aegis-scan 0.3.0

Supply chain security CLI for npm — detect malicious packages before installing
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149

name: Code Quality

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  check:
    name: Check, Lint & Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache cargo registry and build artifacts
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            cargo-${{ runner.os }}-

      - name: Check formatting
        run: cargo fmt --check

      - name: Run clippy
        run: cargo clippy -- -D warnings

      - name: Run tests
        run: cargo test

      - name: Build release
        run: cargo build --release

  security:
    name: Security & Compliance
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry and build artifacts
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-security-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            cargo-security-${{ runner.os }}-

      - name: Install cargo-deny
        run: cargo install cargo-deny --locked

      - name: Run cargo-deny
        run: cargo deny check

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Run cargo-audit
        run: cargo audit

  semver:
    name: Semver Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry and build artifacts
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-semver-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            cargo-semver-${{ runner.os }}-

      - name: Install cargo-semver-checks
        run: cargo install cargo-semver-checks --locked

      - name: Check semver compliance
        run: |
          # Use the latest published version as baseline.
          # If no compatible baseline exists yet, skip gracefully.
          cargo semver-checks check-release || {
            echo "::warning::semver-checks failed — may need a published baseline with lib target"
            true
          }

  coverage:
    name: Code Coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry and build artifacts
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-coverage-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            cargo-coverage-${{ runner.os }}-

      - name: Install cargo-tarpaulin
        run: cargo install cargo-tarpaulin

      - name: Run coverage
        run: cargo tarpaulin --out xml --output-dir coverage/

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          files: coverage/cobertura.xml
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false