feat: initial commit

.backstage/component.yaml

@@ -0,0 +1,11 @@
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: csp-evaluator-cli
+  title: Content Security Policy Evaluator Command line tool
+  description: A command line tool to validate Content-Security-Policy rules
+spec:
+  type: library
+  lifecycle: production
+  owner: freight-control
+  system: developer-tools

.commitlintrc.cjs

@@ -0,0 +1,3 @@
+module.exports = {
+  extends: ["@commitlint/config-conventional"],
+}

.eslintignore

@@ -0,0 +1 @@
+.sage

.eslintrc.cjs

@@ -0,0 +1,8 @@
+module.exports = {
+  extends: ["plugin:@einride/default"],
+  rules: {
+    "no-console": "off",
+    "@typescript-eslint/explicit-function-return-type": "off",
+    "import/extensions": "off",
+  },
+}

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @einride/freight-control

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+
+updates:
+  # npm == yarn in dependabot
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: monthly
+      day: "sunday"
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*" # Include all dependencies in one PR
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: gomod
+    directory: .sage
+    schedule:
+      interval: monthly
+      day: "sunday"
+    groups:
+      go-dependencies:
+        patterns:
+          - "*" # Include all dependencies in one PR
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/release.yaml

@@ -0,0 +1,37 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - master
+      - next
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # to create release (semantic release)
+      id-token: write # to publish with provenance
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Sage
+        uses: einride/sage/actions/setup@master
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+
+      - name: Release
+        run: make release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/review.yaml

@@ -0,0 +1,28 @@
+name: Review
+
+on:
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  review:
+    name: Review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Sage
+        uses: einride/sage/actions/setup@master
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+
+      - name: Review
+        run: make

.gitignore

@@ -0,0 +1,7 @@
+# node
+node_modules
+# corepack
+.yarn/*
+!.yarn/releases
+# gh auth
+gha-creds-*.json

.nvmrc

@@ -0,0 +1 @@
+v20.10.0

.prettierrc.mjs

@@ -0,0 +1,5 @@
+import einridePrettierConfig from "@einride/prettier-config"
+
+export default {
+  ...einridePrettierConfig,
+}

.releaserc.cjs

@@ -0,0 +1,30 @@
+module.exports = {
+  branches: [
+    "+([0-9])?(.{+([0-9]),x}).x",
+    "master",
+    "next",
+    "next-major",
+    { name: "beta", prerelease: true },
+    { name: "alpha", prerelease: true },
+  ],
+  plugins: [
+    [
+      "@semantic-release/commit-analyzer",
+      {
+        preset: "conventionalcommits",
+      },
+    ],
+    "@semantic-release/github",
+    "semantic-release-yarn",
+    [
+      "@semantic-release/release-notes-generator",
+      {
+        preset: "conventionalcommits",
+      },
+    ],
+  ],
+  // disable updates to github PRs and issues due to successful releases
+  success: false,
+  // disable creation of github issues due to failed releases
+  fail: false,
+}

.sage/go.mod

@@ -0,0 +1,5 @@
+module github.com/einride/csp-evaluator-cli/.sage
+
+go 1.17
+
+require go.einride.tech/sage v0.294.0

.sage/go.sum

@@ -0,0 +1,2 @@
+go.einride.tech/sage v0.294.0 h1:X5v6sfvt762QwhcRptlYRKoYrNXb1nT9fxKDXsRtaWI=
+go.einride.tech/sage v0.294.0/go.mod h1:EzV5uciFX7/2ho8EKB5K9JghOfXIxlzs694b+Tkl5GQ=

.sage/main.go

@@ -0,0 +1,97 @@
+package main
+
+import (
+	"context"
+
+	"go.einride.tech/sage/sg"
+	"go.einride.tech/sage/tools/sgbackstage"
+	"go.einride.tech/sage/tools/sggit"
+	"go.einride.tech/sage/tools/sggolangcilint"
+	"go.einride.tech/sage/tools/sggolines"
+)
+
+func main() {
+	sg.GenerateMakefiles(
+		sg.Makefile{
+			Path:          sg.FromGitRoot("Makefile"),
+			DefaultTarget: Default,
+		},
+	)
+}
+
+func Default(ctx context.Context) error {
+	sg.Deps(ctx, Install)
+	sg.Deps(ctx, Review)
+	sg.SerialDeps(ctx, GitVerifyNoDiff)
+	return nil
+}
+
+func Install(ctx context.Context) error {
+	sg.Logger(ctx).Println("installing dependencies...")
+	return sg.Command(ctx, "yarn", "install").Run()
+}
+
+func InstallImmutable(ctx context.Context) error {
+	sg.Logger(ctx).Println("installing dependencies...")
+	return sg.Command(ctx, "yarn", "install", "--immutable").Run()
+}
+
+func Review(ctx context.Context) error {
+	sg.Deps(ctx,
+		Lint, Format,
+		Commitlint,
+		GoLint, GoFormat,
+		BackstageValidate,
+	)
+	return nil
+}
+
+func Commitlint(ctx context.Context) error {
+	sg.Logger(ctx).Println("formatting...")
+	cmd := sg.Command(ctx, "yarn", "commitlint", "--from", "origin/master", "--to", "HEAD")
+	return cmd.Run()
+}
+
+func Lint(ctx context.Context) error {
+	sg.Logger(ctx).Println("formatting...")
+	cmd := sg.Command(ctx, "yarn", "eslint", "--ext", "js", ".")
+	return cmd.Run()
+}
+
+func Format(ctx context.Context) error {
+	sg.Logger(ctx).Println("formatting...")
+	cmd := sg.Command(ctx, "yarn", "prettier", "--write", ".")
+	return cmd.Run()
+}
+
+func GoLint(ctx context.Context) error {
+	sg.Logger(ctx).Println("linting Go files...")
+	return sggolangcilint.Run(ctx)
+}
+
+func GoLintFix(ctx context.Context) error {
+	sg.Logger(ctx).Println("fixing Go files...")
+	return sggolangcilint.Fix(ctx)
+}
+
+func GoFormat(ctx context.Context) error {
+	sg.Logger(ctx).Println("formatting Go files...")
+	return sggolines.Run(ctx)
+}
+
+func BackstageValidate(ctx context.Context) error {
+	sg.Logger(ctx).Println("validating Backstage files...")
+	return sgbackstage.Validate(ctx)
+}
+
+func GitVerifyNoDiff(ctx context.Context) error {
+	sg.Logger(ctx).Println("verifying that git has no diff...")
+	return sggit.VerifyNoDiff(ctx)
+}
+
+func Release(ctx context.Context) error {
+	sg.Logger(ctx).Println("releasing...")
+	sg.Deps(ctx, InstallImmutable)
+	cmd := sg.Command(ctx, "yarn", "semantic-release", "--ci")
+	return cmd.Run()
+}

.yarnrc.yml

@@ -0,0 +1,8 @@
+yarnPath: .yarn/releases/yarn-3.5.0.cjs
+defaultSemverRangePrefix: ""
+nodeLinker: node-modules
+
+npmScopes:
+  saga:
+    npmAlwaysAuth: true
+    npmRegistryServer: "https://europe-west1-npm.pkg.dev/e-npm-registry-prod/npm/"

CONTRIBUTING.md

@@ -0,0 +1,10 @@
+# Contributing
+
+Thanks for showing interest in contributing to `@einride/csp-evaluator-cli`!
+
+## Pull Request Guidelines
+
+`@einride/csp-evaluator-cli` is using the
+[Conventional Commits](https://www.conventionalcommits.org/) commit message convention.
+
+Before opening a PR, please make sure you get no errors when running `make convco-check`.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Einride
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.