spectrum-cli 5.0.1 → 5.1.0

package/src/cli/commands.js

@@ -4,9 +4,12 @@ const hotfix = require('../hotfix');
 const changelog = require('../changelog');
 const chart = require('../chart');
 const token = require('../token');
+const nextjs = require('../nextjs');
+const sbom = require('../sbom');
+const security = require('../security');
 const { upgrade } = require('./update-check');
 const { version: pkgVersion } = require('../../package.json');
-const { runAction } = require('./run-action');
+const { runAction, runAutomationAction } = require('./run-action');
 
 function registerCommands(program) {
 program
@@ -21,6 +24,81 @@ program
   .option("-s, --silence", "Скрыть сообщения об успешно пройденных предпроверках")
   .action((command) => runAction(upgrade, command));
 
+// Команды Next.js
+const nextjsCmd = program
+  .command("nextjs")
+  .description("Обработка Next.js build artifacts");
+
+nextjsCmd
+  .command("licenses")
+  .description("Сохранить LICENSE встроенных пакетов в standalone")
+  .allowExcessArguments(false)
+  .option("-d, --dry", "Запустить только предпроверки")
+  .option("-s, --silence", "Скрыть сообщения об успешно пройденных предпроверках")
+  .action((command) => runAutomationAction(nextjs.licenses, command));
+
+// Команды SBOM
+const sbomCmd = program
+  .command("sbom")
+  .description("Работа с SBOM");
+
+const catalogCmd = sbomCmd
+  .command("catalog")
+  .description("Каталоги встроенных зависимостей Next.js");
+
+catalogCmd
+  .command("resolve")
+  .description("Найти проверенные OCI-каталоги для образа приложения")
+  .allowExcessArguments(false)
+  .option("-d, --dry", "Запустить только предпроверки")
+  .option("-s, --silence", "Скрыть сообщения об успешно пройденных предпроверках")
+  .action((command) => runAutomationAction(sbom.resolve, command));
+
+catalogCmd
+  .command("populate")
+  .description("Построить и опубликовать каталог из официальных исходников")
+  .allowExcessArguments(false)
+  .option("-d, --dry", "Запустить только предпроверки")
+  .option("-s, --silence", "Скрыть сообщения об успешно пройденных предпроверках")
+  .action((command) => runAutomationAction(sbom.populate, command));
+
+// Команды security
+const securityCmd = program
+  .command("security")
+  .description("Ночная проверка и исправление HIGH/CRITICAL");
+
+securityCmd
+  .command("scan")
+  .description("Проверить production npm-зависимости и runtime-образ")
+  .allowExcessArguments(false)
+  .option("-d, --dry", "Запустить только предпроверки")
+  .option("-s, --silence", "Скрыть сообщения об успешно пройденных предпроверках")
+  .action((command) => runAutomationAction(security.scan, command));
+
+securityCmd
+  .command("track")
+  .description("Создать или найти YouTrack-задачи в центральном pipeline")
+  .allowExcessArguments(false)
+  .option("-d, --dry", "Запустить только предпроверки")
+  .option("-s, --silence", "Скрыть сообщения об успешно пройденных предпроверках")
+  .action((command) => runAutomationAction(security.track, command));
+
+securityCmd
+  .command("reconcile")
+  .description("Дождаться центрального tracker и получить номера задач")
+  .allowExcessArguments(false)
+  .option("-d, --dry", "Запустить только предпроверки")
+  .option("-s, --silence", "Скрыть сообщения об успешно пройденных предпроверках")
+  .action((command) => runAutomationAction(security.reconcile, command));
+
+securityCmd
+  .command("repair")
+  .description("Исправить, проверить и создать отдельный MR на проектную задачу")
+  .allowExcessArguments(false)
+  .option("-d, --dry", "Запустить только предпроверки")
+  .option("-s, --silence", "Скрыть сообщения об успешно пройденных предпроверках")
+  .action((command) => runAutomationAction(security.repair, command));
+
 // Команды релиза
 const releaseCmd = program
   .command("release")
@@ -29,6 +107,7 @@ const releaseCmd = program
 releaseCmd
   .command("start")
   .description("Схлопнуть fragments и атомарно отправить release commit в dev и main/master")
+  .option("--stable", "Явно перейти с 0.x на первый стабильный релиз 1.0.0")
   .option("-d, --dry", "Запустить только предпроверки")
   .option("-s, --silence", "Скрыть сообщения об успешно пройденных предпроверках")
   .action((command) => runAction(release.releaseStart, command));

package/src/cli/run-action.js

@@ -1,5 +1,5 @@
 const { checkForUpdates } = require('./update-check');
-const { withCommandOptions } = require('./command-executor');
+const { withCommandOptions, reportDryRun } = require('./command-executor');
 
 function commandOptions(command) {
   return command && typeof command.opts === "function" ? command.opts() : command || {};
@@ -25,4 +25,20 @@ async function runAction(action, command) {
   }
 }
 
-module.exports = { runAction };
+// Automation handlers return numeric exit codes, including 0 (success)
+// and 2 (partial result). They run without the interactive update check.
+async function runAutomationAction(action, command) {
+  const options = commandOptions(command);
+  try {
+    process.exitCode = await withCommandOptions(options, async () => {
+      const code = await action(options);
+      if (options.dry && code === 0) reportDryRun();
+      return code;
+    });
+  } catch (error) {
+    console.error('ERROR: ' + error.message);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = { runAction, runAutomationAction };

package/src/nextjs/index.js

@@ -0,0 +1,184 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { isDryRun, reportPreflight } = require("../cli/command-executor");
+function licenses({
+  cwd = process.cwd(),
+  reportOnly = false,
+  dry = isDryRun(),
+} = {}) {
+  const workspace = fs.realpathSync(cwd);
+  const standalone = path.join(workspace, "dist/standalone");
+  const result = { copied: 0, existing: 0, withoutLicense: 0, warnings: [] };
+  if (dry) result.planned = 0;
+
+  function warn(file, error) {
+    result.warnings.push({
+      path: path.relative(workspace, file),
+      reason: error.message,
+    });
+  }
+
+  // Reject symlinks at every level; never read or write outside this checkout.
+  function checked(file, kind) {
+    const relative = path.relative(workspace, file);
+    if (
+      !relative ||
+      relative === ".." ||
+      relative.startsWith(".." + path.sep) ||
+      path.isAbsolute(relative)
+    ) {
+      throw new Error("path outside checkout");
+    }
+    let current = workspace;
+    const parts = relative.split(path.sep);
+    for (let i = 0; i < parts.length; i++) {
+      current = path.join(current, parts[i]);
+      const stat = fs.lstatSync(current);
+      if (
+        stat.isSymbolicLink() ||
+        (i < parts.length - 1 && !stat.isDirectory())
+      ) {
+        throw new Error("unsafe symlink or parent path");
+      }
+      if (
+        i === parts.length - 1 &&
+        !(kind === "directory" ? stat.isDirectory() : stat.isFile())
+      ) {
+        throw new Error("unexpected file type");
+      }
+    }
+    return file;
+  }
+
+  function read(file) {
+    return fs.readFileSync(checked(file, "file"));
+  }
+
+  function identical(left, right) {
+    if (!read(left).equals(read(right)))
+      throw new Error("source and standalone files differ");
+  }
+
+  function files(directory) {
+    checked(directory, "directory");
+    const found = [];
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      if (entry.isDirectory()) found.push(...files(file));
+      else if (entry.isFile()) found.push(checked(file, "file"));
+      else throw new Error("non-regular compiled package entry");
+    }
+    return found;
+  }
+
+  function preserve(nextRoot) {
+    const sourceRoot = path.join(
+      workspace,
+      path.relative(standalone, nextRoot),
+    );
+    const owner = JSON.parse(read(path.join(nextRoot, "package.json")));
+    if (
+      owner.name !== "next" ||
+      typeof owner.version !== "string" ||
+      !owner.version
+    ) {
+      throw new Error("invalid standalone Next identity");
+    }
+    identical(
+      path.join(nextRoot, "package.json"),
+      path.join(sourceRoot, "package.json"),
+    );
+    const compiled = path.join(nextRoot, "dist/compiled");
+    const manifests = files(compiled).filter(
+      (file) => path.basename(file) === "package.json",
+    );
+    for (const manifest of manifests) {
+      try {
+        const target = path.dirname(manifest);
+        const source = path.join(sourceRoot, path.relative(nextRoot, target));
+        const pkg = JSON.parse(read(manifest));
+        if (typeof pkg.name !== "string" || !pkg.name)
+          throw new Error("invalid compiled package identity");
+        identical(manifest, path.join(source, "package.json"));
+        const license = path.join(source, "LICENSE");
+        // Some published compiled packages legitimately have no LICENSE file.
+        // Validate the parent first so ENOENT cannot hide an unsafe source path.
+        checked(source, "directory");
+        try {
+          checked(license, "file");
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+          result.withoutLicense++;
+          continue;
+        }
+        // No repair of modified code, assets or existing license files.
+        for (const file of files(target)) {
+          identical(file, path.join(source, path.relative(target, file)));
+        }
+        const destination = path.join(target, "LICENSE");
+        try {
+          checked(destination, "file");
+          identical(destination, license);
+          result.existing++;
+          continue;
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+        }
+        checked(target, "directory");
+        if (dry) result.planned++;
+        else {
+          fs.copyFileSync(license, destination, fs.constants.COPYFILE_EXCL);
+          result.copied++;
+        }
+      } catch (error) {
+        warn(manifest, error);
+      }
+    }
+  }
+
+  function discover(directory) {
+    checked(directory, "directory");
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      if (entry.isSymbolicLink()) {
+        // Standalone .bin links are not package roots and are never followed.
+        if (entry.name === "next" || entry.name === "node_modules")
+          warn(file, new Error("symlinked package root"));
+        continue;
+      }
+      if (!entry.isDirectory()) continue;
+      if (
+        entry.name === "next" &&
+        path.basename(directory) === "node_modules"
+      ) {
+        try {
+          preserve(file);
+        } catch (error) {
+          warn(file, error);
+        }
+      }
+      discover(file);
+    }
+  }
+
+  try {
+    discover(standalone);
+  } catch (error) {
+    warn(standalone, error);
+  }
+  if (dry) {
+    if (result.warnings.length)
+      console.error(
+        "Standalone LICENSE preflight: " + JSON.stringify(result.warnings),
+      );
+    else
+      reportPreflight(
+        "nextjs licenses",
+        "standalone-metadata",
+        "проверены исходники, standalone и LICENSE",
+      );
+  } else
+    console.log("Standalone LICENSE preservation: " + JSON.stringify(result));
+  return reportOnly ? result : result.warnings.length ? 2 : 0;
+}
+module.exports = { licenses };

package/src/preflight/automation.js

@@ -0,0 +1,291 @@
+// Noninteractive preflights. Remote checks are read-only and never log credentials.
+const { fs, path, ensure, request } = require("../automation");
+const { API, projectPath } = require("../security/runtime");
+const { encoded } = require("../sbom/schema");
+const { reportPreflight } = require("../cli/command-executor");
+class PreflightError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PreflightError";
+  }
+}
+function check(condition, message) {
+  if (!condition) throw new PreflightError(message);
+}
+function required(env, names) {
+  const missing = names.filter(
+    (name) => typeof env[name] !== "string" || !env[name].trim(),
+  );
+  check(!missing.length, "Missing required variables: " + missing.join(", "));
+  return env;
+}
+function credentialPair(env, user, password) {
+  check(
+    Boolean(env[user]) === Boolean(env[password]),
+    `Configure both ${user} and ${password}`,
+  );
+}
+function httpsEndpoint(value, name) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new PreflightError(name + " must be an explicit HTTPS URL");
+  }
+  check(
+    typeof value === "string" &&
+      !/[\x00-\x20]/.test(value) &&
+      parsed.protocol === "https:" &&
+      !parsed.username &&
+      !parsed.password &&
+      !parsed.search &&
+      !parsed.hash,
+    name + " must be an HTTPS URL without credentials, query or fragment",
+  );
+  return value.replace(/\/+$/, "");
+}
+async function get(api, location, options, label) {
+  try {
+    return await api.get(location, options);
+  } catch (error) {
+    const status = Number.isInteger(error.status)
+      ? ` (HTTP ${error.status})`
+      : "";
+    throw new PreflightError(
+      `${label}: connection, authentication or access check failed${status}`,
+    );
+  }
+}
+async function checkGitlabAccess(
+  env,
+  projects,
+  { write = false, purpose = "repository", api } = {},
+) {
+  required(env, ["CI_API_V4_URL", "GLAB_BOT_PAT"]);
+  const base = httpsEndpoint(env.CI_API_V4_URL, "CI_API_V4_URL");
+  if (env.CI_SERVER_URL)
+    check(
+      base === httpsEndpoint(env.CI_SERVER_URL, "CI_SERVER_URL") + "/api/v4",
+      "GitLab API URL does not match CI_SERVER_URL",
+    );
+  check(base.endsWith("/api/v4"), "CI_API_V4_URL must end with /api/v4");
+  const client = api || new API(base, { "PRIVATE-TOKEN": env.GLAB_BOT_PAT });
+  const user = await get(client, "user", undefined, "GitLab identity");
+  check(
+    user?.id && user.state === "active",
+    "GitLab token does not belong to an active user",
+  );
+  const token = await get(
+    client,
+    "personal_access_tokens/self",
+    undefined,
+    "GitLab token scope",
+  );
+  check(
+    token?.active === true &&
+      token.revoked !== true &&
+      Array.isArray(token.scopes),
+    "GitLab token is inactive, revoked or cannot be inspected",
+  );
+  check(
+    token.scopes.includes("api") ||
+      (!write && token.scopes.includes("read_api")),
+    write
+      ? "GitLab token requires the api scope for pipeline/repository writes"
+      : "GitLab token requires read_api or api scope",
+  );
+  for (const project of [...new Set(projects)]) {
+    check(
+      typeof project === "string" && project.trim() && !/[\r\n]/.test(project),
+      "GitLab project must be configured explicitly",
+    );
+    const data = await get(
+      client,
+      projectPath(project),
+      undefined,
+      "GitLab project access",
+    );
+    const level = user.is_admin
+      ? 50
+      : Math.max(
+          data.permissions?.project_access?.access_level || 0,
+          data.permissions?.group_access?.access_level || 0,
+        );
+    check(
+      level >= (write ? 30 : 20),
+      write
+        ? "GitLab project requires Developer access or higher"
+        : "GitLab project requires Reporter access or higher",
+    );
+    if (write) {
+      check(data.archived !== true, "GitLab project is archived");
+      if (purpose === "pipeline")
+        check(
+          data.builds_access_level !== "disabled",
+          "GitLab pipeline access is disabled",
+        );
+      else
+        check(
+          data.repository_access_level !== "disabled" &&
+            data.merge_requests_access_level !== "disabled" &&
+            data.can_create_merge_request_in !== false,
+          "GitLab repository/MR access is disabled",
+        );
+    }
+  }
+  reportPreflight(
+    "automation",
+    "gitlab-access",
+    "проверены GitLab token, scope и роль в проектах",
+  );
+  return {
+    identity: "verified",
+    token_scope: "verified",
+    project_role: "verified",
+    protected_branch_policies: "checked_by_operations",
+  };
+}
+async function checkYouTrackAccess(env, cfg, api) {
+  required(env, ["YOUTRACK_URL", "YOUTRACK_PRIVATE_TOKEN"]);
+  const base = httpsEndpoint(env.YOUTRACK_URL, "YOUTRACK_URL");
+  check(
+    /^[A-Za-z0-9_-]+$/.test(cfg.youtrack_project || ""),
+    "YouTrack project key is required",
+  );
+  const client =
+    api ||
+    new API(base + "/api", {
+      Authorization: "Bearer " + env.YOUTRACK_PRIVATE_TOKEN,
+    });
+  const user = await get(
+    client,
+    "users/me",
+    { query: { fields: "id,login,guest,banned" } },
+    "YouTrack identity",
+  );
+  check(
+    user?.id && user.login && user.guest !== true && user.banned !== true,
+    "YouTrack token must belong to an active, non-guest user",
+  );
+  const parentProject = env.NIGHTLY_CVE_PROJECT || "CVE";
+  check(
+    /^[A-Za-z0-9_-]+$/.test(parentProject),
+    "Invalid parent YouTrack project",
+  );
+  for (const project of [...new Set([parentProject, cfg.youtrack_project])]) {
+    const projects = await get(
+      client,
+      "admin/projects",
+      { query: { query: project, fields: "id,shortName,archived", $top: 100 } },
+      "YouTrack project access",
+    );
+    check(Array.isArray(projects), "Invalid YouTrack project response");
+    const matches = projects.filter((item) => item.shortName === project);
+    check(
+      matches.length === 1 && matches[0].archived !== true,
+      "YouTrack project is missing, inaccessible or archived",
+    );
+    const fields = await get(
+      client,
+      "admin/projects/" + encoded(matches[0].id) + "/customFields",
+      { query: { fields: "field(name)", $top: 100 } },
+      "YouTrack custom fields",
+    );
+    check(Array.isArray(fields), "Invalid YouTrack custom field response");
+    const names = new Set(fields.map((field) => field.field?.name));
+    const expected =
+      project === parentProject
+        ? ["CVE ID", "Severity", "Priority", "Type"]
+        : [
+            "Tester",
+            "Статья учета времени",
+            ...(cfg.subsystem ? ["Subsystem"] : []),
+          ];
+    const missing = expected.filter((name) => !names.has(name));
+    check(
+      !missing.length,
+      "YouTrack project is missing required fields: " + missing.join(", "),
+    );
+    await get(
+      client,
+      "issues",
+      { query: { query: `project: {${project}}`, fields: "id", $top: 1 } },
+      "YouTrack issue read access",
+    );
+  }
+  // GET access cannot prove create/update/link permission or workflow acceptance.
+  reportPreflight(
+    "security track",
+    "youtrack-access",
+    "проверены вход в YouTrack, проекты, поля и чтение",
+  );
+  return {
+    identity: "verified",
+    projects: "read_verified",
+    required_fields: "verified",
+    write_permissions: "checked_by_operations",
+  };
+}
+async function checkRegistryAccess(
+  namespace,
+  { transport = request, probe } = {},
+) {
+  const host = namespace.split("/")[0];
+  const base = httpsEndpoint("https://" + host, "Registry");
+  let response;
+  try {
+    response = await transport(base + "/v2/", {
+      timeout: 15000,
+      limit: 1024 * 1024,
+    });
+  } catch {
+    throw new PreflightError(
+      "Registry is unavailable or TLS validation failed",
+    );
+  }
+  check(
+    response.status === 200 ||
+      (response.status === 401 && !!response.headers?.get("www-authenticate")),
+    "Registry v2 endpoint is unavailable",
+  );
+  // ORAS handles registry authentication; an exact target read distinguishes
+  // auth failures from an empty/missing catalogue before upstream work begins.
+  const existing = await probe();
+  reportPreflight(
+    "sbom catalog populate",
+    "registry-access",
+    "проверены доступность registry и чтение namespace",
+  );
+  return {
+    endpoint: "reachable",
+    authentication: "oras_login_completed",
+    namespace_read: existing ? "verified" : "missing_or_hidden",
+    push_permissions: "checked_by_publish",
+  };
+}
+function checkExecutables(names, env = process.env) {
+  for (const name of names) {
+    const found = (env.PATH || "").split(path.delimiter).some((directory) => {
+      const file = path.join(directory, name);
+      try {
+        return (
+          fs.statSync(file).isFile() &&
+          (fs.accessSync(file, fs.constants.X_OK), true)
+        );
+      } catch {
+        return false;
+      }
+    });
+    check(found, "Required executable is unavailable: " + name);
+  }
+}
+module.exports = {
+  checkExecutables,
+  PreflightError,
+  required,
+  credentialPair,
+  httpsEndpoint,
+  checkGitlabAccess,
+  checkYouTrackAccess,
+  checkRegistryAccess,
+};

package/src/release/start.js

@@ -5,7 +5,7 @@ const { requireGitRepo, requireCleanWorkingTree, requireCurrentBranchUpToDateWit
 const { CHANGELOG_FILE } = require('../changelog/config');
 const { detectBumpType, resolveReleaseVersion } = require('./version');
 const { releaseFormatChangelog, releaseCheckChangelogLint, releaseCommit, releasePush } = require('./steps');
-function releaseStart() {
+function releaseStart(options = {}) {
     return runCommand({
         name: 'release start',
         checks: [
@@ -24,9 +24,13 @@ function releaseStart() {
                 name: 'detect-bump-type',
                 requires: ['changelogFragments', 'stableVersion'],
                 run: (ctx) => {
+                    if (options.stable && (!ctx.stableVersion.startsWith('0.') ||
+                        (ctx.openReleaseVersion && ctx.openReleaseVersion !== '1.0.0'))) {
+                        return { ok: false, reason: '--stable разрешён только для перехода с 0.x на 1.0.0 без другого открытого релиза.' };
+                    }
                     const resolved = ctx.openReleaseVersion
                         ? { bumpType: detectBumpType(ctx.changelogFragments), newVersion: ctx.openReleaseVersion }
-                        : resolveReleaseVersion(ctx.stableVersion, ctx.changelogFragments);
+                        : resolveReleaseVersion(ctx.stableVersion, ctx.changelogFragments, options);
                     if (!resolved) {
                         return { ok: false, reason: 'Не удалось вычислить release-версию от последнего стабильного тега.' };
                     }

package/src/release/version.js

@@ -1,4 +1,4 @@
-const { upVersion } = require('../common/version');
+const { upVersion, parseStableVersion } = require('../common/version');
 function detectBumpType(fragments) {
     const bumpTypes = new Set((fragments || []).map((fragment) => fragment.bump));
     if (bumpTypes.has('major')) {
@@ -10,8 +10,12 @@ function detectBumpType(fragments) {
     return 'patch';
 }
 
-function resolveReleaseVersion(stableVersion, fragments) {
-    const bumpType = detectBumpType(fragments);
+function resolveReleaseVersion(stableVersion, fragments, { stable = false } = {}) {
+    const baseline = parseStableVersion(stableVersion);
+    if (!baseline || (stable && baseline[0] !== 0)) return null;
+    const impact = detectBumpType(fragments);
+    // Initial development stays in 0.x until explicitly promoted to 1.0.0.
+    const bumpType = stable ? 'major' : baseline[0] === 0 && impact === 'major' ? 'minor' : impact;
     const newVersion = upVersion(stableVersion, bumpType);
     if (!newVersion) return null;
     return { bumpType, newVersion };

package/src/sbom/index.js

@@ -0,0 +1,4 @@
+const { resolve } = require('./resolve');
+const { populate } = require('./populate');
+
+module.exports = { resolve, populate };