48 lines
1.3 KiB
TypeScript
48 lines
1.3 KiB
TypeScript
import { spawnSync } from "node:child_process";
|
|
import { readFile, writeFile } from "node:fs/promises";
|
|
|
|
import { supplyChainDigest } from "./lib/supply-chain.ts";
|
|
|
|
const owner = process.env.DEPENDENCY_BASELINE_OWNER;
|
|
const reason = process.env.DEPENDENCY_BASELINE_REASON;
|
|
if (!owner?.trim() || !reason?.trim()) {
|
|
process.stderr.write(
|
|
"DEPENDENCY_BASELINE_OWNER and DEPENDENCY_BASELINE_REASON are required.\n",
|
|
);
|
|
process.exit(2);
|
|
}
|
|
|
|
const commands: Array<[string, string[]]> = [
|
|
["corepack", ["pnpm", "build"]],
|
|
["node", ["scripts/generate-supply-chain.ts", "--no-baseline"]],
|
|
];
|
|
for (const [command, args] of commands) {
|
|
const result = spawnSync(command, args, { stdio: "inherit" });
|
|
if (result.status !== 0) process.exit(result.status ?? 1);
|
|
}
|
|
|
|
const inventory = JSON.parse(
|
|
await readFile("artifacts/release/dependency-inventory.json", "utf8"),
|
|
);
|
|
await writeFile(
|
|
"config/security/dependency-baseline.json",
|
|
`${JSON.stringify(inventory, null, 2)}\n`,
|
|
);
|
|
await writeFile(
|
|
"config/security/dependency-baseline.approval.json",
|
|
`${JSON.stringify(
|
|
{
|
|
schemaVersion: 1,
|
|
snapshotDigest: supplyChainDigest(inventory),
|
|
owner,
|
|
reason,
|
|
approvedAt: new Date().toISOString(),
|
|
},
|
|
null,
|
|
2,
|
|
)}\n`,
|
|
);
|
|
process.stdout.write(
|
|
`Dependency baseline approved: ${inventory.dependencyCount} packages\n`,
|
|
);
|