Update MegaLinter

.cspell.json

@@ -4,6 +4,7 @@
   "ignorePaths": [
     ".vscode",
     "**/.git/**",
+    "**/docs/images/**",
     "**/node_modules/**",
     "**/vscode-extension/**",
     "cinder",
@@ -30,6 +31,7 @@
     "eslintcache",
     "Garnham",
     "ghaction",
+    "GITLEAKS",
     "GNUPGHOME",
     "gpgsign",
     "Gpgsign",
@@ -53,10 +55,12 @@
     "ncipollo",
     "noproxy",
     "noreply",
+    "nosemgrep",
     "nuxt",
     "oidc",
     "Oidc",
     "openpgp",
+    "oxsecurity",
     "Parens",
     "pids",
     "RELOADAGENT",
@@ -69,6 +73,7 @@
     "strcmp",
     "stringifying",
     "STYLELINT",
+    "TRIVY",
     "tsbuildinfo",
     "venv",
     "vercel",

.github/workflows/mega-linter.yml

@@ -10,6 +10,7 @@ on:
     branches: [main, develop]
 
 permissions:
+  issues: write
   pull-requests: write
   statuses: write
 
@@ -37,7 +38,7 @@ jobs:
         id: ml
         # You can override MegaLinter flavor used to have faster performances
         # More info at https://megalinter.github.io/flavors/
-        uses: megalinter/megalinter/flavors/javascript@v5
+        uses: oxsecurity/megalinter/flavors/javascript@v6
         env:
           # All available variables are described in documentation
           # https://megalinter.github.io/configuration/

.github/workflows/test.yml

@@ -146,6 +146,7 @@ jobs:
           # Import test GPG key
           # secretlint-disable
           {
+            # nosemgrep
             echo -e "-----BEGIN PGP PRIVATE KEY BLOCK-----\n"
             cat __tests__/fixtures/test-key-committer.pgp
             echo -e "\n-----END PGP PRIVATE KEY BLOCK-----\n"

.mega-linter.yml

@@ -10,6 +10,8 @@ DEFAULT_BRANCH: main # Usually master or main
 # - SPELL # Uncomment to disable checks of spelling mistakes
 DISABLE_LINTERS:
   - TYPESCRIPT_STANDARD
+  - REPOSITORY_GITLEAKS
+  - REPOSITORY_TRIVY
 SHOW_ELAPSED_TIME: true
 FILEIO_REPORTER: false
 JAVASCRIPT_ES_FILTER_REGEX_EXCLUDE: (dist|cinder|jest.config.js)

.semgrepignore

@@ -0,0 +1,3 @@
+cinder/
+dist/
+megalinter-reports/

CONTRIBUTING.md

@@ -64,7 +64,7 @@ Document format should be Markdown unless an alternative format is really necess
 
 ## Style guides
 
-In this repository we use Megalinter. We recommend you to install the local checker so as to speed up your contribution process. You will find the local installation options at the bottom of the page: <https://megalinter.github.io/v5/installation/>.
+In this repository we use Megalinter. We recommend you to install the local checker so as to speed up your contribution process. You will find the local installation options at the bottom of the page: <https://oxsecurity.github.io/megalinter/v5/installation/>.
 
 ### Code style guide
 

__tests__/unit/queue.test.ts

@@ -240,6 +240,7 @@ describe('Queue', () => {
 
     const output = gitLogForLatestCommit(gitRepo.getDirPath())
 
+    // nosemgrep
     expect(RegExp(`gpg:.+RSA.+${signingKeyFingerprint}`).test(output)).toBe(
       true
     )

docs/development.md

@@ -108,7 +108,7 @@ In order to contribute you should follow the next steps:
 
 3. Make your changes and commit them using [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) format. Make sure you sign your commits.
 
-4. It is very important that all commits have a distribution package of the application. That means you should run always: `yarn install && yarn build && yarn package` before committing. That sometimes changes the content of the `dist` folder. Those changes should be included in the commit. We encourage you tu run `yarn install && yarn all` before committing. That command is going to build the app but it's also going to test it and fix the TypeScript linting.
+4. It is very important that all commits have a distribution package of the application. That means you should run always: `yarn install && yarn build && yarn package` before committing. That sometimes changes the content of the `dist` folder. Those changes should be included in the commit. That command is going to build the app but it's also going to test it and fix the TypeScript linting.
 
 5. The target branch for your pull request should be `develop`. Keep you branch rebased with `develop` branch.
 

src/__tests__/config.ts

@@ -32,6 +32,7 @@ export function testConfiguration(): TestConfig {
   )
 
   // secretlint-disable
+  // nosemgrep
   const gpgPrivateKey = `-----BEGIN PGP PRIVATE KEY BLOCK-----\n\n${gpgPrivateKeyBody}\n-----END PGP PRIVATE KEY BLOCK-----`
   // secretlint-enable
 

src/__tests__/gpg.ts

@@ -102,6 +102,7 @@ export const overwriteAgentConfiguration = async (
   config: string,
   homedir: string
 ): Promise<void> => {
+  // nosemgrep
   const gpgAgentConfPath: string = path.join(homedir, 'gpg-agent.conf')
 
   fs.writeFile(gpgAgentConfPath, config, function (err) {

src/git-repo-dir.ts

@@ -10,13 +10,14 @@ export class GitRepoDir {
     this.dirPath = this.normalizePath(dirPath)
   }
 
-  guardThatDirExists(dirPath): void {
+  guardThatDirExists(dirPath: string): void {
     if (!existsSync(dirPath)) {
       throw new GitDirNotFoundError(dirPath)
     }
   }
 
-  normalizePath(dirPath): string {
+  normalizePath(dirPath: string): string {
+    // nosemgrep
     return isAbsolute(dirPath) ? dirPath : resolve(dirPath)
   }
 

src/queue-name.ts

@@ -20,7 +20,8 @@ export class QueueName implements Nullable {
     return this.value === other.value
   }
 
-  guardThatNameIsValid(value): void {
+  guardThatNameIsValid(value: string): void {
+    // nosemgrep
     if (!RegExp(`^[a-z-_ ]{1,${MAX_QUEUE_NAME_LENGTH}}$`).test(value)) {
       throw new QueueNameNotValidError(value)
     }