FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
patternfly-java/showcase/audit.mjs at main · patternfly-java/patternfly-java · GitHub
Uh oh!
There was an error while loading.
Please reload this page
.
patternfly-java
/
patternfly-java
Public
Notifications
You must be signed in to change notification settings
Fork
5
Star
34
Code
Issues
39
Pull requests
2
Discussions
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
patternfly-java
/
showcase
/
audit.mjs
Copy path
More file actions
More file actions
Latest commit
History
History
History
118 lines (106 loc) · 4.19 KB
Breadcrumbs
patternfly-java
/
showcase
/
audit.mjs
Copy path
File metadata and controls
118 lines (106 loc) · 4.19 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
/*
* Copyright 2023 Red Hat
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import
{
execSync
}
from
"node:child_process"
;
import
{
readFileSync
,
writeFileSync
}
from
"node:fs"
;
const
WORKSPACE
=
"pnpm-workspace.yaml"
;
const
REPO
=
"patternfly-java/patternfly-java"
;
const
DISMISS_REASON
=
"not_used"
;
const
DISMISS_COMMENT
=
"Transitive dependency of @patternfly/documentation-framework. "
+
"Only CSS files are imported — none of its JS code paths are executed."
;
// ── pnpm audit ──────────────────────────────────────────────────────
function
currentIgnored
(
)
{
const
content
=
readFileSync
(
WORKSPACE
,
"utf8"
)
;
const
matches
=
content
.
match
(
/
G
H
S
A
-
[
a
-
z
0
-
9
]
+
-
[
a
-
z
0
-
9
]
+
-
[
a
-
z
0
-
9
]
+
/
g
)
;
return
new
Set
(
matches
||
[
]
)
;
}
function
auditGhsas
(
)
{
let
output
;
try
{
output
=
execSync
(
"pnpm audit 2>&1"
,
{
encoding
:
"utf8"
}
)
;
}
catch
(
e
)
{
output
=
e
.
stdout
||
""
;
}
const
matches
=
output
.
match
(
/
G
H
S
A
-
[
a
-
z
0
-
9
]
+
-
[
a
-
z
0
-
9
]
+
-
[
a
-
z
0
-
9
]
+
/
g
)
;
return
[
...
new
Set
(
matches
||
[
]
)
]
.
sort
(
)
;
}
function
addIgnoreEntries
(
missing
)
{
const
content
=
readFileSync
(
WORKSPACE
,
"utf8"
)
;
const
marker
=
"ignoreGhsas:\n"
;
const
idx
=
content
.
indexOf
(
marker
)
;
if
(
idx
===
-
1
)
{
console
.
error
(
"Could not find 'ignoreGhsas:' section in"
,
WORKSPACE
)
;
process
.
exit
(
1
)
;
}
const
insertionPoint
=
content
.
indexOf
(
"\n\n"
,
idx
)
;
const
newEntries
=
missing
.
map
(
(
id
)
=>
` -
${
id
}
`
)
.
join
(
"\n"
)
;
const
updated
=
content
.
slice
(
0
,
insertionPoint
)
+
"\n"
+
newEntries
+
content
.
slice
(
insertionPoint
)
;
writeFileSync
(
WORKSPACE
,
updated
)
;
}
// ── Dependabot ──────────────────────────────────────────────────────
function
openDependabotAlerts
(
)
{
try
{
const
json
=
execSync
(
`gh api repos/
${
REPO
}
/dependabot/alerts --jq '[.[] | select(.state == "open") | {number, ghsa: .security_advisory.ghsa_id, package: .security_vulnerability.package.name}]'`
,
{
encoding
:
"utf8"
}
)
;
return
JSON
.
parse
(
json
)
;
}
catch
{
console
.
warn
(
"Could not fetch Dependabot alerts (gh CLI not available or no access)."
)
;
return
[
]
;
}
}
function
dismissAlert
(
number
)
{
execSync
(
`gh api --method PATCH repos/
${
REPO
}
/dependabot/alerts/
${
number
}
`
+
`-f state=dismissed `
+
`-f dismissed_reason=
${
DISMISS_REASON
}
`
+
`-f dismissed_comment="
${
DISMISS_COMMENT
}
"`
,
{
encoding
:
"utf8"
,
stdio
:
"pipe"
}
)
;
}
// ── main ────────────────────────────────────────────────────────────
// 1. Handle pnpm audit
const
ignored
=
currentIgnored
(
)
;
const
reported
=
auditGhsas
(
)
;
const
missing
=
reported
.
filter
(
(
id
)
=>
!
ignored
.
has
(
id
)
)
;
if
(
missing
.
length
>
0
)
{
console
.
log
(
`Adding
${
missing
.
length
}
new GHSA entr
${
missing
.
length
===
1
?
"y"
:
"ies"
}
to
${
WORKSPACE
}
:`
)
;
missing
.
forEach
(
(
id
)
=>
console
.
log
(
` -
${
id
}
`
)
)
;
addIgnoreEntries
(
missing
)
;
}
else
{
console
.
log
(
"pnpm audit: no new advisories to ignore."
)
;
}
// 2. Dismiss open Dependabot alerts
const
alerts
=
openDependabotAlerts
(
)
;
if
(
alerts
.
length
>
0
)
{
console
.
log
(
`\nDismissing
${
alerts
.
length
}
open Dependabot alert
${
alerts
.
length
===
1
?
""
:
"s"
}
:`
)
;
for
(
const
alert
of
alerts
)
{
process
.
stdout
.
write
(
` #
${
alert
.
number
}
${
alert
.
ghsa
}
(
${
alert
.
package
}
)...`
)
;
try
{
dismissAlert
(
alert
.
number
)
;
console
.
log
(
" dismissed"
)
;
}
catch
(
e
)
{
console
.
log
(
" FAILED:"
,
e
.
message
)
;
}
}
}
else
{
console
.
log
(
"Dependabot: no open alerts."
)
;
}
Back
|
FazBrowse Home
|
New Git URL