sentinelayer-cli 0.25.2 → 0.26.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/package.json +1 -1
  2. package/src/legacy-cli.js +74 -0
  3. package/src/scan/generator.js +79 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "sentinelayer-cli",
3
- "version": "0.25.2",
3
+ "version": "0.26.0",
4
4
  "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
5
5
  "type": "module",
6
6
  "scripts": {
package/src/legacy-cli.js CHANGED
@@ -2435,6 +2435,80 @@ jobs:
2435
2435
  echo "- run_id: \\\`\${{ steps.omar.outputs.run_id }}\\\`" >> "\$GITHUB_STEP_SUMMARY"
2436
2436
  echo "- gate_status: \\\`\${{ steps.omar.outputs.gate_status }}\\\`" >> "\$GITHUB_STEP_SUMMARY"
2437
2437
  echo "- findings: P0=\${{ steps.omar.outputs.p0_count }} P1=\${{ steps.omar.outputs.p1_count }} P2=\${{ steps.omar.outputs.p2_count }} P3=\${{ steps.omar.outputs.p3_count }}" >> "\$GITHUB_STEP_SUMMARY"
2438
+ - name: Stage Omar summary artifact
2439
+ shell: bash
2440
+ env:
2441
+ OMAR_RUN_ID: \${{ steps.omar.outputs.run_id || '' }}
2442
+ OMAR_GATE_STATUS: \${{ steps.omar.outputs.gate_status || '' }}
2443
+ OMAR_P0: \${{ steps.omar.outputs.p0_count || '0' }}
2444
+ OMAR_P1: \${{ steps.omar.outputs.p1_count || '0' }}
2445
+ OMAR_P2: \${{ steps.omar.outputs.p2_count || '0' }}
2446
+ OMAR_P3: \${{ steps.omar.outputs.p3_count || '0' }}
2447
+ OMAR_SCAN_MODE: \${{ github.event_name == 'workflow_dispatch' && inputs.scan_mode || 'deep' }}
2448
+ OMAR_SEVERITY_GATE: \${{ github.event_name == 'workflow_dispatch' && inputs.severity_gate || 'P1' }}
2449
+ OMAR_P2_MAX_ALLOWED: \${{ github.event_name == 'workflow_dispatch' && inputs.p2_max_allowed || '5' }}
2450
+ run: |
2451
+ set -euo pipefail
2452
+ mkdir -p omar-artifacts
2453
+ python3 - <<'PY'
2454
+ import json
2455
+ import os
2456
+ from pathlib import Path
2457
+
2458
+ def env(name, default=""):
2459
+ return os.environ.get(name, default)
2460
+
2461
+ def int_env(name):
2462
+ value = env(name, "0").strip()
2463
+ return int(value) if value.isdigit() else 0
2464
+
2465
+ github_run_id = env("GITHUB_RUN_ID")
2466
+ server_url = env("GITHUB_SERVER_URL", "https://github.com").rstrip("/")
2467
+ repository = env("GITHUB_REPOSITORY")
2468
+ run_url = f"{server_url}/{repository}/actions/runs/{github_run_id}" if repository and github_run_id else ""
2469
+ summary = {
2470
+ "schema_version": 1,
2471
+ "kind": "omar_gate_summary",
2472
+ "run_id": env("OMAR_RUN_ID"),
2473
+ "gate_status": env("OMAR_GATE_STATUS"),
2474
+ "findings": {
2475
+ "P0": int_env("OMAR_P0"),
2476
+ "P1": int_env("OMAR_P1"),
2477
+ "P2": int_env("OMAR_P2"),
2478
+ "P3": int_env("OMAR_P3"),
2479
+ },
2480
+ "threshold": {
2481
+ "severity_gate": env("OMAR_SEVERITY_GATE", "P1"),
2482
+ "p2_max_allowed": int_env("OMAR_P2_MAX_ALLOWED"),
2483
+ },
2484
+ "scan": {
2485
+ "mode": env("OMAR_SCAN_MODE", "deep"),
2486
+ "action_ref": "mrrCarter/sentinelayer-v1-action@03d7369cba7de2e9f15b959275c982111f0ee493",
2487
+ "managed_llm": False,
2488
+ "llm_failure_policy": "block",
2489
+ },
2490
+ "github": {
2491
+ "repository": repository,
2492
+ "sha": env("GITHUB_SHA"),
2493
+ "ref": env("GITHUB_REF"),
2494
+ "event_name": env("GITHUB_EVENT_NAME"),
2495
+ "workflow": env("GITHUB_WORKFLOW"),
2496
+ "run_id": github_run_id,
2497
+ "run_attempt": env("GITHUB_RUN_ATTEMPT"),
2498
+ "run_url": run_url,
2499
+ },
2500
+ }
2501
+ Path("omar-artifacts/summary.json").write_text(
2502
+ json.dumps(summary, indent=2, sort_keys=True) + "\n",
2503
+ encoding="utf-8",
2504
+ )
2505
+ PY
2506
+ - name: Upload Omar summary artifact
2507
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874
2508
+ with:
2509
+ name: omar-gate-artifacts
2510
+ path: omar-artifacts/summary.json
2511
+ if-no-files-found: error
2438
2512
  `;
2439
2513
  }
2440
2514
 
package/src/scan/generator.js CHANGED
@@ -8,6 +8,7 @@ export const SUPPORTED_PLAYWRIGHT_MODES = Object.freeze(["auto", "off", "baselin
8
8
 
9
9
  const CHECKOUT_ACTION_REF = "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683";
10
10
  const SETUP_NODE_ACTION_REF = "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020";
11
+ const UPLOAD_ARTIFACT_ACTION_REF = "actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874";
11
12
  const SECRET_NAME_REGEX = /^[A-Z][A-Z0-9_]*$/;
12
13
  const REPO_SLUG_REGEX = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
13
14
 
@@ -274,6 +275,84 @@ export function buildSecurityReviewWorkflow({ secretName = DEFAULT_SCAN_SECRET_N
274
275
  'echo "- findings: P0=${{ steps.omar.outputs.p0_count }} P1=${{ steps.omar.outputs.p1_count }} P2=${{ steps.omar.outputs.p2_count }} P3=${{ steps.omar.outputs.p3_count }}" >> "$GITHUB_STEP_SUMMARY"',
275
276
  ].join("\n"),
276
277
  },
278
+ {
279
+ name: "Stage Omar summary artifact",
280
+ shell: "bash",
281
+ env: {
282
+ OMAR_RUN_ID: "${{ steps.omar.outputs.run_id || '' }}",
283
+ OMAR_GATE_STATUS: "${{ steps.omar.outputs.gate_status || '' }}",
284
+ OMAR_P0: "${{ steps.omar.outputs.p0_count || '0' }}",
285
+ OMAR_P1: "${{ steps.omar.outputs.p1_count || '0' }}",
286
+ OMAR_P2: "${{ steps.omar.outputs.p2_count || '0' }}",
287
+ OMAR_P3: "${{ steps.omar.outputs.p3_count || '0' }}",
288
+ OMAR_SCAN_MODE: "${{ github.event_name == 'workflow_dispatch' && inputs.scan_mode || 'deep' }}",
289
+ OMAR_SEVERITY_GATE: "${{ github.event_name == 'workflow_dispatch' && inputs.severity_gate || 'P1' }}",
290
+ OMAR_P2_MAX_ALLOWED: "${{ github.event_name == 'workflow_dispatch' && inputs.p2_max_allowed || '5' }}",
291
+ },
292
+ run: [
293
+ "set -euo pipefail",
294
+ "mkdir -p omar-artifacts",
295
+ "python3 - <<'PY'",
296
+ "import json",
297
+ "import os",
298
+ "from pathlib import Path",
299
+ "",
300
+ "def env(name, default=''):",
301
+ " return os.environ.get(name, default)",
302
+ "",
303
+ "def int_env(name):",
304
+ " value = env(name, '0').strip()",
305
+ " return int(value) if value.isdigit() else 0",
306
+ "",
307
+ "github_run_id = env('GITHUB_RUN_ID')",
308
+ "server_url = env('GITHUB_SERVER_URL', 'https://github.com').rstrip('/')",
309
+ "repository = env('GITHUB_REPOSITORY')",
310
+ "run_url = f'{server_url}/{repository}/actions/runs/{github_run_id}' if repository and github_run_id else ''",
311
+ "summary = {",
312
+ " 'schema_version': 1,",
313
+ " 'kind': 'omar_gate_summary',",
314
+ " 'run_id': env('OMAR_RUN_ID'),",
315
+ " 'gate_status': env('OMAR_GATE_STATUS'),",
316
+ " 'findings': {",
317
+ " 'P0': int_env('OMAR_P0'),",
318
+ " 'P1': int_env('OMAR_P1'),",
319
+ " 'P2': int_env('OMAR_P2'),",
320
+ " 'P3': int_env('OMAR_P3'),",
321
+ " },",
322
+ " 'threshold': {",
323
+ " 'severity_gate': env('OMAR_SEVERITY_GATE', 'P1'),",
324
+ " 'p2_max_allowed': int_env('OMAR_P2_MAX_ALLOWED'),",
325
+ " },",
326
+ " 'scan': {",
327
+ " 'mode': env('OMAR_SCAN_MODE', 'deep'),",
328
+ ` 'action_ref': '${SENTINELAYER_ACTION_REF}',`,
329
+ " 'managed_llm': False,",
330
+ " 'llm_failure_policy': 'block',",
331
+ " },",
332
+ " 'github': {",
333
+ " 'repository': repository,",
334
+ " 'sha': env('GITHUB_SHA'),",
335
+ " 'ref': env('GITHUB_REF'),",
336
+ " 'event_name': env('GITHUB_EVENT_NAME'),",
337
+ " 'workflow': env('GITHUB_WORKFLOW'),",
338
+ " 'run_id': github_run_id,",
339
+ " 'run_attempt': env('GITHUB_RUN_ATTEMPT'),",
340
+ " 'run_url': run_url,",
341
+ " },",
342
+ "}",
343
+ "Path('omar-artifacts/summary.json').write_text(json.dumps(summary, indent=2, sort_keys=True) + '\\n', encoding='utf-8')",
344
+ "PY",
345
+ ].join("\n"),
346
+ },
347
+ {
348
+ name: "Upload Omar summary artifact",
349
+ uses: UPLOAD_ARTIFACT_ACTION_REF,
350
+ with: {
351
+ name: "omar-gate-artifacts",
352
+ path: "omar-artifacts/summary.json",
353
+ "if-no-files-found": "error",
354
+ },
355
+ },
277
356
  ],
278
357
  },
279
358
  },