add npm audit policies rfc #11
Conversation
|
Unable to locate .performanceTestingBot config file |
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
|
Thanks @2lambda123 for opening this PR! For COLLABORATOR only :
|
![gitginie[bot]](https://avatars.githubusercontent.com/in/712912?s=60&v=4){kind=small}
There was a problem hiding this comment.
@2lambda123
Thank you for your contribution to this repository! We appreciate your effort in opening pull request.
Happy coding!
Their most recently public accepted PR is: #9 |
|
Warning Rate limit exceeded@labels-and-badges[bot] has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 13 minutes and 11 seconds before requesting another review. How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configuration File (
|
labels-and-badges
bot
added
NO JIRA
![codereviewbot-ai[bot]](https://avatars.githubusercontent.com/in/309638?s=60&v=4){kind=small}
| ```json | ||
| { | ||
| "audit": { | ||
| "policies": [ | ||
| { | ||
| "name": "Vulnerable", | ||
| "type": "error", | ||
| "query": ":vulnerable" | ||
| }, | ||
| { | ||
| "name": "Peer Conflicts", | ||
| "type": "error", | ||
| "query": ".peer:not(:deduped)" | ||
| }, | ||
| { | ||
| "name": "Deprecated", | ||
| "type": "warn", | ||
| "query": ":deprecated" | ||
| }, | ||
| { | ||
| "name": "Outdated", | ||
| "type": "log", | ||
| "query": ":outdated()" | ||
| }, | ||
| { | ||
| "name": "Licenses", | ||
| "type": "log", | ||
| "query": ":not([license=MIT])" | ||
| }, | ||
| { | ||
| "name": "Remotes", | ||
| "type": "error", | ||
| "query": ":type(git), :type(remote)" | ||
| }, | ||
| { | ||
| "name": "Extraneous", | ||
| "type": "warn", | ||
| "query": ":extraneous" | ||
| }, | ||
| { | ||
| "name": "Missing", | ||
| "type": "warn", | ||
| "query": ":missing" | ||
| }, | ||
| { | ||
| "name": "Duplicate Peers", | ||
| "type": "warn", | ||
| "query": ".peer:not(:deduped)" | ||
| }, | ||
| { | ||
| "name": "Bad Packages", | ||
| "type": "error", | ||
| "query": "#phishing, #spam, #malware" | ||
| }, | ||
| { | ||
| "name": "Bad Actors", | ||
| "type": "error", | ||
| "query": ":attr(contributors, [email=bad@example.com])" | ||
| }, | ||
| { | ||
| "name": "Architecture Mismatch", | ||
| "type": "error", | ||
| "query": "@supports(cpu:x64) { [cpu=!x64] }" | ||
| } | ||
| ] | ||
| } | ||
| } |
There was a problem hiding this comment.
The JSON configuration for audit policies is embedded directly within the markdown document. This can lead to issues with maintainability and readability, especially as the configuration grows or changes over time.
Recommended Solution: Extract the JSON configuration into a separate file and reference it within the markdown document. This will improve maintainability and make it easier to manage changes to the configuration.
|
PR Details of @2lambda123 in npm-rfcs :
|
PR summaryThis Pull Request introduces a new feature for npm that allows users to define audit policies to gate the installation of packages based on specific criteria. The purpose is to enhance security and control over package installations by leveraging existing npm functionalities and metadata. The impact is significant as it provides a more robust mechanism for preventing the installation of potentially harmful or non-compliant packages. SuggestionConsider adding more detailed documentation or examples on how to configure and use these audit policies effectively. This will help users understand the feature better and implement it correctly in their projects. Disclaimer: This comment was entirely generated using AI. Be aware that the information provided may be incorrect. Current plan usage: 34.44% Have feedback or need help? |
Reviewer's Guide by SourceryThis pull request introduces a new RFC document for npm audit policies. The document outlines the motivation behind the feature, the proposed solution, and known caveats. It also includes a detailed JSON structure for defining various audit policies that can gate the installation of packages based on specific conditions. File-Level Changes
Tips
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @2lambda123 - I've reviewed your changes and they look great!
Here's what I looked at during the review
- 🟢 General issues: all looks good
- 🟢 Security: all looks good
- 🟢 Testing: all looks good
- 🟢 Complexity: all looks good
- 🟡 Documentation: 1 issue found
Help me be more useful! Please click 👍 or 👎 on each comment to tell me if it was helpful.
| ### Known Caveats | ||
| - Adding extra validation during installation will slow down execution | ||
| - this will be up to end-users to control & determine what validations are necessary to meet their own requirements | ||
| - Not all usecases will be met |
There was a problem hiding this comment.
suggestion (documentation): Correct typo in 'usecases'.
Change 'usecases' to 'use cases'.
Description
Related Issue
Types of changes
Checklist:
Summary by Sourcery
Add a new feature to npm that allows users to define audit policies to control package installation based on specific criteria, enhancing security and compliance during the package installation process.
New Features: