supply-chain-guard 5.2.36 → 5.2.37

package/README.md

@@ -342,6 +342,21 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. The most impactful contri
 
 ## Changelog
 
+### v5.2.37 (2026-06-27)
+**Fix: PR-comment step crash on findings containing backticks**
+
+The Comment on PR step built a JavaScript template literal from the scan
+report. Because the report markdown contains backticks, the literal broke and
+the step threw, failing the check on essentially every consumer pull request
+(the scan logic itself was never affected). The step now reads the report from
+a file via `fs.readFileSync` and is marked `continue-on-error`, so a comment
+failure can never fail the scan. No rule, threat-intel, or scan-engine changes
+in this release.
+
+- Composite action `Comment on PR` step rewritten to read `/tmp/scg-report.txt`
+  instead of interpolating the report into an inline template literal (#27).
+- Added `continue-on-error: true` so PR-comment failures are non-fatal.
+
 ### v5.2.36 (2026-06-25)
 **Threat-intel update: PostCSS Tools Windows RAT npm campaign**
 

package/action.yml

@@ -119,9 +119,16 @@ runs:
     - name: Comment on PR
       if: inputs.comment-on-pr == 'true' && github.event_name == 'pull_request' && steps.scan.outputs.findings-count != '0'
       uses: actions/github-script@v7
+      continue-on-error: true
       with:
         script: |
-          const report = `${{ steps.scan.outputs.report }}`;
+          const fs = require('fs');
+          let report = '';
+          try {
+            report = fs.readFileSync('/tmp/scg-report.txt', 'utf8');
+          } catch (err) {
+            console.error('Failed to read report file:', err);
+          }
           const { data: comments } = await github.rest.issues.listComments({
             owner: context.repo.owner,
             repo: context.repo.repo,

package/dist/cli.js

@@ -20,7 +20,7 @@ const program = new commander_1.Command();
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("5.2.36");
+    .version("5.2.37");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/reporter.js

@@ -55,7 +55,7 @@ function formatJson(report) {
 function formatText(report) {
     const lines = [];
     // ── layout constants ───────────────────────────────────────────────────────
-    const VERSION = "5.2.36";
+    const VERSION = "5.2.37";
     const W = 76; // visible chars between "│ " and " │" (total line = 80)
     // ── ANSI helpers ───────────────────────────────────────────────────────────
     const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -462,7 +462,7 @@ function formatSarif(report) {
                 tool: {
                     driver: {
                         name: "supply-chain-guard",
-                        version: "5.2.36",
+                        version: "5.2.37",
                         informationUri: "https://github.com/homeofe/supply-chain-guard",
                         rules,
                     },
@@ -524,7 +524,7 @@ function formatSbom(report) {
             timestamp: report.timestamp,
             tools: {
                 components: [
-                    { type: "application", name: "supply-chain-guard", version: "5.2.36" },
+                    { type: "application", name: "supply-chain-guard", version: "5.2.37" },
                 ],
             },
             component: {
@@ -676,7 +676,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
   ` : ""}
 
   <footer>
-    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.2.36
+    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.2.37
   </footer>
 </div>
 <script>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supply-chain-guard",
-  "version": "5.2.36",
+  "version": "5.2.37",
   "description": "Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, Docker, VS Code extensions, GitHub Actions, IaC and Solana C2. Detects GlassWorm, Shai-Hulud, PPE attacks, dependency confusion and 120+ malware indicators. Generates CycloneDX 1.6 SBOMs and verifies SLSA provenance.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",