139 lines
4.0 KiB
TypeScript
139 lines
4.0 KiB
TypeScript
import { readFile } from "node:fs/promises";
|
|
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
import {
|
|
diffDependencyInventories,
|
|
isValidSha512Integrity,
|
|
parsePnpmLockfilePackages,
|
|
supplyChainDigest,
|
|
validateDependencyReview,
|
|
validateLicensePolicy,
|
|
} from "../../scripts/lib/supply-chain.ts";
|
|
|
|
const integrity = `sha512-${Buffer.alloc(64, 7).toString("base64")}`;
|
|
const dependency = {
|
|
name: "fixture",
|
|
version: "1.0.0",
|
|
direct: true,
|
|
scope: "production",
|
|
optional: false,
|
|
license: "MIT",
|
|
integrity,
|
|
dependencies: [],
|
|
};
|
|
|
|
describe("supply-chain policy", () => {
|
|
it("uses one fail-closed repository inventory for provenance and secret scanning", async () => {
|
|
const [provenanceSource, securitySource] = await Promise.all([
|
|
readFile("scripts/generate-supply-chain.ts", "utf8"),
|
|
readFile("scripts/security-scan.ts", "utf8"),
|
|
]);
|
|
for (const source of [provenanceSource, securitySource]) {
|
|
expect(source).toContain("buildRepositoryFileInventory");
|
|
expect(source).not.toContain("async function filesWithin");
|
|
}
|
|
});
|
|
|
|
it("covers every mandatory release input in the secret scan policy", async () => {
|
|
const policy = JSON.parse(
|
|
await readFile("config/security/secret-scan-policy.json", "utf8"),
|
|
) as { trackedRoots: string[] };
|
|
expect(policy.trackedRoots).toEqual(
|
|
expect.arrayContaining([
|
|
"index.html",
|
|
".dependency-cruiser.json",
|
|
".nvmrc",
|
|
".npmrc",
|
|
"eslint.config.ts",
|
|
"package.json",
|
|
"pnpm-lock.yaml",
|
|
"pnpm-workspace.yaml",
|
|
"scripts",
|
|
"schemas",
|
|
"config",
|
|
".gitea/workflows/quality-gates.yml",
|
|
"vite.config.ts",
|
|
"vite.service-worker.config.ts",
|
|
"playwright.capabilities.config.ts",
|
|
"playwright.dev.config.ts",
|
|
"playwright.storybook.config.ts",
|
|
"playwright.visual.config.ts",
|
|
"tsconfig.json",
|
|
"tsconfig.app.json",
|
|
"tsconfig.base.json",
|
|
"tsconfig.node.json",
|
|
"tsconfig.recipes.json",
|
|
"tsconfig.service-worker.json",
|
|
"tsconfig.test.json",
|
|
"tsconfig.web-worker.json",
|
|
]),
|
|
);
|
|
});
|
|
|
|
it("parses every top-level lockfile package and validates SRI", () => {
|
|
const parsed = parsePnpmLockfilePackages(`
|
|
packages:
|
|
|
|
'@scope/one@1.0.0':
|
|
resolution: {integrity: ${integrity}}
|
|
|
|
two@2.0.0:
|
|
resolution: {integrity: ${integrity}}
|
|
|
|
snapshots:
|
|
`);
|
|
expect(parsed).toEqual([
|
|
{ name: "@scope/one", version: "1.0.0", integrity },
|
|
{ name: "two", version: "2.0.0", integrity },
|
|
]);
|
|
expect(parsed.every((entry) => isValidSha512Integrity(entry.integrity))).toBe(
|
|
true,
|
|
);
|
|
});
|
|
|
|
it("keeps inventory digests stable when dependency ordering changes", () => {
|
|
const other = { ...dependency, name: "other" };
|
|
expect(supplyChainDigest([dependency, other])).toBe(
|
|
supplyChainDigest([other, dependency]),
|
|
);
|
|
});
|
|
|
|
it("calculates actual additions and requires independent high-risk review", () => {
|
|
const before = { dependencies: [] };
|
|
const after = { dependencies: [dependency] };
|
|
const diff = diffDependencyInventories(before, after);
|
|
expect(diff.added).toEqual(["fixture@1.0.0"]);
|
|
expect(
|
|
validateDependencyReview(diff, after, {
|
|
changes: [
|
|
{
|
|
changeId: "add:fixture@1.0.0",
|
|
owner: "one",
|
|
reviewer: "one",
|
|
reason: "fixture",
|
|
rollback: "remove",
|
|
},
|
|
],
|
|
}).passed,
|
|
).toBe(false);
|
|
});
|
|
|
|
it("allows explicit policy licenses and rejects denied licenses", () => {
|
|
expect(
|
|
validateLicensePolicy(
|
|
{ dependencies: [dependency] },
|
|
{ allowedLicenses: ["MIT"], deniedLicensePatterns: ["AGPL"] },
|
|
).passed,
|
|
).toBe(true);
|
|
expect(
|
|
validateLicensePolicy(
|
|
{
|
|
dependencies: [{ ...dependency, license: "AGPL-3.0" }],
|
|
},
|
|
{ allowedLicenses: ["MIT"], deniedLicensePatterns: ["AGPL"] },
|
|
).passed,
|
|
).toBe(false);
|
|
});
|
|
});
|