@jitesoft/audit-for-gitlab/bin/index.js

Minimal application to convert npm audit report into gitlab-ci vulnerability report format.

"use strict";

var _interopRequireDefault = require("@babel/runtime-corejs3/helpers/interopRequireDefault").default;
var _stringify = _interopRequireDefault(require("@babel/runtime-corejs3/core-js/json/stringify"));
var _Util = require("./Util");
var _Npm = require("./Npm");
var _Finalize = require("./Finalize");
var _package = _interopRequireDefault(require("../package.json"));
var _GitLabAnalyzer = _interopRequireDefault(require("./GitLabAnalyzer"));
var _Processor = _interopRequireDefault(require("./dependencies/Processor"));
const startTime = new Date();
(0, _Npm.audit)().then(async auditData => {
  await (0, _Util.logger)(_Util.LogLevels.info, 'Generated audit report from npm');
  await (0, _Util.logger)(_Util.LogLevels.info, 'Converting to gitlab specification');
  const npmVersion = await (0, _Npm.version)();
  const packageFile = await (0, _Util.readFileJson)(`${process.cwd()}/package.json`);
  const packageLockFile = await (0, _Util.readFileJson)(`${process.cwd()}/package-lock.json`);

  // Fetch all dependencies.
  const dependencies = await (0, _Processor.default)(packageLockFile);
  const result = await new _GitLabAnalyzer.default(_package.default.meta.scanner, startTime, _package.default.version, npmVersion.npm).convert(auditData.vulnerabilities, packageFile, dependencies);
  return {
    npmVersion: npmVersion.npm,
    meta: auditData.metadata,
    result
  };
}).then(async output => {
  await (0, _Util.logger)(_Util.LogLevels.debug, 'Writing result to file.');
  await (0, _Util.writeFile)((0, _Util.getConf)('REPORT_FILE', 'gl-dependency-scanning-report.json'), (0, _stringify.default)(output.result, null, 2));
  if (await (0, _Util.fileExists)('gl-dependency-scanning-report.json')) {
    await (0, _Util.logger)(_Util.LogLevels.debug, 'File created successfully.');
  }
  return {
    npmVersion: output.npmVersion,
    meta: output.meta
  };
}).then(async data => {
  await (0, _Finalize.reportFindings)(data.meta, data.npmVersion, _package.default);
  await (0, _Finalize.doExit)(data.meta.vulnerabilities);
}).catch(e => {
  (0, _Util.logger)(_Util.LogLevels.fatal, e.message);
});