{"action":"created","issue":{"url":"https://api.github.com/repos/coinbase/salus/issues/4","repository_url":"https://api.github.com/repos/coinbase/salus","labels_url":"https://api.github.com/repos/coinbase/salus/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/coinbase/salus/issues/4/comments","events_url":"https://api.github.com/repos/coinbase/salus/issues/4/events","html_url":"https://github.com/coinbase/salus/pull/4","id":371277573,"node_id":"MDExOlB1bGxSZXF1ZXN0MjIzNzYxODE2","number":4,"title":"implement new and better npm audit scanner","user":{"login":"as3richa","id":16654100,"node_id":"MDQ6VXNlcjE2NjU0MTAw","avatar_url":"https://avatars2.githubusercontent.com/u/16654100?v=4","gravatar_id":"","url":"https://api.github.com/users/as3richa","html_url":"https://github.com/as3richa","followers_url":"https://api.github.com/users/as3richa/followers","following_url":"https://api.github.com/users/as3richa/following{/other_user}","gists_url":"https://api.github.com/users/as3richa/gists{/gist_id}","starred_url":"https://api.github.com/users/as3richa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/as3richa/subscriptions","organizations_url":"https://api.github.com/users/as3richa/orgs","repos_url":"https://api.github.com/users/as3richa/repos","events_url":"https://api.github.com/users/as3richa/events{/privacy}","received_events_url":"https://api.github.com/users/as3richa/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-10-17T21:38:35Z","updated_at":"2018-10-18T17:41:38Z","closed_at":null,"author_association":"COLLABORATOR","pull_request":{"url":"https://api.github.com/repos/coinbase/salus/pulls/4","html_url":"https://github.com/coinbase/salus/pull/4","diff_url":"https://github.com/coinbase/salus/pull/4.diff","patch_url":"https://github.com/coinbase/salus/pull/4.patch"},"body":"tl;dr the old implementation spewed out the entire output of npm audit --json to Salus's STDOUT. This wasn't great, because it was basically impossible to parse out what the specific breakage or remediation is from that output.\r\n\r\nThis PR adds a fairly heavy wrapper interface around npm audit, which distills it down to the most important details - the advisory id, the module name, a link to the advisory, and indicators for whether it's in prod and whether there exists an exception in the config already. For QoL reasons it also flags unnecessary exceptions and exceptions against dev-only advisories.\r\n\r\nSee the screenshot and the new fixtures for what things actually look like\r\n\r\n<img width=\"953\" alt=\"screen shot 2018-10-17 at 2 11 14 pm\" src=\"https://user-images.githubusercontent.com/16654100/47117696-19a1cf80-d233-11e8-91ce-83fb14b5cbc8.png\">\r\n"},"comment":{"url":"https://api.github.com/repos/coinbase/salus/issues/comments/431099008","html_url":"https://github.com/coinbase/salus/pull/4#issuecomment-431099008","issue_url":"https://api.github.com/repos/coinbase/salus/issues/4","id":431099008,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMTA5OTAwOA==","user":{"login":"as3richa","id":16654100,"node_id":"MDQ6VXNlcjE2NjU0MTAw","avatar_url":"https://avatars2.githubusercontent.com/u/16654100?v=4","gravatar_id":"","url":"https://api.github.com/users/as3richa","html_url":"https://github.com/as3richa","followers_url":"https://api.github.com/users/as3richa/followers","following_url":"https://api.github.com/users/as3richa/following{/other_user}","gists_url":"https://api.github.com/users/as3richa/gists{/gist_id}","starred_url":"https://api.github.com/users/as3richa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/as3richa/subscriptions","organizations_url":"https://api.github.com/users/as3richa/orgs","repos_url":"https://api.github.com/users/as3richa/repos","events_url":"https://api.github.com/users/as3richa/events{/privacy}","received_events_url":"https://api.github.com/users/as3richa/received_events","type":"User","site_admin":false},"created_at":"2018-10-18T17:41:38Z","updated_at":"2018-10-18T17:41:38Z","author_association":"COLLABORATOR","body":"> I suggested moving this module just to be directly in the NPMAudit class\r\n\r\nI'm fine with doing this if that's your preference, but just to explain my thought process here 😁:\r\n\r\nMost of the scanners (brakeman, bundle audit, the old nsp one, etc.) call some arbitrary binary with no particular coupling to salus itself, and emit the result of that call pretty much verbatim. Also obviously those binaries have a life/utility outside of salus.\r\n\r\nI tried to separate concerns similarly here: `NpmAuditWrapper` is just an arbitrary program that produces some output; salus calls it and just emits the result. The calling convention is different (a ruby class rather than a binary on disk), but I think it's the same sort of encapsulation."}}
{"actor":{"display_login":"as3richa"}}