mirror of
https://github.com/unslothai/unsloth.git
synced 2026-07-09 15:58:41 +00:00
dd0b557794
* ci: add advisory lockfile supply-chain audit Adds a fast, focused workflow that scans every checked-in npm and cargo lockfile on PRs touching one. Default behaviour is advisory: only public indicator-of-compromise strings, versions on the public known-malicious list, and structurally broken lockfiles fail the build. Structural anomalies (missing integrity hashes, non-default registry, etc.) surface as :⚠️: annotations without gating merges, so reviewers see the audit result inline on every PR without changing the existing install behaviour. Also commits the two missing npm lockfiles the audit needs: studio/package-lock.json (Tauri CLI holder for desktop release) and studio/backend/core/data_recipe/oxc-validator/package-lock.json (oxc-parser runtime for the data-recipe validator). studio/setup.sh, studio/setup.ps1, build.sh, and pyproject.toml are intentionally left alone so the existing install path keeps working unchanged. Audit script behaviour: default mode -> exits 1 only on blocked-known-malicious, known-ioc-string, malformed-lockfile, missing-lockfile, unreadable-lockfile, or missing-toml-parser --strict -> promotes every finding to blocking (opt-in) Adds a try/except around lockfile reads so a permissions error prints a finding instead of crashing CI with a raw traceback. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * test(security): update cargo regression test for advisory mode `scripts/lockfile_supply_chain_audit.py` now classifies `non-registry-cargo-source` as an advisory finding by default (returns exit 0 with a `:⚠️:` annotation) rather than unconditionally blocking with exit 1. Update the existing `test_malicious_cargo_lockfile_refused` to pass --strict so it keeps verifying the "refuse to install" behavior it is named for, and add a second test that pins the default-mode behavior: advisory finding emitted, exit code 0. * audit: escape Finding for GH Actions annotations `:⚠️:` and `::error::` workflow commands truncate the annotation message at the first newline unless the message is %-encoded per the workflow-commands spec. Since `Finding.__str__` returns three lines (kind+path, package, detail), the package and detail fields were being dropped from the GitHub Actions UI. Add a `_gha_escape()` helper that applies the spec'd escapes (`%` -> `%25`, then `\r` -> `%0D`, then `\n` -> `%0A`; the `%` replacement must happen first so the subsequent escapes are not double-encoded), wrap every Finding rendered into a workflow command with it, and pin both the helper and the end-to-end single-line emission with two new regression tests. Caught by gemini-code-assist on PR #5604. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
233 lines
7.1 KiB
JSON
233 lines
7.1 KiB
JSON
{
|
|
"name": "unsloth-studio-tauri-cli",
|
|
"version": "0.0.0",
|
|
"lockfileVersion": 3,
|
|
"requires": true,
|
|
"packages": {
|
|
"": {
|
|
"name": "unsloth-studio-tauri-cli",
|
|
"version": "0.0.0",
|
|
"license": "AGPL-3.0-only",
|
|
"devDependencies": {
|
|
"@tauri-apps/cli": "2.10.1"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli/-/cli-2.10.1.tgz",
|
|
"integrity": "sha512-jQNGF/5quwORdZSSLtTluyKQ+o6SMa/AUICfhf4egCGFdMHqWssApVgYSbg+jmrZoc8e1DscNvjTnXtlHLS11g==",
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"bin": {
|
|
"tauri": "tauri.js"
|
|
},
|
|
"engines": {
|
|
"node": ">= 10"
|
|
},
|
|
"funding": {
|
|
"type": "opencollective",
|
|
"url": "https://opencollective.com/tauri"
|
|
},
|
|
"optionalDependencies": {
|
|
"@tauri-apps/cli-darwin-arm64": "2.10.1",
|
|
"@tauri-apps/cli-darwin-x64": "2.10.1",
|
|
"@tauri-apps/cli-linux-arm-gnueabihf": "2.10.1",
|
|
"@tauri-apps/cli-linux-arm64-gnu": "2.10.1",
|
|
"@tauri-apps/cli-linux-arm64-musl": "2.10.1",
|
|
"@tauri-apps/cli-linux-riscv64-gnu": "2.10.1",
|
|
"@tauri-apps/cli-linux-x64-gnu": "2.10.1",
|
|
"@tauri-apps/cli-linux-x64-musl": "2.10.1",
|
|
"@tauri-apps/cli-win32-arm64-msvc": "2.10.1",
|
|
"@tauri-apps/cli-win32-ia32-msvc": "2.10.1",
|
|
"@tauri-apps/cli-win32-x64-msvc": "2.10.1"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-darwin-arm64": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-arm64/-/cli-darwin-arm64-2.10.1.tgz",
|
|
"integrity": "sha512-Z2OjCXiZ+fbYZy7PmP3WRnOpM9+Fy+oonKDEmUE6MwN4IGaYqgceTjwHucc/kEEYZos5GICve35f7ZiizgqEnQ==",
|
|
"cpu": [
|
|
"arm64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"darwin"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-darwin-x64": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-x64/-/cli-darwin-x64-2.10.1.tgz",
|
|
"integrity": "sha512-V/irQVvjPMGOTQqNj55PnQPVuH4VJP8vZCN7ajnj+ZS8Kom1tEM2hR3qbbIRoS3dBKs5mbG8yg1WC+97dq17Pw==",
|
|
"cpu": [
|
|
"x64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"darwin"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-arm-gnueabihf": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm-gnueabihf/-/cli-linux-arm-gnueabihf-2.10.1.tgz",
|
|
"integrity": "sha512-Hyzwsb4VnCWKGfTw+wSt15Z2pLw2f0JdFBfq2vHBOBhvg7oi6uhKiF87hmbXOBXUZaGkyRDkCHsdzJcIfoJC2w==",
|
|
"cpu": [
|
|
"arm"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-arm64-gnu": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-gnu/-/cli-linux-arm64-gnu-2.10.1.tgz",
|
|
"integrity": "sha512-OyOYs2t5GkBIvyWjA1+h4CZxTcdz1OZPCWAPz5DYEfB0cnWHERTnQ/SLayQzncrT0kwRoSfSz9KxenkyJoTelA==",
|
|
"cpu": [
|
|
"arm64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-arm64-musl": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.10.1.tgz",
|
|
"integrity": "sha512-MIj78PDDGjkg3NqGptDOGgfXks7SYJwhiMh8SBoZS+vfdz7yP5jN18bNaLnDhsVIPARcAhE1TlsZe/8Yxo2zqg==",
|
|
"cpu": [
|
|
"arm64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-riscv64-gnu": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-riscv64-gnu/-/cli-linux-riscv64-gnu-2.10.1.tgz",
|
|
"integrity": "sha512-X0lvOVUg8PCVaoEtEAnpxmnkwlE1gcMDTqfhbefICKDnOTJ5Est3qL0SrWxizDackIOKBcvtpejrSiVpuJI1kw==",
|
|
"cpu": [
|
|
"riscv64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-x64-gnu": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-gnu/-/cli-linux-x64-gnu-2.10.1.tgz",
|
|
"integrity": "sha512-2/12bEzsJS9fAKybxgicCDFxYD1WEI9kO+tlDwX5znWG2GwMBaiWcmhGlZ8fi+DMe9CXlcVarMTYc0L3REIRxw==",
|
|
"cpu": [
|
|
"x64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-x64-musl": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-musl/-/cli-linux-x64-musl-2.10.1.tgz",
|
|
"integrity": "sha512-Y8J0ZzswPz50UcGOFuXGEMrxbjwKSPgXftx5qnkuMs2rmwQB5ssvLb6tn54wDSYxe7S6vlLob9vt0VKuNOaCIQ==",
|
|
"cpu": [
|
|
"x64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-win32-arm64-msvc": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-arm64-msvc/-/cli-win32-arm64-msvc-2.10.1.tgz",
|
|
"integrity": "sha512-iSt5B86jHYAPJa/IlYw++SXtFPGnWtFJriHn7X0NFBVunF6zu9+/zOn8OgqIWSl8RgzhLGXQEEtGBdR4wzpVgg==",
|
|
"cpu": [
|
|
"arm64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"win32"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-win32-ia32-msvc": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-ia32-msvc/-/cli-win32-ia32-msvc-2.10.1.tgz",
|
|
"integrity": "sha512-gXyxgEzsFegmnWywYU5pEBURkcFN/Oo45EAwvZrHMh+zUSEAvO5E8TXsgPADYm31d1u7OQU3O3HsYfVBf2moHw==",
|
|
"cpu": [
|
|
"ia32"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"win32"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-win32-x64-msvc": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-x64-msvc/-/cli-win32-x64-msvc-2.10.1.tgz",
|
|
"integrity": "sha512-6Cn7YpPFwzChy0ERz6djKEmUehWrYlM+xTaNzGPgZocw3BD7OfwfWHKVWxXzdjEW2KfKkHddfdxK1XXTYqBRLg==",
|
|
"cpu": [
|
|
"x64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"win32"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
}
|
|
}
|
|
}
|