External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: advisory message appended to block output (#362)

Browse Source 
* docs(specs): add custom block messages and package blocklist spec

* docs(specs): add custom block messages and package blocklist implementation plan

* feat(config): add blocked_packages list and custom block messages

* feat(audit): add package_blocklist_blocked event and blocklist model

* feat(proxy): block blocklisted packages in the policy gate before analysis

* feat(guard): block blocklisted packages before trust skip and analysis

* feat(ui): render blocklist blocks and custom messages, fix silent-mode block output

* feat(proxy): append custom messages to malware and go-cooldown block bodies

* test(proxye2e): cover blocklist enforcement and custom block messages

* docs(specs): remove spec and plan documents

* refactor: drop guard-flow blocklist enforcement and trim docs

Guard mode is being deprecated; the blocklist is enforced in proxy mode
only. Remove the trusted_packages mirroring references outside the docs.

* refactor(config): consolidate blocklist and block message under top-level block section

Replace dependency_cooldown.message, malware.message and blocked_packages
with a single block section: block.message is appended to every block
output regardless of which control blocked, and block.packages is the
package blocklist.

* fix(ui): render block.message as info note with clean spacing

* fix(ui): indent wrapped continuation lines in block reasons and messages

* update config template

* refactor(config): replace block section with top-level advisory_message

Remove the package blocklist (will be implemented as part of policies in
the future) and replace block.message with an optional top-level
advisory_message appended to every block output.

* chore(config): move advisory_message near top-level scalar configs in template
This commit is contained in:
Sahil Bansal
2026-07-09 17:49:00 +05:30
committed by GitHub
parent c601e17cdc
commit 2d938ea381
17 changed files with 378 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/cooldown_skip_test.go
+4 -4
View File
@@ -19,7 +19,7 @@ func TestIsTrustedPackageRef(t *testing.T) {
{Purl: "pkg:npm/all-versions"},
{Purl: "pkg:npm/pinned@1.0.0"},
}}
_ = preprocessTrustedPackages(cfg)
_ = preprocessPackageRefs(cfg)
setGlobalForTest(t, cfg)
assert.True(t, IsTrustedPackageRef(packagev1.Ecosystem_ECOSYSTEM_NPM, "all-versions", "9.9.9"))
@@ -33,7 +33,7 @@ func TestIsTrustedPackageAllVersions(t *testing.T) {
{Purl: "pkg:npm/all-versions"},
{Purl: "pkg:npm/pinned@1.0.0"},
}}
_ = preprocessTrustedPackages(cfg)
_ = preprocessPackageRefs(cfg)
setGlobalForTest(t, cfg)
assert.True(t, IsTrustedPackageAllVersions(packagev1.Ecosystem_ECOSYSTEM_NPM, "all-versions"))
@@ -130,7 +130,7 @@ func TestCooldownSkip(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
cfg := &Config{DependencyCooldown: DependencyCooldownConfig{Skip: tt.skip}}
_ = preprocessTrustedPackages(cfg)
_ = preprocessPackageRefs(cfg)
got := cooldownSkip(cfg.DependencyCooldown.Skip, tt.ecosystem, tt.pkgName)
assert.Equal(t, tt.wantSkipAll, got.SkipAll)
@@ -156,7 +156,7 @@ func TestCooldownSkipIsSkipListOnly(t *testing.T) {
TrustedPackages: []TrustedPackage{{Purl: "pkg:npm/trusted-only"}},
DependencyCooldown: DependencyCooldownConfig{Skip: []TrustedPackage{{Purl: "pkg:npm/cooldown-only"}}},
}
_ = preprocessTrustedPackages(cfg)
_ = preprocessPackageRefs(cfg)
setGlobalForTest(t, cfg)
assert.False(t, CooldownSkip(packagev1.Ecosystem_ECOSYSTEM_NPM, "trusted-only").SkipAll, "trusted_packages must not leak into CooldownSkip")