ci: build the self-scan from source instead of installing @latest - #100
Merged
Conversation
This repository IS ThreatCrush, and its own scan workflow was installing `@profullstack/threatcrush@latest` from npm to scan itself. That was wrong two ways: a pull request that broke the scanner still passed its own gate, because the gate ran the previously-published code; and a broken *publish* took the gate down entirely — `workspace:*` shipped in the 0.7.0/0.7.1 manifests made `npm install` fail with EUNSUPPORTEDPROTOCOL, so every PR's scan errored on a registry problem unrelated to the diff. Build the CLI from the checkout and put it on PATH as `threatcrush` via a one-line shim, so every step below runs unchanged. The registry is out of the path completely: no version to pin, nothing to install, and the scan tests the code in the pull request, which is what a self-scan is for. The fleet hash header is dropped deliberately so a drift check does not revert this — the customisation is specific to the repo that owns the tool. Everything downstream of the build (interface detection, SARIF handling, fail-closed logic, reporting) is unchanged from the pack. Verified locally: the built CLI reports --version and the native --format interface, and `scan . --format sarif` produces a non-empty SARIF and exits 0, so the job passes as an advisory scan. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ThreatCrush Security Scan141 finding(s) HIGH/CRITICAL: 19 | MEDIUM: 86 | LOW: 36
…and 91 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the unpinned-
@latestfragility for the one scan workflow that lives in this repo — the self-scan.The problem
This repository is ThreatCrush, and its own scan workflow installed
@profullstack/threatcrush@latestfrom npm to scan itself. Wrong two ways:workspace:*shipped in the 0.7.0/0.7.1 manifests, sonpm installfailed withEUNSUPPORTEDPROTOCOL— every PR's scan errored on a registry problem unrelated to its diff. That's the failure this surfaced through.The fix
Build the CLI from the checkout and put it on PATH as
threatcrushvia a one-line shim, so every step below runs unchanged:The registry is out of the path entirely: no version to pin, nothing to install, and the scan tests the code in the PR — which is what a self-scan is for. Everything downstream (interface detection, SARIF handling, fail-closed logic, reporting) is unchanged from the pack.
The fleet-management hash header is dropped deliberately, so a drift check doesn't revert a customisation that is specific to the repo owning the tool.
Effect
This turns the self-scan check from red (install error on the broken publish) to green (advisory scan, job passes). Verified locally: the built CLI reports
--versionand the native--formatinterface, andscan . --format sarifproduces a non-empty SARIF and exits 0.Heads-up, separate from this PR: the self-scan reports ~141 advisory findings on the monorepo, and the bulk are the scanner detecting its own rule definitions and test fixtures (
packages/scan,modules) — vulnerable-by-design example code. Worth a path exclusion or.threatcrush.ymlignore later so the Security tab isn't dominated by the tool flagging its own examples. Not blocking: it's advisory and the job passes.