jpmschweitzerandClaude Opus 4.8
34ce01cbf1
`make push-check` now runs a `security` step (ci/osv_scan.sh) that scans pubspec.lock with osv-scanner and fails the push if any resolved dependency has a known advisory. This is a hard, fail-closed gate on top of `dart pub get`'s passive (non-failing) advisory print. Replaces the old manual-review `security` no-op target. Slots in among the instant fail-fast gates, before the coverage suite. Resolves the osv-scanner binary from PATH, falling back to a brew prefix so the gate works under the pre-push hook's leaner PATH; if absent it fails with an install hint (brew install osv-scanner). Native deps (dugite, tree-sitter, wasmtime) are vendored by SHA and reviewed separately on bump (D-42), so they're out of scope for the lockfile scan. Verified clean against the current lockfile (80 packages, no issues). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
35 lines
1.5 KiB
Bash
Executable File
35 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Supply-chain gate — fails the push if any resolved dependency in
|
|
# pubspec.lock has a known advisory (OSV / GitHub Advisory Database).
|
|
#
|
|
# Complements `dart pub get`'s passive advisory print (informational,
|
|
# non-failing) with a hard, fail-closed gate. Native deps (dugite,
|
|
# tree-sitter, wasmtime) are vendored by SHA and not in a lockfile OSV
|
|
# reads — they're reviewed separately on bump (D-42, CLAUDE.md supply chain).
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
# Resolve osv-scanner: PATH first, then a brew prefix (the git pre-push hook
|
|
# may run with a leaner PATH than the dev's interactive shell).
|
|
OSV="$(command -v osv-scanner || true)"
|
|
if [[ -z "$OSV" ]] && command -v brew >/dev/null 2>&1; then
|
|
cand="$(brew --prefix 2>/dev/null)/bin/osv-scanner"
|
|
[[ -x "$cand" ]] && OSV="$cand"
|
|
fi
|
|
if [[ -z "$OSV" ]]; then
|
|
echo "==> osv gate: osv-scanner not found on PATH." >&2
|
|
echo " Install it: brew install osv-scanner" >&2
|
|
echo " (or: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest)" >&2
|
|
exit 2
|
|
fi
|
|
|
|
echo "==> osv gate: scanning pubspec.lock for known advisories"
|
|
if "$OSV" scan source --lockfile=pubspec.lock; then
|
|
echo "==> osv gate OK: no known advisories"
|
|
else
|
|
echo "==> osv gate FAIL: a dependency has a known advisory (see above)." >&2
|
|
echo " Bump the affected package (+ its assets/licenses.yaml entry), or" >&2
|
|
echo " document an explicit, justified exception before pushing." >&2
|
|
exit 1
|
|
fi
|