mirror of
https://github.com/kremalicious/metamask-extension.git
synced 2024-11-23 18:41:38 +01:00
1fd3dc9ecf
As a solution to the constant lockfile churn issues we've had with `npm`, the project now uses `yarn` to manage dependencies. The `package-lock.json` file has been replaced with `yarn.lock`, which was created using `yarn import`. It should approximate the contents of `package-lock.json` fairly well, though there may be some changes due to deduplication. The codeowners file has been updated to reference this new lockfile. All documentation and npm scripts have been updated to reference `yarn` rather than `npm`. Note that running scripts using `npm run` still works fine, but it seemed better to switch those to `yarn` as well to avoid confusion. The `npm-audit` Bash script has been replaced with `yarn-audit`. The output of `yarn audit` is a bit different than `npm audit` in that it returns a bitmask to describe which severity issues were found. This made it simpler to check the results directly from the Bash script, so the associated `npm-audit-check.js` script was no longer required. The output should be exactly the same, and the information is still sourced from the same place (the npm registry). The new `yarn-audit` script does have an external dependency: `jq`. However, `jq` is already assumed to be present by another CI script, and is present on all CI images we use. `jq` was not added to `package.json` as a dependency because there is no official package on the npm registry, just wrapper scripts. We don't need it anywhere exept on CI anyway. The section in `CONTRIBUTING` about how to develop inside the `node_modules` folder was removed, as the advice was a bit dated, and wasn't specific to this project anyway.
21 lines
725 B
Bash
Executable File
21 lines
725 B
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -u
|
|
set -o pipefail
|
|
|
|
yarn audit --level moderate --groups dependencies
|
|
audit_status="$?"
|
|
|
|
# Use a bitmask to ignore INFO and LOW severity audit results
|
|
# See here: https://yarnpkg.com/lang/en/docs/cli/audit/
|
|
audit_status="$(( audit_status & 11100 ))"
|
|
|
|
if [[ "$audit_status" != 0 ]]
|
|
then
|
|
count="$(yarn audit --level moderate --groups dependencies --json | tail -1 | jq '.data.vulnerabilities.moderate + .data.vulnerabilities.high + .data.vulnerabilities.critical')"
|
|
printf "Audit shows %s moderate or high severity advisories _in the production dependencies_\n" "$count"
|
|
exit 1
|
|
else
|
|
printf "Audit shows _zero_ moderate or high severity advisories _in the production dependencies_\n"
|
|
fi
|