7
|
+
* / *KEY* / *PASS* / *PAT*, case-insensitive) with `[REDACTED:<digest>]`,
|
|
8
|
+
* where `<digest>` is a stable 8-hex-char SHA-256 prefix (#134).
|
|
9
|
+
* Operators can correlate rotated tokens across log lines without ever
|
|
10
|
+
* seeing the value.
|
|
10
11
|
*
|
|
11
12
|
* Substring redaction (rather than Pino-style field-path redaction) is
|
|
12
13
|
* deliberate: handlers capture child-process stdout/stderr and feed it
|
|
13
14
|
* through the logger. A token leaked inside that stream must not escape
|
|
14
15
|
* to CI logs regardless of which field it ended up in.
|
|
15
16
|
*
|
|
17
|
+
* Sources scanned:
|
|
18
|
+
* - `process.env` (always)
|
|
19
|
+
* - any additional `envSources` passed to `createLogger` (#136), so
|
|
20
|
+
* credentials injected into a per-call `ctx.env` object (rather than
|
|
21
|
+
* the process env) are redacted too.
|
|
22
|
+
*
|
|
23
|
+
* Performance (#141): the redaction set is cached per-source object by
|
|
24
|
+
* identity in a WeakMap, keyed by a cheap content signature. Back-to-back
|
|
25
|
+
* log calls re-use the cached entries; env is re-walked only when a
|
|
26
|
+
* source object's size/contents change.
|
|
27
|
+
*
|
|
28
|
+
* Length floor (#137): values shorter than 8 chars are skipped even when
|
|
29
|
+
* their env-var name matches a known-secret pattern. Real registry
|
|
30
|
+
* tokens comfortably clear this; short values (`CI=1`, a boolean flag)
|
|
31
|
+
* cause far more harm by mangling every occurrence of that character in
|
|
32
|
+
* the log stream than they are worth defending as credentials.
|
|
33
|
+
*
|
|
16
34
|
* Issue #11. Plan: §22.2, §22.5.
|
|
17
35
|
*/
|
|
18
36
|
import { createHash } from 'node:crypto';
|
|
@@ -28,14 +46,17 @@ export function createLogger(opts = {}) {
|
|
|
28
46
|
/* v8 ignore next -- tests always pass an explicit stream */
|
|
29
47
|
const stream = opts.stream ?? process.stderr;
|
|
30
48
|
const pretty = opts.pretty ?? isTty(stream);
|
|
31
|
-
/* v8 ignore next -- 'info' default vs explicit level both exercised; the ?? branch is one of those */
|
|
32
49
|
const minLevel = LEVEL_ORDER[opts.level ?? 'info'];
|
|
50
|
+
const sources = [
|
|
51
|
+
process.env,
|
|
52
|
+
...(opts.envSources ?? []),
|
|
53
|
+
];
|
|
33
54
|
const emit = (level, msg, fields) => {
|
|
34
55
|
if (LEVEL_ORDER[level] < minLevel)
|
|
35
56
|
return;
|
|
36
57
|
const record = { level, time: new Date().toISOString(), msg, ...fields };
|
|
37
58
|
const raw = pretty ? formatPretty(record) : `${JSON.stringify(record)}\n`;
|
|
38
|
-
stream.write(redact(raw));
|
|
59
|
+
stream.write(redact(raw, sources));
|
|
39
60
|
};
|
|
40
61
|
return {
|
|
41
62
|
debug: (msg, fields = {}) => emit('debug', msg, fields),
|
|
@@ -64,27 +85,71 @@ function formatScalar(v) {
|
|
|
64
85
|
return JSON.stringify(v);
|
|
65
86
|
}
|
|
66
87
|
/* ----------------------------- redaction ----------------------------- */
|
|
67
|
-
const SECRET_KEY = /TOKEN|SECRET|PASSWORD|KEY/i;
|
|
88
|
+
const SECRET_KEY = /TOKEN|SECRET|PASSWORD|KEY|PASS|PAT/i;
|
|
89
|
+
const MIN_OPAQUE_LEN = 8;
|
|
90
|
+
const SCAN_CACHE = new WeakMap();
|
|
91
|
+
function scanSource(src) {
|
|
92
|
+
// Cheap signature-of-env to detect in-place mutation. Accumulates a
|
|
93
|
+
// small multiplicative hash over each key name + value length + key's
|
|
94
|
+
// first byte; distinguishes renames and equal-length swaps that a
|
|
95
|
+
// plain count+length sum would miss. Keeping the per-call cost below
|
|
96
|
+
// the full scan is what makes #141 a real win.
|
|
97
|
+
const keys = Object.keys(src);
|
|
98
|
+
let acc = keys.length;
|
|
99
|
+
for (const k of keys) {
|
|
100
|
+
const v = src[k] ?? '';
|
|
101
|
+
acc = (acc * 31 + k.length + v.length + k.charCodeAt(0)) | 0;
|
|
102
|
+
}
|
|
103
|
+
const sig = `${keys.length}:${acc}`;
|
|
104
|
+
const cached = SCAN_CACHE.get(src);
|
|
105
|
+
if (cached !== undefined && cached.sig === sig)
|
|
106
|
+
return cached.values;
|
|
107
|
+
const values = [];
|
|
108
|
+
for (const k of keys) {
|
|
109
|
+
const v = src[k];
|
|
110
|
+
// `undefined` is rare (read-after-delete race in tests). Treat
|
|
111
|
+
// as absent; skip without a dedicated branch so coverage stays
|
|
112
|
+
// tight.
|
|
113
|
+
if (!v)
|
|
114
|
+
continue;
|
|
115
|
+
if (!SECRET_KEY.test(k))
|
|
116
|
+
continue;
|
|
117
|
+
// #137 length floor. Short values mangle every matching character
|
|
118
|
+
// in unrelated log text. Real tokens clear 8 easily; short values
|
|
119
|
+
// that happen to share a name shape with a credential aren't worth
|
|
120
|
+
// defending.
|
|
121
|
+
if (v.length < MIN_OPAQUE_LEN)
|
|
122
|
+
continue;
|
|
123
|
+
values.push(v);
|
|
124
|
+
}
|
|
125
|
+
// Longest-first: redacting a substring first would leave the
|
|
126
|
+
// superset's leftover fragment unredacted in the output.
|
|
127
|
+
values.sort((a, b) => b.length - a.length);
|
|
128
|
+
const entry = { sig, values };
|
|
129
|
+
SCAN_CACHE.set(src, entry);
|
|
130
|
+
return values;
|
|
131
|
+
}
|
|
68
132
|
/**
|
|
69
133
|
* Replace every occurrence of a known-secret env value with
|
|
70
134
|
* `[REDACTED:<digest>]` where `<digest>` is a stable 8-hex-char
|
|
71
135
|
* SHA-256 prefix of the token. Operators can correlate rotated
|
|
72
136
|
* tokens across log lines without ever seeing the value itself.
|
|
73
|
-
*
|
|
74
|
-
*
|
|
137
|
+
*
|
|
138
|
+
* Sources default to `[process.env]`. Callers (e.g. `createLogger`)
|
|
139
|
+
* pass additional per-ctx env objects so credentials that never touched
|
|
140
|
+
* `process.env` still redact (#136).
|
|
75
141
|
*/
|
|
76
|
-
export function redact(s) {
|
|
142
|
+
export function redact(s, sources = [process.env]) {
|
|
77
143
|
let out = s;
|
|
78
|
-
for (const
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
out = out.split(v).join(`[REDACTED:${sha256Prefix(v)}]`);
|
|
144
|
+
for (const src of sources) {
|
|
145
|
+
for (const v of scanSource(src)) {
|
|
146
|
+
if (!out.includes(v))
|
|
147
|
+
continue;
|
|
148
|
+
// String.replaceAll expects a literal or a RegExp; use split/join to
|
|
149
|
+
// avoid regex escaping every secret value. Repeats across sources
|
|
150
|
+
// are a no-op (the value's already gone after the first pass).
|
|
151
|
+
out = out.split(v).join(`[REDACTED:${sha256Prefix(v)}]`);
|
|
152
|
+
}
|
|
88
153
|
}
|
|
89
154
|
return out;
|
|
90
155
|
}
|
package/dist/log.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,MAAM,WAAW,GAA0B;IACzC,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACV,CAAC;AAiBF,MAAM,UAAU,YAAY,CAAC,OAAsB,EAAE;IACnD,+DAA+D;IAC/D,kDAAkD;IAClD,4DAA4D;IAC5D,MAAM,MAAM,GAAa,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC;IACnD,MAAM,OAAO,GAAyB;QACpC,OAAO,CAAC,GAAgB;QACxB,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;KAC3B,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,KAAY,EAAE,GAAW,EAAE,MAA+B,EAAQ,EAAE;QAChF,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,QAAQ;YAAE,OAAO;QAC1C,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;QACvD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;QACrD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;QACrD,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAgB;IAC7B,OAAO,OAAO,CAAE,MAA8B,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B;IACnD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC;IAClD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;AAClG,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,oFAAoF;IACpF,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAE3E,MAAM,UAAU,GAAG,qCAAqC,CAAC;AACzD,MAAM,cAAc,GAAG,CAAC,CAAC;AAmBzB,MAAM,UAAU,GAAG,IAAI,OAAO,EAAsB,CAAC;AAErD,SAAS,UAAU,CAAC,GAAc;IAChC,oEAAoE;IACpE,sEAAsE;IACtE,kEAAkE;IAClE,qEAAqE;IACrE,+CAA+C;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvB,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IAErE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,+DAA+D;QAC/D,+DAA+D;QAC/D,SAAS;QACT,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QAClC,kEAAkE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,aAAa;QACb,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc;YAAE,SAAS;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,6DAA6D;IAC7D,yDAAyD;IACzD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACvC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CACpB,CAAS,EACT,UAAgC,CAAC,OAAO,CAAC,GAAgB,CAAC;IAE1D,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC/B,qEAAqE;YACrE,kEAAkE;YAClE,+DAA+D;YAC/D,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;yDAGyD;AACzD,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC"}
|
|
@@ -0,0 +1,102 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* OIDC trust-policy local validation.
|
|
3
|
+
*
|
|
4
|
+
* `doctor` uses this module to check the locally-knowable structural
|
|
5
|
+
* prerequisites of OIDC trusted publishing:
|
|
6
|
+
*
|
|
7
|
+
* 1. At least one `.github/workflows/*.yml` file invokes either
|
|
8
|
+
* `putitoutthere publish` (as a `run:` command) or the composite
|
|
9
|
+
* action `thekevinscott/put-it-out-there@...` with a `command:`
|
|
10
|
+
* input that implies publishing.
|
|
11
|
+
* 2. That workflow's publishing job has `permissions: id-token: write`
|
|
12
|
+
* and `contents: write` (either job-level or workflow-level).
|
|
13
|
+
* 3. The publishing job has an `environment:` key set. We cannot
|
|
14
|
+
* validate the *value* against the registry's trust policy — that
|
|
15
|
+
* requires a registry-policy-read API per registry, which is
|
|
16
|
+
* deferred (Option C, see follow-up to #162).
|
|
17
|
+
* 4. A clearly-identifiable publish step exists — defends against
|
|
18
|
+
* edge cases like commented-out steps slipping past (1).
|
|
19
|
+
*
|
|
20
|
+
* The parser is intentionally regex/line-based rather than a full YAML
|
|
21
|
+
* parse: the four checks above all reduce to substring/indentation
|
|
22
|
+
* matches within a single jobs block. Adding a YAML dependency would
|
|
23
|
+
* buy us very little here. If the check set grows beyond this (e.g.
|
|
24
|
+
* "validate the environment value against a registry's trust policy"),
|
|
25
|
+
* revisit.
|
|
26
|
+
*
|
|
27
|
+
* Issue #162 — Option D (locally-knowable checks only).
|
|
28
|
+
*/
|
|
29
|
+
export interface WorkflowFile {
|
|
30
|
+
/** Absolute path to the workflow file on disk. */
|
|
31
|
+
path: string;
|
|
32
|
+
/** Basename, e.g. `release.yml`. */
|
|
33
|
+
filename: string;
|
|
34
|
+
/** Full file contents. */
|
|
35
|
+
source: string;
|
|
36
|
+
/** Parsed jobs (best-effort; top-level job keys + their raw bodies). */
|
|
37
|
+
jobs: WorkflowJob[];
|
|
38
|
+
/** Workflow-level `permissions:` block contents (empty if none). */
|
|
39
|
+
workflowPermissions: string;
|
|
40
|
+
}
|
|
41
|
+
export interface WorkflowJob {
|
|
42
|
+
/** Job key, e.g. `publish`. */
|
|
43
|
+
name: string;
|
|
44
|
+
/** Raw source of just that job block (everything indented under it). */
|
|
45
|
+
source: string;
|
|
46
|
+
}
|
|
47
|
+
export interface PermissionIssue {
|
|
48
|
+
kind: 'missing-permission';
|
|
49
|
+
workflow: string;
|
|
50
|
+
job: string;
|
|
51
|
+
permission: 'id-token: write' | 'contents: write';
|
|
52
|
+
}
|
|
53
|
+
export interface EnvironmentIssue {
|
|
54
|
+
kind: 'missing-environment';
|
|
55
|
+
workflow: string;
|
|
56
|
+
job: string;
|
|
57
|
+
}
|
|
58
|
+
export interface InvocationIssue {
|
|
59
|
+
kind: 'no-publish-step';
|
|
60
|
+
workflow: string;
|
|
61
|
+
}
|
|
62
|
+
/**
|
|
63
|
+
* Scan `.github/workflows/*.yml` and `*.yaml` for workflows that invoke
|
|
64
|
+
* `putitoutthere publish` or the composite action in a publish mode.
|
|
65
|
+
*
|
|
66
|
+
* Permissive by design: if a workflow *mentions* piot in any way that
|
|
67
|
+
* looks like publishing, include it. Downstream checks then report
|
|
68
|
+
* specifically. The cost of a false-positive is a spurious pass/fail
|
|
69
|
+
* line in `doctor`; the cost of a false-negative is silently missing
|
|
70
|
+
* the user's real publish workflow.
|
|
71
|
+
*/
|
|
72
|
+
export declare function findPublishWorkflows(repoRoot: string): WorkflowFile[];
|
|
73
|
+
/**
|
|
74
|
+
* Best-effort jobs parser. Finds the top-level `jobs:` block and
|
|
75
|
+
* extracts each direct-child key + its body. We use the two-space
|
|
76
|
+
* indent convention GitHub Actions workflows follow. Workflows that
|
|
77
|
+
* deviate (tabs, four-space) would miss — but `init` emits two-space,
|
|
78
|
+
* which is what we're validating.
|
|
79
|
+
*/
|
|
80
|
+
export declare function parseJobs(source: string): WorkflowJob[];
|
|
81
|
+
/**
|
|
82
|
+
* Check that the publishing job has (or inherits) the two permissions
|
|
83
|
+
* that OIDC trusted publishing requires. The permissions may be set at
|
|
84
|
+
* workflow level (top-level `permissions:`) and/or job level; this
|
|
85
|
+
* function reports a missing permission only if *neither* scope
|
|
86
|
+
* declares it. `write-all` satisfies both.
|
|
87
|
+
*/
|
|
88
|
+
export declare function checkPermissions(workflow: WorkflowFile): PermissionIssue[];
|
|
89
|
+
/**
|
|
90
|
+
* Return `{ kind: 'missing' }` when the publish job lacks an
|
|
91
|
+
* `environment:` key. Does NOT inspect the value — diff-vs-registry is
|
|
92
|
+
* Option C.
|
|
93
|
+
*/
|
|
94
|
+
export declare function checkEnvironment(workflow: WorkflowFile): EnvironmentIssue | null;
|
|
95
|
+
/**
|
|
96
|
+
* Sanity check: confirm the workflow has at least one clearly-
|
|
97
|
+
* identifiable publish step. `findPublishWorkflows` already filters,
|
|
98
|
+
* but this catches weird states like a `run:` that's been edited into
|
|
99
|
+
* a comment while the composite-action `uses:` line still matches.
|
|
100
|
+
*/
|
|
101
|
+
export declare function checkPublishInvocation(workflow: WorkflowFile): InvocationIssue | null;
|
|
102
|
+
//# sourceMappingURL=oidc-policy.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oidc-policy.d.ts","sourceRoot":"","sources":["../src/oidc-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;CACnD;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CA8BrE;AAgBD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CA6BvD;AA0BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,EAAE,CAyB1E;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,gBAAgB,GAAG,IAAI,CAShF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,GAAG,IAAI,CAiBrF"}
|