Class: Rules::MissingFrozenLockfile

Inherits:
Base
  • Object
show all
Defined in:
lib/rules/missing_frozen_lockfile.rb

Constant Summary collapse

INSTALL_WITHOUT_LOCK = 
/(?:npm|pnpm|yarn)\s+install(?!\s+(-g|--global|--frozen-lockfile|--ci|--immutable))/

Instance Method Summary collapse

Instance Method Details

#check(workflow) ⇒ Object 



9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
 
# File 'lib/rules/missing_frozen_lockfile.rb', line 9

def check(workflow)
  findings = []

  workflow.raw_lines.each_with_index do |line, i|
    next unless line.match?(INSTALL_WITHOUT_LOCK)
    next if line.match?(/--frozen-lockfile|--ci|--immutable|npm ci/)
    next if line.strip.start_with?("#")

    findings << finding(workflow,
      line: i + 1,
      code: line.strip,
      message: "Package install without --frozen-lockfile — dependency resolution may differ from tested versions",
      fix: "Use pnpm install --frozen-lockfile or npm ci"
    )
  end

  findings
end

#description ⇒ Object 



4
 
# File 'lib/rules/missing_frozen_lockfile.rb', line 4

def description = "Package install without lockfile enforcement"

#name ⇒ Object 



3
 
# File 'lib/rules/missing_frozen_lockfile.rb', line 3

def name = "missing-frozen-lockfile"

#severity ⇒ Object 



5
 
# File 'lib/rules/missing_frozen_lockfile.rb', line 5

def severity = :medium