39 lines
1.6 KiB
JavaScript
39 lines
1.6 KiB
JavaScript
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
|
|
const projectRoot = path.resolve(__dirname, '..');
|
|
|
|
function read(relativePath) {
|
|
return fs.readFileSync(path.join(projectRoot, relativePath), 'utf8');
|
|
}
|
|
|
|
test('package.json exposes the security audit script and excludes removed cloud dependencies', () => {
|
|
const packageJson = JSON.parse(read('package.json'));
|
|
|
|
assert.equal(packageJson.scripts['security:audit'], 'node ./scripts/security-audit-report.cjs');
|
|
assert.match(packageJson.scripts['test:ci'], /tests\/security-governance\.test\.cjs/);
|
|
assert.ok(!('@google-cloud/translate' in packageJson.dependencies));
|
|
assert.ok(!('express' in packageJson.dependencies));
|
|
assert.ok(!('firebase-admin' in packageJson.dependencies));
|
|
assert.ok(!('firebase-functions' in packageJson.dependencies));
|
|
assert.ok(!('firebase-functions-test' in packageJson.devDependencies));
|
|
});
|
|
|
|
test('security governance workflow enforces npm audit policy and uploads reports', () => {
|
|
const workflow = read('.github/workflows/security-governance.yml');
|
|
|
|
assert.match(workflow, /name:\s+Security Governance/);
|
|
assert.match(workflow, /run:\s+npm run security:audit/);
|
|
assert.match(workflow, /actions\/upload-artifact@v4/);
|
|
assert.match(workflow, /cron:\s+'31 17 \* \* 1'/);
|
|
});
|
|
|
|
test('security baseline file is present and ready for future exceptions', () => {
|
|
const baseline = JSON.parse(read('security/npm-audit-baseline.json'));
|
|
|
|
assert.ok(Array.isArray(baseline.entries));
|
|
assert.equal(baseline.entries.length, 0);
|
|
});
|