feat: add pnpm audit security test#23
Merged
Merged
Conversation
Adds pnpmaudit as a Language-type security test for JavaScript repos using pnpm. Uses in-cmd detection (checks pnpm-lock.yaml, silent skip if not found) matching the existing npm/yarn audit pattern. 14 touchpoints across API, client, and Docker: - api/config.yaml: pnpmaudit block with image huskyci/pnpmaudit:11.5.2 - api/types/types.go: HuskyCIPnpmAuditOutput in JavaScriptResults - api/context/context.go: PnpmAuditSecurityTest + SetOnceConfig wiring - api/util/api/api.go: seeding + checkSecurityTest registration - api/securitytest/pnpmaudit.go: parser with advisories JSON key - api/securitytest/securitytest.go: dispatch map entry - api/securitytest/run.go: const + vulnOutput routing - api/securitytest/pnpmaudit_test.go: 4 parser unit tests - client/types/types.go: mirrored JavaScriptResults + Summary - client/types/pnpmaudit.go: client-level PnpmAuditOutput types - client/analysis/output.go: print + summary + exit-code via FoundVuln - client/analysis/output_pnpmaudit_test.go: 2 output tests - client/integration/sonarqube/sonarqube.go: collection for SQ - deployments/dockerfiles/pnpmaudit/Dockerfile: node:alpine + pnpm@11.5.2
All three JS security tests (npm, yarn, pnpm) now check for ALL recognized lockfiles before emitting a lockfile-not-found error. Previously npm and yarn only checked each other, so pnpm repos got false LOW vulns from both. Changes: - config.yaml: npm/yarn else-branches now also check pnpm-lock.yaml; pnpm audit gains an else-branch checking package-lock.json + yarn.lock - securitytest.go: add PnpmLockNotFound field to SecTestScanInfo - pnpmaudit.go: detect ERROR_PNPM_LOCK_NOT_FOUND, set flag, emit low vuln - run.go: RunAllInfo tracks all three lockfile-not-found flags; coalesceJsLockfileErrors() replaces 3 LOW vulns with 1 HIGH vuln when no lockfile exists at all - Tests: 5 pnpm parser tests + 2 coalescing tests (all-three, not-all)
The GetAPIConfig test compares a hardcoded expected struct against the actual APIConfig. Since PnpmAuditSecurityTest was added to the struct, the test expected it to be nil but the production code now populates it from config.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
pnpmauditas a new Language-type security test for JavaScript repos using pnpm, alongside the existingnpmaudit(npm) andyarnaudit(yarn).Detection Strategy
In-cmd detection — the shell script checks for
pnpm-lock.yamland silently skips if not found, matching the existing npm/yarn pattern. All three tests run in parallel via errgroup; the wrong package manager test produces empty output.Lockfile Awareness Fix
All three JS audit tests are now mutually aware of each other's lockfiles:
ERROR_PACKAGE_LOCK_NOT_FOUNDwhen neither yarn.lock nor pnpm-lock.yaml existsERROR_YARN_LOCK_NOT_FOUNDwhen neither package-lock.json nor pnpm-lock.yaml existsERROR_PNPM_LOCK_NOT_FOUNDwhen neither package-lock.json nor yarn.lock existsWhen all three report lockfile-not-found (no lockfile in the repo), the 3 individual LOW vulns are coalesced into a single HIGH vuln — because HuskyCI genuinely cannot audit the repo's dependencies.
Files Changed
api/config.yamlapi/types/types.goHuskyCIPnpmAuditOutputinJavaScriptResultsapi/context/context.goPnpmAuditSecurityTestfield + wiringapi/util/api/api.goapi/securitytest/pnpmaudit.goadvisoriesJSON keyapi/securitytest/securitytest.goPnpmLockNotFoundfieldapi/securitytest/run.goapi/securitytest/pnpmaudit_test.goapi/securitytest/run_test.goclient/types/types.go,client/types/pnpmaudit.goclient/analysis/output.goclient/analysis/output_pnpmaudit_test.goclient/integration/sonarqube/sonarqube.godeployments/dockerfiles/pnpmaudit/Dockerfilenode:alpine+pnpm@11.5.2cli/analysis/analysis.goREADME.mddocs/plans/2026-06-08-pnpm-audit.mdTest Results
Post-Merge (Phase C — separate PRs)
huskyci-pnpmauditDocker image to ECR