History

Colin 4f58b92a31 ci/woodpecker/push/woodpecker Pipeline failed Details Fix lockfile-check: use temp dir to avoid node_modules race - Check mode now works in isolated temp directory - Removed dependency on test step (not needed) - No longer touches workspace node_modules		2026-01-23 20:09:08 -05:00
..
README.md	Security improvements and local testing scripts	2026-01-21 10:21:55 -05:00
generate-sitemap.js	Add sitemap.xml generation with MCP discovery endpoint	2026-01-23 09:27:09 -05:00
install-git-hooks.sh	Add unused code/dependency scanning with knip and depcheck	2026-01-23 09:04:57 -05:00
refresh-lockfile.sh	Fix lockfile-check: use temp dir to avoid node_modules race	2026-01-23 20:09:08 -05:00
scan-sbom-image.sh	Security improvements and local testing scripts	2026-01-21 10:21:55 -05:00
scan-sbom.sh	Security improvements and local testing scripts	2026-01-21 10:21:55 -05:00
scan-trivy-fs.sh	Security improvements and local testing scripts	2026-01-21 10:21:55 -05:00
scan-trivy-image.sh	Security improvements and local testing scripts	2026-01-21 10:21:55 -05:00

README.md

Scripts

This directory contains utility scripts for the Hastebin project.

Git Hooks Installation

`install-git-hooks.sh`

Installs Git pre-commit hooks to prevent pushing broken code. The hook runs core tests before each commit.

Usage:

./scripts/install-git-hooks.sh

What it does:

Creates a pre-commit hook in .git/hooks/pre-commit
The hook runs npm run test:core before each commit
If tests fail, the commit is aborted
Automatically installs dependencies if node_modules is missing

Skipping the hook:

If you need to skip the pre-commit hook (not recommended), use:

git commit --no-verify

Note: The hook runs core tests only (faster than the full test suite) to keep commit times reasonable. Full tests are still run in CI/CD via Woodpecker.

Security Scanning

SBOM Generation

`scan-sbom.sh`

Generates a Software Bill of Materials (SBOM) for the source code using Syft. Creates SBOM files in multiple formats (table, SPDX JSON, CycloneDX JSON).

Usage:

./scripts/scan-sbom.sh
# or
npm run scan:sbom

Output files:

sbom.txt - Human-readable table format
sbom.spdx.json - SPDX JSON format
sbom.cyclonedx.json - CycloneDX JSON format

Requirements:

Syft (automatically installed if not present)

Trivy Security Scans

`scan-trivy-fs.sh`

Runs Trivy filesystem security scan to detect vulnerabilities and misconfigurations in the codebase and Dockerfile.

Usage:

./scripts/scan-trivy-fs.sh
# or
npm run scan:trivy

What it scans:

Filesystem for vulnerabilities (HIGH and CRITICAL severity)
Dockerfile for misconfigurations
Reports findings but doesn't fail (exit code 0)

Requirements:

Trivy installed (brew install trivy or see Trivy installation guide)

`scan-trivy-image.sh`

Builds the Docker image and scans it for vulnerabilities using Trivy.

Usage:

./scripts/scan-trivy-image.sh [image-name]
# or
npm run scan:trivy:image

Default image name: hastebin:test

What it does:

Builds the Docker image
Scans the image for vulnerabilities (HIGH and CRITICAL severity)
Fails if unfixed vulnerabilities are found (exit code 1)

Requirements:

Docker
Trivy installed

Image SBOM Generation

`scan-sbom-image.sh`

Builds the Docker image and generates an SBOM for it.

Usage:

./scripts/scan-sbom-image.sh [image-name]
# or
npm run scan:sbom:image

Default image name: hastebin:test

Output files:

sbom-image.txt - Human-readable table format
sbom-image.spdx.json - SPDX JSON format
sbom-image.cyclonedx.json - CycloneDX JSON format

Requirements:

Docker
Syft (automatically installed if not present)

Running All Scans

To run both SBOM generation and Trivy filesystem scan:

npm run scan:all

This runs:

SBOM generation for source code
Trivy filesystem security scan