tony/dependency-guard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pin dependency policy exceptions to versions

Browse Source
This commit is contained in:
tony
2026-08-27 12:51:53 +01:00
parent f28b9ee87d
commit 8098495abf
10 changed files with 125 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/project.js
+5 -3
View File
@@ -20,14 +20,16 @@ export async function readProject(projectPath) {
return { manifest, lock, direct };
}
export function inspectLock(lock, policy) {
export function inspectLock(lock, policy, now = Date.now()) {
const failures = [];
let registryEntries = 0;
for (const [lockPath, entry] of Object.entries(lock.packages)) {
if (!lockPath || entry.link) continue;
const name = packageNameFromLockPath(lockPath, entry) ?? lockPath;
if (entry.hasInstallScript && !policy.allowInstallScripts.includes(name)) {
failures.push(`${name}: lock entry declares hasInstallScript; add a reviewed allowInstallScripts exception if intentional`);
const scriptException = policy.allowInstallScripts[name];
const scriptAllowed = scriptException?.versions.includes(entry.version) && Date.parse(scriptException.expiresAt) > now;
if (entry.hasInstallScript && !scriptAllowed) {
failures.push(`${name}@${entry.version ?? "unknown"}: lock entry declares hasInstallScript; add a reviewed, version-pinned allowInstallScripts exception if intentional`);
}
if (!lockPath.includes("node_modules/")) continue;
registryEntries += 1;