3.1.21

.gitlab-ci.yml

@@ -34,6 +34,28 @@ snyk:
   - docker
   - notpriv
 
+sast:
+  stage: security
+  image: docker:stable
+  variables:
+    DOCKER_DRIVER: overlay2
+  allow_failure: true
+  services:
+    - docker:stable-dind
+  script:
+    - export SP_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')
+    - docker run
+        --env SAST_CONFIDENCE_LEVEL="${SAST_CONFIDENCE_LEVEL:-3}"
+        --volume "$PWD:/code"
+        --volume /var/run/docker.sock:/var/run/docker.sock
+        "registry.gitlab.com/gitlab-org/security-products/sast:$SP_VERSION" /app/bin/run /code
+  artifacts:
+    reports:
+      sast: gl-sast-report.json
+  tags:
+  - docker
+  - priv
+
 # ====================
 # test stage
 # ====================

npmextra.json

@@ -6,7 +6,8 @@
     },
     "npmci": {
         "npmGlobalTools": [],
-        "npmAccessLevel": "public"
+        "npmAccessLevel": "public",
+        "npmRegistryUrl": "registry.npmjs.org"
     },
     "npmdocker":{
         "baseImage":"hosttoday/ht-docker-node:npmci",

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipzone/npmci",
-  "version": "3.1.3",
+  "version": "3.1.21",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -102,7 +102,7 @@
     },
     "@pushrocks/projectinfo": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@pushrocks/projectinfo/-/projectinfo-4.0.2.tgz",
+      "resolved": "https://verdaccio.lossless.one/@pushrocks%2fprojectinfo/-/projectinfo-4.0.2.tgz",
       "integrity": "sha512-u5tSlrJTdDb5r3qmPub5WkDWlW561WfjqylZMkswP4yNZSR2krhew4ra4Y2/6q2QUnMBXRmo1lj4n7ggXoDNWQ==",
       "requires": {
         "@pushrocks/smartfile": "^6.0.8",
@@ -252,9 +252,9 @@
       }
     },
     "@pushrocks/smartshell": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@pushrocks/smartshell/-/smartshell-2.0.8.tgz",
-      "integrity": "sha512-OeGrJez0vSHe/E0auHNUqf7r0B3yS+pkVe6BuxdJemJx5LBRtcHuZnJCxU5pSLL8igzlTfR+jVpjKJXUMzCsrA==",
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/@pushrocks/smartshell/-/smartshell-2.0.11.tgz",
+      "integrity": "sha512-NvDrafAgSPK12/HAekyL+BF5lROxhcfBNJIELI/bU7Jto/32QOOn6DthzMEPbqyPzsH7mWMjv10Djy3TWdqZag==",
       "requires": {
         "@pushrocks/smartpromise": "^2.0.5",
         "@types/which": "^1.3.1",
@@ -290,42 +290,15 @@
       }
     },
     "@pushrocks/smartstring": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@pushrocks/smartstring/-/smartstring-3.0.4.tgz",
-      "integrity": "sha512-6LwG9dRAVY6qAeDDWj7P1ehTh9KYdeUG/SNKdx+jIvzOfyldy0fGsdm4o4glfeZvijGSxFEcmXkL3ic7rR19+Q==",
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@pushrocks/smartstring/-/smartstring-3.0.5.tgz",
+      "integrity": "sha512-Bws2s6+Pc0HIXA35QH6cl6LJywhZ1U5icjyYMx+1kH8nURG+njzkacfarr9NWqyVYYOVu7SgXLzp9sR0eH7k9g==",
       "requires": {
         "crypto-random-string": "^1.0.0",
-        "js-base64": "^2.4.8",
+        "js-base64": "^2.4.9",
         "normalize-newline": "^3.0.0",
-        "randomatic": "^3.1.0",
+        "randomatic": "^3.1.1",
         "strip-indent": "^2.0.0"
-      },
-      "dependencies": {
-        "is-number": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/is-number/-/is-number-4.0.0.tgz",
-          "integrity": "sha512-rSklcAIlf1OmFdyAqbnWTLVelsQ58uvZ66S/ZyawjWqIviTWCjg2PzVGw8WUA+nNuPTqb4wgA+NszrJ+08LlgQ=="
-        },
-        "js-base64": {
-          "version": "2.4.9",
-          "resolved": "https://registry.npmjs.org/js-base64/-/js-base64-2.4.9.tgz",
-          "integrity": "sha512-xcinL3AuDJk7VSzsHgb9DvvIXayBbadtMZ4HFPx8rUszbW1MuNMlwYVC4zzCZ6e1sqZpnNS5ZFYOhXqA39T7LQ=="
-        },
-        "kind-of": {
-          "version": "6.0.2",
-          "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz",
-          "integrity": "sha512-s5kLOcnH0XqDO+FvuaLX8DDjZ18CGFk7VygH40QoKPUQhW4e2rvM0rwUq0t8IQDOwYSeLK01U90OjzBTme2QqA=="
-        },
-        "randomatic": {
-          "version": "3.1.0",
-          "resolved": "https://registry.npmjs.org/randomatic/-/randomatic-3.1.0.tgz",
-          "integrity": "sha512-KnGPVE0lo2WoXxIZ7cPR8YBpiol4gsSuOwDSg410oHh80ZMp5EiypNqL2K4Z77vJn6lB5rap7IkAmcUlalcnBQ==",
-          "requires": {
-            "is-number": "^4.0.0",
-            "kind-of": "^6.0.0",
-            "math-random": "^1.0.1"
-          }
-        }
       }
     },
     "@pushrocks/smarttime": {
@@ -718,20 +691,6 @@
       "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.0.0.tgz",
       "integrity": "sha512-faqwZqnWxbxn+F1d399ygeamQNy3lPp/H9H6rNrqYh4FSVCtcY+3cub1MxA8o9mDd55mM8Aghuu/kuyYA6VTsA=="
     },
-    "cflare": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/cflare/-/cflare-1.0.5.tgz",
-      "integrity": "sha1-0B/XhZ4UEvRcsp8CoiJ/8EcasJQ=",
-      "requires": {
-        "beautylog": "^6.1.10",
-        "smartdelay": "^1.0.3",
-        "smartq": "^1.1.1",
-        "smartrequest": "^1.0.6",
-        "smartstring": "^2.0.24",
-        "tsclass": "^1.0.12",
-        "typings-global": "^1.0.17"
-      }
-    },
     "chai": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/chai/-/chai-4.1.2.tgz",
@@ -1243,11 +1202,6 @@
       "resolved": "https://registry.npmjs.org/invert-kv/-/invert-kv-2.0.0.tgz",
       "integrity": "sha512-wPVv/y/QQ/Uiirj/vh3oP+1Ww+AWehmi1g5fFWGPF6IpCBCDVrhgHRMvrLfdYcwDh3QJbGXDW4JAuzxElLSqKA=="
     },
-    "is-buffer": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w=="
-    },
     "is-callable": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.1.3.tgz",
@@ -1264,22 +1218,9 @@
       "integrity": "sha1-o7MKXE8ZkYMWeqq5O+764937ZU8="
     },
     "is-number": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-number/-/is-number-3.0.0.tgz",
-      "integrity": "sha1-JP1iAaR4LPUFYcgQJ2r8fRLXEZU=",
-      "requires": {
-        "kind-of": "^3.0.2"
-      },
-      "dependencies": {
-        "kind-of": {
-          "version": "3.2.2",
-          "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
-          "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-          "requires": {
-            "is-buffer": "^1.1.5"
-          }
-        }
-      }
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-4.0.0.tgz",
+      "integrity": "sha512-rSklcAIlf1OmFdyAqbnWTLVelsQ58uvZ66S/ZyawjWqIviTWCjg2PzVGw8WUA+nNuPTqb4wgA+NszrJ+08LlgQ=="
     },
     "is-promise": {
       "version": "2.1.0",
@@ -1320,9 +1261,9 @@
       "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA="
     },
     "js-base64": {
-      "version": "2.4.5",
-      "resolved": "https://registry.npmjs.org/js-base64/-/js-base64-2.4.5.tgz",
-      "integrity": "sha512-aUnNwqMOXw3yvErjMPSQu6qIIzUmT1e5KcU1OZxRDU1g/am6mzBvcrmLAYwzmB59BHPrh5/tKaiF4OPhqRWESQ=="
+      "version": "2.4.9",
+      "resolved": "https://registry.npmjs.org/js-base64/-/js-base64-2.4.9.tgz",
+      "integrity": "sha512-xcinL3AuDJk7VSzsHgb9DvvIXayBbadtMZ4HFPx8rUszbW1MuNMlwYVC4zzCZ6e1sqZpnNS5ZFYOhXqA39T7LQ=="
     },
     "js-tokens": {
       "version": "3.0.2",
@@ -1348,12 +1289,9 @@
       }
     },
     "kind-of": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-4.0.0.tgz",
-      "integrity": "sha1-IIE989cSkosgc3hpGkUGb65y3Vc=",
-      "requires": {
-        "is-buffer": "^1.1.5"
-      }
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz",
+      "integrity": "sha512-s5kLOcnH0XqDO+FvuaLX8DDjZ18CGFk7VygH40QoKPUQhW4e2rvM0rwUq0t8IQDOwYSeLK01U90OjzBTme2QqA=="
     },
     "lcid": {
       "version": "2.0.0",
@@ -1745,12 +1683,13 @@
       "integrity": "sha1-fjL3W0E4EpHQRhHxvxQQmsAGUdc="
     },
     "randomatic": {
-      "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/randomatic/-/randomatic-1.1.7.tgz",
-      "integrity": "sha512-D5JUjPyJbaJDkuAazpVnSfVkLlpeO3wDlPROTMLGKG1zMFNFRgrciKo1ltz/AzNTkqE0HzDx655QOL51N06how==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/randomatic/-/randomatic-3.1.1.tgz",
+      "integrity": "sha512-TuDE5KxZ0J461RVjrJZCJc+J+zCkTb1MbH9AQUq68sMhOMcy9jLcb3BrZKgp9q9Ncltdg4QVqWrH02W2EFFVYw==",
       "requires": {
-        "is-number": "^3.0.0",
-        "kind-of": "^4.0.0"
+        "is-number": "^4.0.0",
+        "kind-of": "^6.0.0",
+        "math-random": "^1.0.1"
       }
     },
     "readable-stream": {
@@ -1954,19 +1893,6 @@
         "socket.io-client": "^2.0.4"
       }
     },
-    "smartstring": {
-      "version": "2.0.28",
-      "resolved": "https://registry.npmjs.org/smartstring/-/smartstring-2.0.28.tgz",
-      "integrity": "sha512-pneklqLF1w3k043fyM3eMrJ1lXRnE4b/W6xlQrpkf2fLb/w1+NbnfJopJVfWJxtft8bVPHhYRk6fa1JKH4qTVw==",
-      "requires": {
-        "crypto-random-string": "^1.0.0",
-        "js-base64": "^2.3.2",
-        "normalize-newline": "^3.0.0",
-        "randomatic": "^1.1.7",
-        "strip-indent": "^2.0.0",
-        "typings-global": "^1.0.20"
-      }
-    },
     "socket.io": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/socket.io/-/socket.io-2.1.1.tgz",
@@ -2147,11 +2073,6 @@
         "yn": "^2.0.0"
       }
     },
-    "tsclass": {
-      "version": "1.0.20",
-      "resolved": "https://registry.npmjs.org/tsclass/-/tsclass-1.0.20.tgz",
-      "integrity": "sha512-oreiwoX8YjXuSYy2cmsVS8/XC8YEb1ms7w9S9P+84sj+ZB6t/MEO8mJ7DaMZGH14zro8jcMSKVT7U9eTbknNLg=="
-    },
     "tslib": {
       "version": "1.9.3",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.9.3.tgz",
@@ -2178,9 +2099,9 @@
       }
     },
     "tslint-config-prettier": {
-      "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/tslint-config-prettier/-/tslint-config-prettier-1.16.0.tgz",
-      "integrity": "sha512-zu6RAcpBtqdvhT6KpBh9kRPYATjOf9BnRi718kNqVKFjEgSE4rFrPprFju1YJrkOa3RbtbWI1ZSuLd2NBX1MDw==",
+      "version": "1.17.0",
+      "resolved": "https://registry.npmjs.org/tslint-config-prettier/-/tslint-config-prettier-1.17.0.tgz",
+      "integrity": "sha512-NKWNkThwqE4Snn4Cm6SZB7lV5RMDDFsBwz6fWUkTxOKGjMx8ycOHnjIbhn7dZd5XmssW3CwqUjlANR6EhP9YQw==",
       "dev": true
     },
     "tsutils": {

package.json

@@ -1,6 +1,7 @@
 {
   "name": "@shipzone/npmci",
-  "version": "3.1.3",
+  "version": "3.1.21",
+  "private": false,
   "description": "node and docker in gitlab ci on steroids",
   "main": "dist/index.js",
   "typings": "dist/index.d.ts",
@@ -29,7 +30,7 @@
     "@pushrocks/tapbundle": "^3.0.7",
     "@types/node": "^10.12.10",
     "tslint": "^5.11.0",
-    "tslint-config-prettier": "^1.16.0"
+    "tslint-config-prettier": "^1.17.0"
   },
   "dependencies": {
     "@pushrocks/lik": "^3.0.2",
@@ -43,17 +44,15 @@
     "@pushrocks/smartparam": "^1.0.4",
     "@pushrocks/smartpromise": "^2.0.5",
     "@pushrocks/smartrequest": "^1.1.14",
-    "@pushrocks/smartshell": "^2.0.8",
+    "@pushrocks/smartshell": "^2.0.11",
     "@pushrocks/smartssh": "^1.2.3",
-    "@pushrocks/smartstring": "^3.0.4",
+    "@pushrocks/smartstring": "^3.0.5",
     "@types/lodash": "^4.14.118",
     "@types/shelljs": "^0.8.0",
     "@types/through2": "^2.0.34",
-    "cflare": "^1.0.5",
     "lodash": "^4.17.11",
     "smartanalytics": "^2.0.9",
     "smartsocket": "^1.1.19",
     "through2": "^3.0.0"
-  },
-  "private": false
+  }
 }

ts/mod_docker/mod.helpers.ts

@@ -165,7 +165,7 @@ export let getDockerBuildArgs = async (): Promise<string> => {
   let buildArgsString: string = '';
   for (const key in NpmciConfig.configObject.dockerBuildargEnvMap) {
     const targetValue = process.env[NpmciConfig.configObject.dockerBuildargEnvMap[key]];
-    buildArgsString = `${buildArgsString} --build-arg ${key}=${targetValue}`;
+    buildArgsString = `${buildArgsString} --build-arg ${key}="${targetValue}"`;
   }
   return buildArgsString;
 };

ts/mod_git/index.ts

@@ -3,6 +3,8 @@ import * as plugins from './mod.plugins';
 import { bash } from '../npmci.bash';
 import { repo } from '../npmci.env';
 
+import { configObject } from '../npmci.config';
+
 /**
  * handle cli input
  * @param argvArg
@@ -15,10 +17,10 @@ export let handleCli = async argvArg => {
         await mirror();
         break;
       default:
-        logger.log('error', `>>npmci git ...<< action >>${action}<< not supported`);
+        logger.log('error', `npmci git -> action >>${action}<< not supported!`);
     }
   } else {
-    logger.log('info', `>>npmci git ...<< cli arguments invalid... Please read the documentation.`);
+    logger.log('info', `npmci git -> cli arguments invalid! Please read the documentation.`);
   }
 };
 
@@ -26,6 +28,16 @@ export let mirror = async () => {
   const githubToken = process.env.NPMCI_GIT_GITHUBTOKEN;
   const githubUser = process.env.NPMCI_GIT_GITHUBGROUP || repo.user;
   const githubRepo = process.env.NPMCI_GIT_GITHUB || repo.repo;
+  if (
+    configObject.projectInfo.npm.packageJson.private === true ||
+    configObject.npmAccessLevel === 'private'
+  ) {
+    logger.log(
+      'warn',
+      `refusing to mirror due to private property use a private mirror location instead`
+    );
+    return;
+  }
   if (githubToken) {
     logger.log('info', 'found github token.');
     logger.log('info', 'attempting the mirror the repository to GitHub');

ts/mod_node/index.ts

@@ -36,11 +36,11 @@ export let install = async versionArg => {
   logger.log('info', `now installing node version ${versionArg}`);
   let version: string;
   if (versionArg === 'stable') {
-    version = '10';
+    version = '11';
   } else if (versionArg === 'lts') {
-    version = '8';
+    version = '10';
   } else if (versionArg === 'legacy') {
-    version = '9';
+    version = '8';
   } else {
     version = versionArg;
   }

ts/mod_npm/index.ts

@@ -37,15 +37,27 @@ export let handleCli = async argvArg => {
  * authenticates npm with token from env var
  */
 const prepare = async () => {
-  const npmrcPrefix: string = '//registry.npmjs.org/:_authToken=';
-  const npmToken: string = process.env.NPMCI_TOKEN_NPM;
-  const npmrcFileString: string = npmrcPrefix + npmToken;
-  if (npmToken) {
-    logger.log('info', 'found access token');
+  const config = await configModule.getConfig();
+  let npmrcFileString: string = '';
+  await plugins.smartparam.forEachMinimatch(process.env, 'NPMCI_TOKEN_NPM*', npmEnvArg => {
+    const npmRegistryUrl = npmEnvArg.split('|')[0];
+    const npmToken = npmEnvArg.split('|')[1];
+    npmrcFileString += `//${npmRegistryUrl}/:_authToken="${plugins.smartstring.base64.decode(
+      npmToken
+    )}"\n`;
+  });
+  logger.log('info', `setting default npm registry to ${config.npmRegistryUrl}`);
+  npmrcFileString += `registry=https://${config.npmRegistryUrl}\n`;
+
+  // final check
+  if (npmrcFileString.length > 0) {
+    logger.log('info', 'found one or more access tokens');
   } else {
     logger.log('error', 'no access token found! Exiting!');
     process.exit(1);
   }
+
+  // lets save it to disk
   plugins.smartfile.memory.toFsSync(npmrcFileString, '/root/.npmrc');
   return;
 };
@@ -55,6 +67,7 @@ const prepare = async () => {
  */
 const publish = async () => {
   let npmAccessCliString = ``;
+  let npmRegistryCliString = ``;
   const config = await configModule.getConfig();
 
   // -> configure package access level
@@ -65,6 +78,14 @@ const publish = async () => {
     npmAccessCliString = `--access=${config.npmAccessLevel}`;
   }
 
+  // -> configure registry url
+  if (config.npmRegistryUrl) {
+    npmRegistryCliString = `--registry=https://${config.npmRegistryUrl}`;
+  } else {
+    logger.log('error', `no registry url specified. Can't publish!`);
+    process.exit(1);
+  }
+
   // -> preparing
   logger.log('info', `now preparing environment:`);
   prepare();
@@ -84,7 +105,7 @@ const publish = async () => {
 
   // -> publish it
   logger.log('info', `now invoking npm to publish the package!`);
-  await bash(`npm publish ${npmAccessCliString}`);
+  await bash(`npm publish ${npmAccessCliString} ${npmRegistryCliString}`);
   logger.log('success', `Package was successfully published!`);
 };
 

ts/mod_trigger/index.ts

@@ -6,7 +6,7 @@ const triggerValueRegex = /^([a-zA-Z0-9\.]*)\|([a-zA-Z0-9\.]*)\|([a-zA-Z0-9\.]*)
 
 export let trigger = async () => {
   logger.log('info', 'now running triggers');
-  plugins.smartparam.forEachMinimatch(process.env, 'NPMCI_TRIGGER_*', evaluateTrigger);
+  await plugins.smartparam.forEachMinimatch(process.env, 'NPMCI_TRIGGER_*', evaluateTrigger);
 };
 
 const evaluateTrigger = async triggerEnvVarArg => {

ts/npmci.config.ts

@@ -6,8 +6,10 @@ import { repo } from './npmci.env';
 import { KeyValueStore } from '@pushrocks/npmextra';
 
 export interface INpmciOptions {
+  projectInfo: plugins.projectinfo.ProjectInfo;
   npmGlobalTools: string[];
   npmAccessLevel?: 'private' | 'public';
+  npmRegistryUrl: string;
   dockerRegistryRepoMap: any;
   dockerBuildargEnvMap: any;
 }
@@ -18,8 +20,11 @@ export let kvStorage = new KeyValueStore('custom', `${repo.user}_${repo.repo}`);
 // handle config retrival
 const npmciNpmextra = new plugins.npmextra.Npmextra(paths.cwd);
 const defaultConfig: INpmciOptions = {
+  projectInfo: new plugins.projectinfo.ProjectInfo(paths.cwd),
   npmGlobalTools: [],
   dockerRegistryRepoMap: {},
+  npmAccessLevel: 'private',
+  npmRegistryUrl: 'registry.npmjs.org',
   dockerBuildargEnvMap: {}
 };
 export let configObject = npmciNpmextra.dataFor<INpmciOptions>('npmci', defaultConfig);

ts/npmci.env.ts

@@ -1,6 +1,6 @@
 import * as plugins from './npmci.plugins';
 import * as paths from './npmci.paths';
-import { GitRepo } from 'smartstring';
+import { GitRepo } from '@pushrocks/smartstring';
 import { Dockerfile } from './mod_docker/index';
 
 /**