chore: initialize from frontend template 4dc033c

scripts/security-scan.ts

@@ -0,0 +1,38 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { evaluateRepositorySecretScan } from "./lib/secret-scan-evaluator.ts";
+
+function argumentValue(name: string, fallback: string): string {
+  const index = process.argv.indexOf(name);
+  return index >= 0 && process.argv[index + 1]
+    ? process.argv[index + 1]
+    : fallback;
+}
+
+const policyPath = argumentValue(
+  "--policy",
+  "config/security/secret-scan-policy.json",
+);
+const artifactPath = argumentValue(
+  "--artifact",
+  "artifacts/security/scan.sarif",
+);
+const evaluation = await evaluateRepositorySecretScan({ policyPath });
+
+await mkdir(path.dirname(artifactPath), { recursive: true });
+await writeFile(
+  artifactPath,
+  `${JSON.stringify(evaluation.sarif, null, 2)}\n`,
+);
+const blockingCount =
+  evaluation.findings.length + evaluation.policyFailures.length;
+if (blockingCount > 0) {
+  process.stderr.write(
+    `Security scan found ${blockingCount} blocking result(s).\n`,
+  );
+  process.exit(1);
+}
+process.stdout.write(
+  `Tracked source, config, built asset and artifact secret scan: PASS (${evaluation.scanFiles.length} files)\n`,
+);