xread/scripts/security-audit-report.cjs

const fs = require("node:fs");
const path = require("node:path");
const { spawnSync } = require("node:child_process");

const projectRoot = path.resolve(__dirname, "..");
const baselinePath = path.join(
  projectRoot,
  "security",
  "npm-audit-baseline.json",
);
const reportDirectory = path.join(projectRoot, "security-reports");
const summaryJsonPath = path.join(reportDirectory, "npm-audit-summary.json");
const summaryMarkdownPath = path.join(reportDirectory, "npm-audit-summary.md");

const severityRank = {
  info: 0,
  low: 1,
  moderate: 2,
  high: 3,
  critical: 4,
};

function npmCommand() {
  return process.platform === "win32" ? "npm.cmd" : "npm";
}

function readBaseline() {
  const raw = fs.readFileSync(baselinePath, "utf8");
  const parsed = JSON.parse(raw);
  return Array.isArray(parsed.entries) ? parsed.entries : [];
}

function runAudit(extraArgs) {
  const result = spawnSync(npmCommand(), ["audit", "--json", ...extraArgs], {
    cwd: projectRoot,
    encoding: "utf8",
    env: process.env,
  });

  if (![0, 1].includes(result.status ?? 0)) {
    process.stderr.write(
      result.stderr || result.stdout || "npm audit failed.\n",
    );
    process.exit(result.status ?? 1);
  }

  const combinedOutput =
    `${result.stdout || ""}\n${result.stderr || ""}`.trim();
  const jsonStart = combinedOutput.indexOf("{");
  if (jsonStart === -1) {
    if ((result.status ?? 0) === 0) {
      return {
        auditReportVersion: 2,
        vulnerabilities: {},
        metadata: {
          vulnerabilities: {
            info: 0,
            low: 0,
            moderate: 0,
            high: 0,
            critical: 0,
            total: 0,
          },
        },
      };
    }

    throw new Error("npm audit returned no JSON payload.");
  }

  return JSON.parse(combinedOutput.slice(jsonStart));
}

function toFindings(report, scope) {
  return Object.entries(report.vulnerabilities || {}).map(([pkg, entry]) => {
    const advisories = (entry.via || [])
      .filter((item) => item && typeof item === "object" && item.title)
      .map((item) => ({
        source: item.source,
        title: item.title,
        severity: item.severity,
        url: item.url,
      }));

    return {
      package: pkg,
      scope,
      severity: entry.severity,
      isDirect: Boolean(entry.isDirect),
      nodes: entry.nodes || [],
      effects: entry.effects || [],
      advisories,
    };
  });
}

function matchBaseline(finding, baselineEntries) {
  return baselineEntries.find(
    (entry) =>
      entry.package === finding.package &&
      entry.scope === finding.scope &&
      entry.severity === finding.severity,
  );
}

function formatFinding(finding, baselineEntry) {
  const headline = `${finding.package} (${finding.scope}, ${finding.severity})`;
  const notes = [];

  if (finding.advisories.length) {
    notes.push(
      `advisories: ${finding.advisories.map((item) => item.title).join(" | ")}`,
    );
  }
  if (finding.effects.length) {
    notes.push(`effects: ${finding.effects.join(", ")}`);
  }
  if (finding.nodes.length) {
    notes.push(`nodes: ${finding.nodes.join(", ")}`);
  }
  if (baselineEntry) {
    notes.push(
      `baseline: ${baselineEntry.reason} (review by ${baselineEntry.reviewBy})`,
    );
  }

  return `- ${headline}\n  ${notes.join("\n  ")}`;
}

function writeReports(payload) {
  fs.mkdirSync(reportDirectory, { recursive: true });
  fs.writeFileSync(summaryJsonPath, JSON.stringify(payload, null, 2) + "\n");

  const sections = [
    "# npm audit summary",
    "",
    `- generatedAt: ${payload.generatedAt}`,
    `- blockingFindings: ${payload.blockingFindings.length}`,
    `- baselinedDevelopmentFindings: ${payload.baselinedDevelopmentFindings.length}`,
    `- productionVulnerabilities: ${JSON.stringify(payload.production.metadata.vulnerabilities)}`,
    `- fullAuditVulnerabilities: ${JSON.stringify(payload.full.metadata.vulnerabilities)}`,
    "",
    "## Blocking findings",
    ...(payload.blockingFindings.length
      ? payload.blockingFindings.map((item) => formatFinding(item, null))
      : ["- none"]),
    "",
    "## Baselined development findings",
    ...(payload.baselinedDevelopmentFindings.length
      ? payload.baselinedDevelopmentFindings.map((item) =>
          formatFinding(item.finding, item.baseline),
        )
      : ["- none"]),
  ];

  fs.writeFileSync(summaryMarkdownPath, sections.join("\n") + "\n");
}

const baselineEntries = readBaseline();
const productionAudit = runAudit(["--omit=dev"]);
const fullAudit = runAudit([]);

const productionFindings = toFindings(productionAudit, "production");
const fullFindings = toFindings(fullAudit, "development");

const baselinedDevelopmentFindings = [];
const blockingFindings = [];

for (const finding of productionFindings) {
  if (severityRank[finding.severity] >= severityRank.high) {
    blockingFindings.push(finding);
  }
}

for (const finding of fullFindings) {
  if (
    productionFindings.some(
      (prodFinding) => prodFinding.package === finding.package,
    )
  ) {
    continue;
  }

  const baselineEntry = matchBaseline(finding, baselineEntries);
  if (baselineEntry) {
    baselinedDevelopmentFindings.push({ finding, baseline: baselineEntry });
    continue;
  }

  if (severityRank[finding.severity] >= severityRank.high) {
    blockingFindings.push(finding);
  }
}

const payload = {
  generatedAt: new Date().toISOString(),
  production: {
    metadata: productionAudit.metadata,
    findings: productionFindings,
  },
  full: {
    metadata: fullAudit.metadata,
    findings: fullFindings,
  },
  blockingFindings,
  baselinedDevelopmentFindings,
};

writeReports(payload);

if (blockingFindings.length) {
  process.stderr.write(
    `Security audit failed with ${blockingFindings.length} blocking finding(s).\n`,
  );
  process.exit(1);
}

process.stdout.write("Security audit policy passed.\n");