registry / tegami / 1.2.5

tegami@1.2.5

A tool to manage changelogs, versioning, and publishing in monorepo

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 241 KB of source, external domains: api.github.com, crates.io, github.com, gitlab.com, proxy.golang.org, registry.npmjs.org, tegami.fuma-nama.dev

Source & flagged code

1 flagged

dist/plugins/gitlab.jsView file

Lines 1-41javascript

1import { t as changelogFilename } from "../generate-Cip5o2xy.js";

2import { c as joinPath, n as execFailure, o as cached, r as fetchFailure, s as isCI } from "../error-CAsrGb6e.js";

3import { a as createDraft, l as readChangelogEntries } from "../publish-CQifflae.js";

4import { git } from "./git.js";

5import { i as versionRequestPlugin, n as formatPreview, r as resolveFileCommit, t as createAutoRelease } from "../version-request-CLEmlVnL.js";

6import { readFile, writeFile } from "node:fs/promises";

7import { basename, join, relative, resolve } from "node:path";

8import { x } from "tinyexec";

9import { note, outro } from "@clack/prompts";

10//#region src/plugins/gitlab/api.ts

11function parseGitLabRepo(repo) {

12 const projectPath = repo.replace(/^\/+|\/+$/g, "");

13 if (!projectPath || !projectPath.includes("/")) throw new Error(`Invalid GitLab repository: ${repo}`);

14 return {

15 projectPath,

16 encodedProjectPath: encodeURIComponent(projectPath)

17 };

18}

19async function gitlabRequest(options, path, init = {}) {

20 const headers = new Headers(init.headers);

21 headers.set("Accept", "application/json");

22 if (options.token) headers.set(options.token.type === "job-token" ? "JOB-TOKEN" : "PRIVATE-TOKEN", options.token.value);

23 return fetch(joinPath(options.apiUrl ?? "https://gitlab.com/api/v4", path), {

24 ...init,

25 headers

26 });

27}

28async function releaseExistsByTag(repo, tag, options = {}) {

29 const { encodedProjectPath } = parseGitLabRepo(repo);

30 const response = await gitlabRequest(options, `/projects/${encodedProjectPath}/releases/${encodeURIComponent(tag)}`, { method: "HEAD" });

31 if (response.status === 404) return false;

32 if (!response.ok) throw await fetchFailure(`Failed to get GitLab release for ${tag}`, response);

33 return true;

34}

35async function createRelease(repo, options) {

36 const { encodedProjectPath } = parseGitLabRepo(repo);

37 const response = await gitlabRequest(options, `/projects/${encodedProjectPath}/releases`, {

38 method: "POST",

39 headers: { "Content-Type": "application/json" },

40 body: JSON.stringify({

41 tag_name: options.tag,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/plugins/gitlab.jsView on unpkg · L21

Source & flagged code

1 flagged · loading source

dist/plugins/gitlab.jsView file

21headers.set("Accept", "application/json"); L22: if (options.token) headers.set(options.token.type === "job-token" ? "JOB-TOKEN" : "PRIVATE-TOKEN", options.token.value); L23: return fetch(joinPath(options.apiUrl ?? "https://gitlab.com/api/v4", path), { L24: ...init, ... L39: headers: { "Content-Type": "application/json" }, L40: body: JSON.stringify({ L41: tag_name: options.tag, ... L56: if (!response.ok) throw await fetchFailure("Failed to check for an existing version merge request", response); L57: return (await response.json())[0]?.iid; L58: } ... L168: if (isCI()) { L169: process.stdout.write(`${body}\n`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/plugins/gitlab.jsView on unpkg · L21

Findings

1 High2 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/plugins/gitlab.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/plugins/gitlab.jsView file

Lines 1-41javascript

1import { t as changelogFilename } from "../generate-Cip5o2xy.js";

2import { c as joinPath, n as execFailure, o as cached, r as fetchFailure, s as isCI } from "../error-CAsrGb6e.js";

3import { a as createDraft, l as readChangelogEntries } from "../publish-CQifflae.js";

4import { git } from "./git.js";

5import { i as versionRequestPlugin, n as formatPreview, r as resolveFileCommit, t as createAutoRelease } from "../version-request-CLEmlVnL.js";

6import { readFile, writeFile } from "node:fs/promises";

7import { basename, join, relative, resolve } from "node:path";

8import { x } from "tinyexec";

9import { note, outro } from "@clack/prompts";

10//#region src/plugins/gitlab/api.ts

11function parseGitLabRepo(repo) {

12 const projectPath = repo.replace(/^\/+|\/+$/g, "");

13 if (!projectPath || !projectPath.includes("/")) throw new Error(`Invalid GitLab repository: ${repo}`);

14 return {

15 projectPath,

16 encodedProjectPath: encodeURIComponent(projectPath)

17 };

18}

19async function gitlabRequest(options, path, init = {}) {

20 const headers = new Headers(init.headers);

21 headers.set("Accept", "application/json");

22 if (options.token) headers.set(options.token.type === "job-token" ? "JOB-TOKEN" : "PRIVATE-TOKEN", options.token.value);

23 return fetch(joinPath(options.apiUrl ?? "https://gitlab.com/api/v4", path), {

24 ...init,

25 headers

26 });

27}

28async function releaseExistsByTag(repo, tag, options = {}) {

29 const { encodedProjectPath } = parseGitLabRepo(repo);

30 const response = await gitlabRequest(options, `/projects/${encodedProjectPath}/releases/${encodeURIComponent(tag)}`, { method: "HEAD" });

31 if (response.status === 404) return false;

32 if (!response.ok) throw await fetchFailure(`Failed to get GitLab release for ${tag}`, response);

33 return true;

34}

35async function createRelease(repo, options) {

36 const { encodedProjectPath } = parseGitLabRepo(repo);

37 const response = await gitlabRequest(options, `/projects/${encodedProjectPath}/releases`, {

38 method: "POST",

39 headers: { "Content-Type": "application/json" },

40 body: JSON.stringify({

41 tag_name: options.tag,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/plugins/gitlab.jsView on unpkg · L21