package.json

{
  "name": "pipeline-check",
  "displayName": "Pipeline-Check",
  "description": "Lint CI/CD pipelines for 22 providers against OWASP Top 10 CI/CD Risks and 14 other compliance frameworks. 810+ rules, inline in your editor.",
  "version": "1.5.1",
  "publisher": "greylag-ci",
  "license": "MIT",
  "icon": "icon.png",
  "galleryBanner": {
    "color": "#04101a",
    "theme": "dark"
  },
  "engines": {
    "vscode": "^1.85.0"
  },
  "categories": [
    "Linters",
    "Other"
  ],
  "keywords": [
    "ci",
    "cd",
    "security",
    "pipeline",
    "github-actions",
    "gitlab-ci",
    "terraform",
    "cloudformation",
    "kubernetes",
    "helm",
    "dockerfile"
  ],
  "repository": {
    "type": "git",
    "url": "https://github.com/greylag-ci/pipeline-check-vscode.git"
  },
  "bugs": {
    "url": "https://github.com/greylag-ci/pipeline-check-vscode/issues"
  },
  "qna": "https://github.com/greylag-ci/pipeline-check-vscode/discussions",
  "homepage": "https://github.com/greylag-ci/pipeline-check-vscode#readme",
  "main": "./dist/extension.js",
  "activationEvents": [
    "workspaceContains:**/.github/workflows/*.yml",
    "workspaceContains:**/.github/workflows/*.yaml",
    "workspaceContains:**/.gitlab-ci.yml",
    "workspaceContains:**/azure-pipelines.yml",
    "workspaceContains:**/bitbucket-pipelines.yml",
    "workspaceContains:**/.circleci/config.yml",
    "workspaceContains:**/cloudbuild.yaml",
    "workspaceContains:**/.buildkite/pipeline.yml",
    "workspaceContains:**/.drone.yml",
    "workspaceContains:**/.drone.yaml",
    "workspaceContains:**/Jenkinsfile",
    "workspaceContains:**/Dockerfile",
    "workspaceContains:**/Containerfile"
  ],
  "capabilities": {
    "untrustedWorkspaces": {
      "supported": "limited",
      "description": "Pipeline-Check spawns the configured Python interpreter (defaults to `python -m pipeline_check.lsp`) to analyze workflow files. The `serverCommand` and `serverArgs` settings — the only inputs that influence what gets executed — are scoped `machine-overridable`, so a workspace cannot silently override them; VS Code surfaces an explicit prompt before any workspace-level value is applied. No other workspace-controlled input reaches a process-spawning code path."
    },
    "virtualWorkspaces": false
  },
  "contributes": {
    "viewsContainers": {
      "activitybar": [
        {
          "id": "pipelineCheck",
          "title": "Pipeline-Check",
          "icon": "media/pipeline-check.svg"
        }
      ]
    },
    "views": {
      "pipelineCheck": [
        {
          "id": "pipelineCheck.findings",
          "name": "Findings",
          "contextualTitle": "Pipeline-Check"
        }
      ]
    },
    "viewsWelcome": [
      {
        "view": "pipelineCheck.findings",
        "when": "pipelineCheck.lspReady",
        "contents": "Pipeline-Check lints CI/CD configs against OWASP Top 10 CI/CD risks and 14 compliance frameworks. 810+ rules.\n\n[Scan workspace](command:pipelineCheck.scanWorkspace)\n\nFindings also appear automatically as you open `.github/workflows/*.yml`, `.gitlab-ci.yml`, `Dockerfile`, and other supported configs.\n\nNavigate findings with `Alt+F8` / `Shift+Alt+F8`."
      },
      {
        "view": "pipelineCheck.findings",
        "when": "!pipelineCheck.lspReady && !pipelineCheck.engineOutOfDate",
        "contents": "Pipeline-Check lints CI/CD configs against OWASP Top 10 CI/CD risks and 14 compliance frameworks. 810+ rules.\n\nIt needs a Python helper — `pipeline-check[lsp]` from PyPI — running locally.\n\n[Install in terminal](command:pipelineCheck.installInTerminal)\n[Retry connection](command:pipelineCheck.restart)\n\nAlready installed but still seeing this? [Open server log](command:pipelineCheck.showLog)."
      },
      {
        "view": "pipelineCheck.findings",
        "when": "pipelineCheck.engineOutOfDate",
        "contents": "The installed `pipeline-check` engine is older than this extension requires.\n\nUpgrade it from PyPI:\n\n[Upgrade in terminal](command:pipelineCheck.upgradeInTerminal)\n[Retry connection](command:pipelineCheck.restart)\n\n[Open server log](command:pipelineCheck.showLog) for the version probe's output."
      }
    ],
    "commands": [
      {
        "command": "pipelineCheck.restart",
        "title": "Restart Language Server",
        "category": "Pipeline-Check"
      },
      {
        "command": "pipelineCheck.showLog",
        "title": "Show Language Server Output",
        "category": "Pipeline-Check"
      },
      {
        "command": "pipelineCheck.copyInstallCommand",
        "title": "Copy LSP Install Command",
        "category": "Pipeline-Check"
      },
      {
        "command": "pipelineCheck.installInTerminal",
        "title": "Install LSP Server in Terminal",
        "category": "Pipeline-Check"
      },
      {
        "command": "pipelineCheck.upgradeInTerminal",
        "title": "Upgrade LSP Server in Terminal",
        "category": "Pipeline-Check"
      },
      {
        "command": "pipelineCheck.scanWorkspace",
        "title": "Scan Workspace",
        "category": "Pipeline-Check",
        "icon": "$(play)"
      },
      {
        "command": "pipelineCheck.findings.refresh",
        "title": "Refresh Findings",
        "category": "Pipeline-Check",
        "icon": "$(refresh)"
      },
      {
        "command": "pipelineCheck.findings.changeGrouping",
        "title": "Change Grouping",
        "category": "Pipeline-Check",
        "icon": "$(list-tree)"
      },
      {
        "command": "pipelineCheck.findings.copyRuleId",
        "title": "Copy Rule ID",
        "category": "Pipeline-Check"
      },
      {
        "command": "pipelineCheck.findings.openRuleDocs",
        "title": "Open Rule Documentation",
        "category": "Pipeline-Check"
      },
      {
        "command": "pipelineCheck.findings.openNonPreview",
        "title": "Open Finding",
        "category": "Pipeline-Check"
      },
      {
        "command": "pipelineCheck.findings.filter",
        "title": "Filter Findings",
        "category": "Pipeline-Check",
        "icon": "$(filter)"
      },
      {
        "command": "pipelineCheck.findings.toggleSeverity",
        "title": "Show / Hide Severities",
        "category": "Pipeline-Check",
        "icon": "$(eye)"
      },
      {
        "command": "pipelineCheck.goToNextFinding",
        "title": "Go to Next Finding",
        "category": "Pipeline-Check"
      },
      {
        "command": "pipelineCheck.goToPreviousFinding",
        "title": "Go to Previous Finding",
        "category": "Pipeline-Check"
      }
    ],
    "keybindings": [
      {
        "command": "pipelineCheck.goToNextFinding",
        "key": "alt+f8",
        "when": "editorTextFocus"
      },
      {
        "command": "pipelineCheck.goToPreviousFinding",
        "key": "shift+alt+f8",
        "when": "editorTextFocus"
      }
    ],
    "menus": {
      "view/title": [
        {
          "command": "pipelineCheck.scanWorkspace",
          "when": "view == pipelineCheck.findings",
          "group": "navigation@0"
        },
        {
          "command": "pipelineCheck.findings.filter",
          "when": "view == pipelineCheck.findings",
          "group": "navigation@1"
        },
        {
          "command": "pipelineCheck.findings.toggleSeverity",
          "when": "view == pipelineCheck.findings",
          "group": "navigation@2"
        },
        {
          "command": "pipelineCheck.findings.changeGrouping",
          "when": "view == pipelineCheck.findings",
          "group": "navigation@3"
        },
        {
          "command": "pipelineCheck.findings.refresh",
          "when": "view == pipelineCheck.findings",
          "group": "navigation@9"
        }
      ],
      "view/item/context": [
        {
          "command": "pipelineCheck.findings.openNonPreview",
          "when": "view == pipelineCheck.findings && viewItem == pipelineCheck.finding",
          "group": "navigation@0"
        },
        {
          "command": "pipelineCheck.findings.openRuleDocs",
          "when": "view == pipelineCheck.findings && viewItem == pipelineCheck.finding",
          "group": "navigation@1"
        },
        {
          "command": "pipelineCheck.findings.copyRuleId",
          "when": "view == pipelineCheck.findings && viewItem == pipelineCheck.finding",
          "group": "1_copy@1"
        }
      ],
      "commandPalette": [
        {
          "command": "pipelineCheck.findings.refresh",
          "when": "view == pipelineCheck.findings"
        },
        {
          "command": "pipelineCheck.findings.changeGrouping",
          "when": "view == pipelineCheck.findings"
        },
        {
          "command": "pipelineCheck.findings.copyRuleId",
          "when": "false"
        },
        {
          "command": "pipelineCheck.findings.openRuleDocs",
          "when": "false"
        },
        {
          "command": "pipelineCheck.findings.openNonPreview",
          "when": "false"
        }
      ]
    },
    "configuration": {
      "type": "object",
      "title": "Pipeline-Check",
      "properties": {
        "pipelineCheck.serverCommand": {
          "type": "string",
          "default": "python",
          "scope": "machine-overridable",
          "markdownDescription": "Command used to launch the language server. Defaults to `python`; override if `pipeline_check` is installed under a different interpreter (e.g. `python3`, or an absolute path to a virtualenv interpreter). An absolute path is recommended — a bare name resolves through `PATH`, which a workspace can manipulate. Scope is `machine-overridable`: workspace overrides require an explicit prompt."
        },
        "pipelineCheck.serverArgs": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "default": [
            "-m",
            "pipeline_check.lsp"
          ],
          "scope": "machine-overridable",
          "markdownDescription": "Arguments passed to the server command. Default invokes the module via `python -m pipeline_check.lsp`. Scope is `machine-overridable`: workspace overrides require an explicit prompt, since arbitrary args can execute arbitrary code (e.g. `-c \"...\"`)."
        },
        "pipelineCheck.disabledProviders": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "github-actions",
              "gitlab",
              "azure",
              "bitbucket",
              "circleci",
              "cloud-build",
              "buildkite",
              "drone",
              "jenkins",
              "dockerfile"
            ]
          },
          "uniqueItems": true,
          "default": [],
          "markdownDescription": "Providers to silence. Diagnostics for files matching a disabled provider's path glob are dropped before they reach the editor — useful in a monorepo where Pipeline-Check would otherwise lint a Dockerfile from a sub-project that has its own lint pipeline. Empty by default; everything scans. `dockerfile` covers both `Dockerfile` and `Containerfile`."
        },
        "pipelineCheck.codeLens.enabled": {
          "type": "boolean",
          "default": true,
          "markdownDescription": "Show the `Pipeline-Check: N critical · M high` summary CodeLens at the top of each scanned file. Turn off if you find the line-1 lens intrusive — the editor gutter, the Findings panel, and the status bar still surface the same counts."
        },
        "pipelineCheck.scanOnSave": {
          "type": "boolean",
          "default": false,
          "markdownDescription": "Re-scan the whole workspace whenever you save a CI/CD config file. Useful when one file references another (a Jenkinsfile sharing a library, GHA workflows that reuse a composite action) and a fix in one file should re-evaluate findings in the others. Renders as a status-bar spinner — no toast. Off by default; the LSP already re-scans the saved file itself on `didSave`, so this is purely about catching cross-file effects in files that aren't currently open."
        },
        "pipelineCheck.severityThreshold": {
          "type": "string",
          "enum": [
            "low",
            "medium",
            "high",
            "critical"
          ],
          "default": "low",
          "markdownDescription": "Lowest severity that produces a diagnostic. Findings below this level are dropped on the client side so the gutter / Problems panel only carries the cuts you care about. Mirrors the CLI's `--severity-threshold`. Default `low` matches CLI behavior; set to `high` or `critical` for a quieter editor."
        },
        "pipelineCheck.trace.server": {
          "type": "string",
          "enum": [
            "off",
            "messages",
            "verbose"
          ],
          "default": "off",
          "markdownDescription": "Traces LSP traffic between the editor and the `pipeline_check.lsp` server. Set to `verbose` when debugging."
        },
        "pipelineCheck.engineUpdates.checkEnabled": {
          "type": "boolean",
          "default": true,
          "markdownDescription": "Check PyPI once per day for a newer `pipeline-check` engine and surface a non-blocking notification when one is available. The notification's **Upgrade in terminal** action opens a terminal with `python -m pip install --upgrade \"pipeline-check[lsp]\"` typed (but not auto-run, same pattern as the install CTA). **Skip this version** silences the prompt for the offered version only — a later release re-prompts. Set to `false` to disable the check entirely; this is independent of the hard `MIN_ENGINE_VERSION` floor that still drives the **Upgrade in terminal** welcome panel when the installed engine is too old to support the extension."
        }
      }
    }
  },
  "scripts": {
    "vscode:prepublish": "npm run typecheck && npm run bundle:prod",
    "compile": "npm run typecheck && npm run bundle:dev",
    "typecheck": "tsc -p ./ --noEmit",
    "bundle:dev": "esbuild ./src/extension.ts --bundle --outfile=dist/extension.js --external:vscode --format=cjs --platform=node --sourcemap",
    "bundle:prod": "esbuild ./src/extension.ts --bundle --outfile=dist/extension.js --external:vscode --format=cjs --platform=node --minify",
    "watch": "esbuild ./src/extension.ts --bundle --outfile=dist/extension.js --external:vscode --format=cjs --platform=node --sourcemap --watch",
    "lint": "eslint src",
    "test": "vitest run",
    "test:watch": "vitest",
    "test:integration:compile": "tsc -p tsconfig.integration.json",
    "test:integration": "npm run bundle:dev && npm run test:integration:compile && vscode-test",
    "smoke": "node scripts/smoke.js",
    "package": "vsce package",
    "publish:vsce": "vsce publish --packagePath",
    "publish:ovsx": "ovsx publish"
  },
  "dependencies": {
    "vscode-languageclient": "^9.0.1"
  },
  "overrides": {
    "serialize-javascript": "^7.0.5"
  },
  "devDependencies": {
    "@types/mocha": "^10.0.10",
    "@types/node": "^25.9.1",
    "@types/vscode": "^1.85.0",
    "@eslint/js": "^9.0.0",
    "@vscode/test-cli": "^0.0.12",
    "@vscode/test-electron": "^2.5.2",
    "@vscode/vsce": "^3.9.1",
    "esbuild": "^0.28.0",
    "eslint": "^9.0.0",
    "typescript-eslint": "^8.60.0",
    "mocha": "^11.7.6",
    "ovsx": "^0.10.12",
    "typescript": "^6.0.3",
    "vitest": "^4.1.7"
  }
}