39 lines
1.1 KiB
TypeScript
39 lines
1.1 KiB
TypeScript
import { mkdir, writeFile } from "node:fs/promises";
|
|
import path from "node:path";
|
|
|
|
import { evaluateRepositorySecretScan } from "./lib/secret-scan-evaluator.ts";
|
|
|
|
function argumentValue(name: string, fallback: string): string {
|
|
const index = process.argv.indexOf(name);
|
|
return index >= 0 && process.argv[index + 1]
|
|
? process.argv[index + 1]
|
|
: fallback;
|
|
}
|
|
|
|
const policyPath = argumentValue(
|
|
"--policy",
|
|
"config/security/secret-scan-policy.json",
|
|
);
|
|
const artifactPath = argumentValue(
|
|
"--artifact",
|
|
"artifacts/security/scan.sarif",
|
|
);
|
|
const evaluation = await evaluateRepositorySecretScan({ policyPath });
|
|
|
|
await mkdir(path.dirname(artifactPath), { recursive: true });
|
|
await writeFile(
|
|
artifactPath,
|
|
`${JSON.stringify(evaluation.sarif, null, 2)}\n`,
|
|
);
|
|
const blockingCount =
|
|
evaluation.findings.length + evaluation.policyFailures.length;
|
|
if (blockingCount > 0) {
|
|
process.stderr.write(
|
|
`Security scan found ${blockingCount} blocking result(s).\n`,
|
|
);
|
|
process.exit(1);
|
|
}
|
|
process.stdout.write(
|
|
`Tracked source, config, built asset and artifact secret scan: PASS (${evaluation.scanFiles.length} files)\n`,
|
|
);
|