Installations
npm install @secretlint/config-loaderDeveloper Guide
BETA
Typescript
Yes
Module System
ESM
Min. Node Version
^14.13.1 || >=16.0.0
Node Version
18.20.4
NPM Version
lerna/2.7.2/node@v18.20.4+x64 (linux)
Score
97.5
Supply Chain
100
Quality
84.5
Maintenance
100
Vulnerability
99.6
License
Releases
83
Contributors
28
Unable to fetch Contributors
Languages
4
TypeScript
JavaScript
Shell
Dockerfile
TypeScript (95.83%)
JavaScript (3.33%)
Shell (0.59%)
Dockerfile (0.25%)
Love this project? Help keep it running — sponsor us today! 🚀
Developer
secretlint
Download Statistics
Total Downloads
4,021,430
Last Day
7,170
Last Week
7,170
Last Month
127,437
Last Year
1,621,983
GitHub Statistics
980 Stars
1,275 Commits
40 Forks
8 Watching
6 Branches
28 Contributors
Bundle Size
202.37 kB
Minified
60.91 kB
Minified + Gzipped
Maintainers
2
Package Meta Information
Latest Version
9.0.0
Package Id
@secretlint/config-loader@9.0.0
Unpacked Size
97.12 kB
Size
20.01 kB
File Count
38
NPM Version
lerna/2.7.2/node@v18.20.4+x64 (linux)
Node Version
18.20.4
Publised On
14 Oct 2024
Total Downloads
Cumulative downloads
Total Downloads
4,021,430
Last day
0%
7,170
Compared to previous day
Last week
-75.2%
7,170
Compared to previous week
Last month
-11.5%
127,437
Compared to previous month
Last year
50.6%
1,621,983
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Versions
@secretlint/config-loader
Config loader for secretlint.
Install
Install with npm:
npm install @secretlint/config-loader
Usage
API Interface
1import { SecretLintConfigDescriptor, SecretLintCoreDescriptor } from "@secretlint/types"; 2export declare type SecretLintConfigLoaderOptions = { 3 cwd?: string; 4}; 5export declare type SecretLintConfigLoaderResult = { 6 ok: true; 7 configFilePath: string; 8 config: SecretLintCoreDescriptor; 9} | { 10 ok: false; 11 configFilePath: null; 12 config: null; 13 errors: Error[]; 14}; 15export declare type SecretLintConfigLoaderRawResult = { 16 ok: true; 17 configFilePath: string; 18 config: SecretLintConfigDescriptor; 19} | { 20 ok: false; 21 errors: Error[]; 22}; 23/** 24 * Load config file and return config object that is loaded rule instance. 25 * @param options 26 */ 27export declare const loadConfig: (options: SecretLintConfigLoaderOptions) => SecretLintConfigLoaderResult; 28export declare const loadConfigRaw: (options: SecretLintConfigLoaderOptions) => SecretLintConfigLoaderRawResult;
Example
1impor { loadConfig } from "@secretlint/config-loader"; 2// Load <CurrentDir>/.secretlintrc.{json,yml,js} 3const { ok, config, configFilePath, errors } = loadConfig({ cwd: process.cwd() }); 4if(ok) { 5 console.log("load from configFile:" + configFilePath); 6 console.log("config", config); 7} else{ 8 console.error(errors); 9}
Terminology
- ConfigDescriptor: config file literal that is not loaded yet
- Config: loaded object
Workflow
- Validate
ConfigDescriptor - Load
ConfigDescriptorand createConfigobject - imports each rule modules - Validate Loaded
ConfigwithConfigDescriptor- Invalid option, Invalid allowMessageIds, Invalid id specify for a preset
- If all validation is passed, get a Config.
Changelog
See Releases page.
Running tests
Install devDependencies and Run npm test:
npm test
Contributing
Pull requests and stars are always welcome.
For bugs and feature requests, please create an issue.
- Fork it!
- Create your feature branch:
git checkout -b my-new-feature - Commit your changes:
git commit -am 'Add some feature' - Push to the branch:
git push origin my-new-feature - Submit a pull request :D
Author
License
MIT © azu
No vulnerabilities found.
Reason
30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
no dangerous workflow patterns detected
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish-artifact.yml:45
Reason
no binaries found in the repo
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/secretlint/.github/SECURITY.md:1
- Info: Found linked content: github.com/secretlint/.github/SECURITY.md:1
- Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
- Info: Found text in security policy: github.com/secretlint/.github/SECURITY.md:1
Reason
SAST tool detected but not run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Warn: 23 commits out of 30 are checked with a SAST tool
Reason
3 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
Reason
Found 1/29 approved changesets -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/test-diff.yml:8
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/benchmark.yml:9
- Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:24
- Info: topLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:25
- Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/codeql-analysis.yml:26
- Warn: topLevel 'security-events' permission set to 'write': .github/workflows/codeql-analysis.yml:27
- Info: topLevel 'contents' permission set to 'read': .github/workflows/comment-publish-artifact.yml:10
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/create-release-pr.yml:15
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/publish-artifact.yml:11
- Warn: topLevel 'packages' permission set to 'write': .github/workflows/publish-artifact.yml:12
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/publish.yml:11
- Warn: no topLevel permission defined: .github/workflows/test-diff.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/test.yml:9
- Info: no jobLevel write permissions found
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
Project has not signed or included provenance with any releases.
Details
- Warn: release artifact v9.0.0 not signed: https://api.github.com/repos/secretlint/secretlint/releases/179740637
- Warn: release artifact v8.5.0 not signed: https://api.github.com/repos/secretlint/secretlint/releases/179737095
- Warn: release artifact v8.4.0 not signed: https://api.github.com/repos/secretlint/secretlint/releases/178559699
- Warn: release artifact v8.3.3 not signed: https://api.github.com/repos/secretlint/secretlint/releases/178547108
- Warn: release artifact v8.3.2 not signed: https://api.github.com/repos/secretlint/secretlint/releases/178524561
- Warn: release artifact v9.0.0 does not have provenance: https://api.github.com/repos/secretlint/secretlint/releases/179740637
- Warn: release artifact v8.5.0 does not have provenance: https://api.github.com/repos/secretlint/secretlint/releases/179737095
- Warn: release artifact v8.4.0 does not have provenance: https://api.github.com/repos/secretlint/secretlint/releases/178559699
- Warn: release artifact v8.3.3 does not have provenance: https://api.github.com/repos/secretlint/secretlint/releases/178547108
- Warn: release artifact v8.3.2 does not have provenance: https://api.github.com/repos/secretlint/secretlint/releases/178524561
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/benchmark.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/benchmark.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/benchmark.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/benchmark.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/benchmark.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/benchmark.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/comment-publish-artifact.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/comment-publish-artifact.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/comment-publish-artifact.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/comment-publish-artifact.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/comment-publish-artifact.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/comment-publish-artifact.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/create-release-pr.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/create-release-pr.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/create-release-pr.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/create-release-pr.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/create-release-pr.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/create-release-pr.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-artifact.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish-artifact.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-artifact.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish-artifact.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-artifact.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish-artifact.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-artifact.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish-artifact.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-artifact.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish-artifact.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-artifact.yml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish-artifact.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-artifact.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish-artifact.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish.yml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:85: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish.yml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish.yml:105: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-diff.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/test-diff.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-diff.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/test-diff.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-diff.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/test-diff.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/test.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/secretlint/secretlint/test.yml/master?enable=pin
- Warn: containerImage not pinned by hash: publish/docker/Dockerfile:1: pin your Docker image by updating node:20-alpine to node:20-alpine@sha256:2cd2a6f4cb37cf8a007d5f1e9aef090ade6b62974c7a274098c390599e8c72b4
- Warn: npmCommand not pinned by hash: publish/docker/Dockerfile:11-19
- Info: 0 out of 22 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 15 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 containerImage dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Score
5.5
/10
Last Scanned on 2025-01-27
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn MoreGathering detailed insights and metrics for @secretlint/config-loader