#!/usr/bin/env node

// Generates release dependency evidence artifacts and summaries.

import { execFileSync } from "node:child_process";

import { appendFile, mkdir, readFile, rm, writeFile } from "node:fs/promises";

import path from "node:path";

import process from "node:process";

/**

* Dependency evidence reports generated for release artifacts.

*/

export const DEPENDENCY_EVIDENCE_REPORTS = [

{

name: "npm advisory vulnerability gate",

});

}

/**

* Resolves the release tag when the release ref is a SHA or tag.

*/

export function resolveReleaseTag({ releaseRef, packageVersion }) {

if (/^[0-9a-fA-F]{40}$/u.test(releaseRef)) {

return `v${packageVersion}`;

}

return releaseRef;

}

/**

* Resolves the previous reachable release tag for dependency diffs.

*/

export function resolvePreviousReleaseTag({

rootDir = process.cwd(),

execFileSyncImpl = execFileSync,

);

}

/**

* Creates the dependency evidence manifest payload.

*/

export function createDependencyEvidenceManifest({

generatedAt = new Date().toISOString(),

releaseTag,

return JSON.parse(await readFile(filePath, "utf8"));

}

/**

* Reads generated reports and collects summary counts.

*/

export async function collectDependencyEvidenceSummaryCounts(evidenceDir) {

const [vulnerability, transitiveRisk, ownershipSurface, dependencyChanges] = await Promise.all([

readJson(reportPath(evidenceDir, "dependency-vulnerability-gate.json")),

};

}

/**

* Renders the dependency evidence Markdown summary.

*/

export function renderDependencyEvidenceSummary({ releaseTag, releaseSha, baseRef, counts }) {

return `${[

"# Dependency release evidence",

].join("\n")}\n`;

}

/**

* Renders the GitHub Actions step summary for dependency evidence.

*/

export function renderDependencyEvidenceStepSummary({ evidenceArtifactName, baseRef, counts }) {

return `${[

"### Dependency release evidence",

);

}

/**

* Generates dependency evidence reports, manifest, and summaries for a release.

*/

export async function generateDependencyReleaseEvidence({

rootDir = process.cwd(),

outputDir,

return options;

}

/**

* Runs the dependency release evidence generator CLI.

*/

export async function main(argv = process.argv.slice(2)) {

await generateDependencyReleaseEvidence(parseArgs(argv));

return 0;