Fix security linting error: non-literal require in size-checker tests#27
Fix security linting error: non-literal require in size-checker tests#27warengonzaga merged 10 commits intodevfrom
Conversation
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR implements automated bundle size monitoring to enforce the library's "lightweight" promise. It introduces a size validation script that checks the dist output against defined thresholds (1MB total, 512KB per format), integrates it into the CI/CD pipeline, and adds comprehensive test coverage.
Changes:
- Added automated size checker script with configurable thresholds and formatted reporting
- Integrated size checking into the validation pipeline and CI/CD workflows
- Added comprehensive test suite validating script execution and size limits
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
scripts/check-size.js |
New script that recursively calculates directory sizes, validates against thresholds (1MB total, 512KB ESM/CJS), and provides formatted output with exit codes for CI integration |
src/__tests__/size-checker.test.ts |
New test suite with 10 tests covering script existence, execution, output validation, size limit checks, and npm script integration |
package.json |
Added size:check script and integrated it into the validate script chain |
.github/workflows/size-check.yml |
New CI workflow that runs on push/PR to main/dev branches, building and validating bundle size with proper pnpm setup |
README.md |
Added "Size Monitoring" feature documentation and updated available scripts section |
|
@copilot apply changes based on the comments in this thread |
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Applied all changes from the review feedback in commit 8b82c3c:
All tests pass and the script works correctly. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
|
@copilot apply changes based on the comments in this thread. |
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Applied all changes from the review feedback in commit a742641: Error Handling & Validation:
Type Safety:
Documentation:
All tests pass and the script now provides better error detection and reporting. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
|
@copilot apply changes based on the comments in this thread |
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Applied all changes from the review feedback in commit d093805: Security Fix:
Error Visibility Fix:
All tests pass and the code is now more secure and reliable. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
* 📦 new: add bundle size checker with tests and workflow (#27) * Initial plan * 📦 new: add bundle size checker with tests and workflow Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 📖 docs: add bundle size checker to documentation Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🧪 test: fix inverted logic in size checker test Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔒 security: add permissions block to size-check workflow Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * ⚙️ setup: fix linting issues in size-checker test Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: address PR review feedback Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: improve error handling and validation Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔒 security: fix shell injection and improve error visibility Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔒 security: fix non-literal require in tests Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 📦 new (emoji): add emoji selector and context-aware logic (#26) * Initial plan * 📦 new (emoji): add emoji selector and context-aware logic Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 📖 docs: add comprehensive emoji feature documentation Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: fix linting issues in emoji feature Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update (emoji): address code review feedback Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: enable emoji by default and move toggle to format.includeEmoji Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 📖 docs: update README for new emoji configuration pattern Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: fix trailing spaces in tests Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update (emoji): address code review feedback on performance and state management Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update (emoji): move config to Logger.configure() to preserve regex cache Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: fix eslint errors by removing invalid security rule comments Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔒 security: add eslint-disable comments for safe code patterns Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * � test: improve patch coverage for emoji feature - Remove deprecated dead-code methods (getMappings, matchesKeywords) from EmojiSelector - Add tests for unknown log level edge case in EmojiSelector - Add tests for Logger.configure emoji configuration path - Add tests for numeric and boolean data edge cases * 🧪 test: improve patch coverage for emoji feature - Remove deprecated dead-code methods (getMappings, matchesKeywords) from EmojiSelector - Add tests for unknown log level edge case in EmojiSelector - Add tests for Logger.configure emoji configuration path - Add tests for numeric and boolean data edge cases * 🗑️ remove: delete outdated Snyk security instructions * 🔧 update: address code review feedback on performance and safety Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> Co-authored-by: Waren Gonzaga <opensource@warengonzaga.com> * 🚀 release: bump version to 2.3.0 * 🗑️ remove: delete repository banner image * 📖 docs: update README with new features and improved descriptions * 📖 docs: update README to format code blocks for emoji log examples --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
* 📦 new: add bundle size checker with tests and workflow (#27) * Initial plan * 📦 new: add bundle size checker with tests and workflow Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 📖 docs: add bundle size checker to documentation Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🧪 test: fix inverted logic in size checker test Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔒 security: add permissions block to size-check workflow Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * ⚙️ setup: fix linting issues in size-checker test Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: address PR review feedback Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: improve error handling and validation Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔒 security: fix shell injection and improve error visibility Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔒 security: fix non-literal require in tests Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 📦 new (emoji): add emoji selector and context-aware logic (#26) * Initial plan * 📦 new (emoji): add emoji selector and context-aware logic Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 📖 docs: add comprehensive emoji feature documentation Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: fix linting issues in emoji feature Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update (emoji): address code review feedback Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: enable emoji by default and move toggle to format.includeEmoji Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 📖 docs: update README for new emoji configuration pattern Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: fix trailing spaces in tests Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update (emoji): address code review feedback on performance and state management Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update (emoji): move config to Logger.configure() to preserve regex cache Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: fix eslint errors by removing invalid security rule comments Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔒 security: add eslint-disable comments for safe code patterns Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * � test: improve patch coverage for emoji feature - Remove deprecated dead-code methods (getMappings, matchesKeywords) from EmojiSelector - Add tests for unknown log level edge case in EmojiSelector - Add tests for Logger.configure emoji configuration path - Add tests for numeric and boolean data edge cases * 🧪 test: improve patch coverage for emoji feature - Remove deprecated dead-code methods (getMappings, matchesKeywords) from EmojiSelector - Add tests for unknown log level edge case in EmojiSelector - Add tests for Logger.configure emoji configuration path - Add tests for numeric and boolean data edge cases * 🗑️ remove: delete outdated Snyk security instructions * 🔧 update: address code review feedback on performance and safety Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> Co-authored-by: Waren Gonzaga <opensource@warengonzaga.com> * 🚀 release: bump version to 2.3.0 * 🗑️ remove: delete repository banner image * 📖 docs: update README with new features and improved descriptions * 📖 docs: update README to format code blocks for emoji log examples * 🔧 update: add LogCallOptions interface and update signatures (#31) * Initial plan * 🔧 update: add LogCallOptions interface and update signatures Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🧪 test: add comprehensive tests for emoji override Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: add options parameter to LogEngine wrapper Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: address code review feedback Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 📖 docs: enhance LogCallOptions JSDoc and add LogEngine wrapper tests Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update: replace magic numbers with LogMode enum constants Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🚀 release: bump version to 2.3.1 --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
CI security linting was failing on
security/detect-non-literal-requirerule violation in test file.Changes
src/tests/size-checker.test.ts
require()call withreadFileSync()+JSON.parse()readFileSyncimport fromfsBefore/After
The linting rule flags
require()with computed paths as potential arbitrary file loading vectors. Using explicit file system operations avoids the warning while maintaining identical functionality.Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
downloads.snyk.io/home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec(dns block)o30291.ingest.sentry.io/home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec(dns block)static.snyk.io/home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec(dns block)If you need me to access, download, or install something from one of these locations, you can either:
Original prompt
💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.