57 lines
1.6 KiB
Bash
57 lines
1.6 KiB
Bash
|
#!/bin/bash
|
||
|
|
set -euo pipefail
|
||
|
|
# SEC-203: Dependency audit — run npm audit and cargo audit.
|
||
|
|
|
||
|
|
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||
|
|
|
||
|
|
log() { echo -e "\033[1;34m[AUDIT]\033[0m $*"; }
|
||
|
|
|
||
|
|
main() {
|
||
|
|
log "=== Dependency Audit ==="
|
||
|
|
echo ""
|
||
|
|
|
||
|
|
# Frontend — npm audit
|
||
|
|
log "Running npm audit..."
|
||
|
|
cd "$REPO_ROOT/neode-ui"
|
||
|
|
npm audit --omit=dev 2>&1 | tail -20 || true
|
||
|
|
echo ""
|
||
|
|
|
||
|
|
# Backend — cargo audit (if installed)
|
||
|
|
log "Checking for cargo-audit..."
|
||
|
|
if command -v cargo-audit &>/dev/null; then
|
||
|
|
log "Running cargo audit..."
|
||
|
|
cd "$REPO_ROOT/core"
|
||
|
|
cargo audit 2>&1 | tail -20 || true
|
||
|
|
else
|
||
|
|
log "cargo-audit not installed locally — run on build server:"
|
||
|
|
log " cargo install cargo-audit && cd core && cargo audit"
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo ""
|
||
|
|
|
||
|
|
# Check for pinned versions in Cargo.toml
|
||
|
|
log "Checking Cargo.toml version pinning..."
|
||
|
|
local unpinned
|
||
|
|
unpinned=$(grep -E '^[a-z].*= "[^=><~]' "$REPO_ROOT/core/archipelago/Cargo.toml" 2>/dev/null | grep -v '= "' || echo "")
|
||
|
|
if [ -z "$unpinned" ]; then
|
||
|
|
log " All Cargo dependencies appear pinned"
|
||
|
|
else
|
||
|
|
log " WARNING: Some deps may not be pinned:"
|
||
|
|
echo "$unpinned" | head -5 | sed 's/^/ /'
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Check for pinned versions in package.json
|
||
|
|
log "Checking package.json version pinning..."
|
||
|
|
local npm_unpinned
|
||
|
|
npm_unpinned=$(grep -E '"[^"]+": "\^|~' "$REPO_ROOT/neode-ui/package.json" | head -10 || echo "")
|
||
|
|
if [ -n "$npm_unpinned" ]; then
|
||
|
|
log " NOTE: Some npm deps use ^ or ~ (normal for npm):"
|
||
|
|
echo "$npm_unpinned" | head -5 | sed 's/^/ /'
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo ""
|
||
|
|
log "=== Audit Complete ==="
|
||
|
|
}
|
||
|
|
|
||
|
|
main "$@"
|