https://github.com/jahilldev/audit-teamcity-report

Simple CLI that loads local project dependencies and outputs an NPM audit in TeamCity service message format.
https://github.com/jahilldev/audit-teamcity-report

cli continuous-integration nodejs npm npm-audit reporter teamcity tooling typescript yarn yarn-audit

Last synced: 29 days ago
JSON representation

Simple CLI that loads local project dependencies and outputs an NPM audit in TeamCity service message format.

• Host: GitHub
• URL: https://github.com/jahilldev/audit-teamcity-report
• Owner: jahilldev
• Created: 2021-01-18T12:36:46.000Z (almost 4 years ago)
• Default Branch: master
• Last Pushed: 2022-02-09T13:00:20.000Z (almost 3 years ago)
• Last Synced: 2024-10-06T11:58:50.981Z (about 1 month ago)
• Topics: cli, continuous-integration, nodejs, npm, npm-audit, reporter, teamcity, tooling, typescript, yarn, yarn-audit
• Language: TypeScript
• Homepage:
• Size: 290 KB
• Stars: 1
• Watchers: 2
• Forks: 0
• Open Issues: 1
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
`audit-teamcity-report` is a simple CLI and library that prints out an NPM package audit in TeamCity service message format. Useful for running security audits in CI/CD, and monitoring changes.

This package calls the NPM restful API directly to gather security vulnerability data and suggestions. This makes it faster than running `npm audit` and then using the output to generate readable TeamCity service messages.

# Getting Started

Install with Yarn:

```bash

$ yarn add --dev audit-teamcity-report

```

Install with NPM:

```bash

$ npm i --save-dev audit-teamcity-report

```

# Demo

When the audit identifies vulnerabilities for your packages, a new tab for that build labeled "Code Inspection" will appear. You'll get a list of all packages that require an update, with a description and link to the advisory.

![alt text](demo.png)

# Useage

The package can be used in two ways, via the CLI or by consuming the exported functions. `audit-teamcity-report` will, by default, load your `package.json` file from the current working directory. It'll then check for a `package-lock.json` file, if this isn't found, it will try and load a `yarn.lock` file. If neither lock files are found, it'll run an audit on your top level dependencies only.

If you'd like to only report on packages installed directly into your project (top level), you can use the `topLevelOnly` argument to do so.

## CLI

```bash

$ audit-teamcity-report

```

## Node

```javascript

import { readDependencies, auditService, outputReport } from 'audit-teamcity-report';

/*[...]*/

const project = await readDependencies({ topLevelOnly: false });

const result = await auditService(project);

// optional

outputReport(result);

```