mirror of
https://github.com/kremalicious/metamask-extension.git
synced 2024-12-23 09:52:26 +01:00
754f98aea2
The npm audit script was auditing all dependencies, then filtering the results to just the advisories concerning production dependencies. This was done by checking the boolean `dev` and `optional` properties of each `findings` entry in each advisory. The `dev` and `optional` properties are now missing, which is resulting in dev advisories being mistakenly identified as affecting production. This check has been removed, and instead the `--production` flag is used when calling `npm audit`. This accomplishes the same goal without relying as much upon the audit output format. The `--production` flag was added in `npm` `v6.10.0`, so `npm` has been updated to the current latest stable (`v6.10.2`) for the `test-deps` job. It was also updated on the `prep-deps-npm` job to ensure consistency in behaviour. The other jobs only use `npm run` which hasn't changed substantially in some time, so compatibility isn't really a concern for those. `audit.json` has also been added to `.gitignore`. It was accidentally checked in once while working on this branch.
25 lines
652 B
JavaScript
25 lines
652 B
JavaScript
const path = require('path')
|
|
const audit = require(path.join(__dirname, '..', '..', 'audit.json'))
|
|
const error = audit.error
|
|
const advisories = Object.keys(audit.advisories || []).map((k) => audit.advisories[k])
|
|
|
|
if (error) {
|
|
process.exit(1)
|
|
}
|
|
|
|
let count = 0
|
|
for (const advisory of advisories) {
|
|
if (advisory.severity === 'low') {
|
|
continue
|
|
}
|
|
|
|
count += advisory.findings.length
|
|
}
|
|
|
|
if (count > 0) {
|
|
console.log(`Audit shows ${count} moderate or high severity advisories _in the production dependencies_`)
|
|
process.exit(1)
|
|
} else {
|
|
console.log(`Audit shows _zero_ moderate or high severity advisories _in the production dependencies_`)
|
|
}
|