implement NPM

Signed-off-by: Jefferson <jefferson.rios.caro@gmail.com>

Author: riosje

.github/workflows/check-vulns.yml

@@ -87,11 +87,36 @@ jobs:
       max-parallel: 1
     steps:
       - uses: actions/checkout@v4
+      - name: Build labels for issue
+        id: build_labels
+        run: |
+          # Start with base labels
+          LABELS="${{ inputs.nsolidStream }}"
+          
+          # Add NPM label if it's an npm vulnerability
+          if [ "${{ matrix.vulnerabilities.source }}" = "npm" ]; then
+            LABELS="${LABELS}, NPM"
+          fi
+          
+          # Add severity label if available
+          if [ -n "${{ matrix.vulnerabilities.severity }}" ] && [ "${{ matrix.vulnerabilities.severity }}" != "null" ]; then
+            SEVERITY=$(echo "${{ matrix.vulnerabilities.severity }}" | tr '[:lower:]' '[:upper:]')
+            LABELS="${LABELS}, ${SEVERITY}"
+          fi
+          
+          # Extract runtime version from stream (e.g., node-v20.x-nsolid-v5.x -> v20.x)
+          RUNTIME_VERSION=$(echo "${{ inputs.nsolidStream }}" | sed -n 's/.*node-\(v[0-9]*\.x\).*/\1/p')
+          if [ -n "$RUNTIME_VERSION" ]; then
+            LABELS="${LABELS}, ${RUNTIME_VERSION}"
+          fi
+          
+          echo "ISSUE_LABELS=${LABELS}" >> $GITHUB_ENV
+          echo "Generated labels: ${LABELS}"
       - uses: dblock/create-a-github-issue@v3
         with:
           update_existing: false
           search_existing: open
-          labels: ${{ matrix.vulnerabilities.source == 'npm' && format('{0}, NPM', inputs.nsolidStream) || inputs.nsolidStream }}
+          labels: ${{ env.ISSUE_LABELS }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VULN_ID: ${{ matrix.vulnerabilities.id }}

dep_checker/main.py

@@ -22,7 +22,7 @@
 from gql.transport.aiohttp import AIOHTTPTransport
 from nvdlib import searchCVE  # type: ignore
 from packaging.specifiers import SpecifierSet
-from typing import Optional
+from typing import Optional, List
 from pathlib import Path
 
 import json

dep_checker/npm_audit.py

@@ -15,17 +15,42 @@
 
 logger = logging.getLogger(__name__)
 
+# Folder paths to exclude from npm package scanning
+# Add folder paths here that should be skipped during package.json discovery
+# Paths should be relative to the repository root (e.g., "deps/v8/tools/turbolizer")
+# You can also use folder names for broader exclusions (e.g., "test" excludes all test folders)
+EXCLUDE_PATHS = [
+    # Specific path exclusions
+    "deps/v8/tools/turbolizer",
+
+    # General folder name exclusions (will match any folder with this name)
+    "test",
+    "tests", 
+    "examples",
+    "example",
+    "docs",
+    "documentation",
+    "demo",
+    "demos",
+    "coverage",
+    ".git",
+    ".github"
+]
+
 
 class NPMAuditChecker:
     """Handles npm audit vulnerability checking for package.json files"""
 
     def __init__(self, repo_path: Path, timeout: int = 300):
         self.repo_path = repo_path
         self.timeout = timeout
+        self.exclude_paths = EXCLUDE_PATHS  # Use the static exclusion list
 
     def find_package_json_files(self) -> List[Path]:
-        """Find all package.json files in the deps/ folder only"""
+        """Find all package.json files in the deps/ folder only, excluding specified folders"""
         package_json_files = []
+        excluded_count = 0
+        
         try:
             # Only search within the deps/ folder
             deps_path = self.repo_path / "deps"
@@ -36,9 +61,30 @@ def find_package_json_files(self) -> List[Path]:
             # Use pathlib to recursively find package.json files in deps/ folder
             for package_json in deps_path.rglob("package.json"):
                 # Skip node_modules directories
-                if "node_modules" not in str(package_json):
+                if "node_modules" in str(package_json):
+                    continue
+                
+                # Check if the package.json is in an excluded path
+                is_excluded = False
+                package_relative_path = str(package_json.relative_to(self.repo_path))
+                
+                for exclude_path in self.exclude_paths:
+                    # Check for exact path match or if path starts with the exclusion
+                    if (package_relative_path.startswith(exclude_path + "/") or 
+                        package_relative_path == exclude_path or
+                        exclude_path in package_json.parts):  # Also support folder name matching
+                        is_excluded = True
+                        excluded_count += 1
+                        logger.debug(f"Excluding {package_json} (matches exclusion: {exclude_path})")
+                        break
+                
+                if not is_excluded:
                     package_json_files.append(package_json)
+            
             logger.info(f"Found {len(package_json_files)} package.json files in deps/ folder")
+            if excluded_count > 0:
+                logger.info(f"Excluded {excluded_count} package.json files based on exclusion list: {self.exclude_paths}")
+            
             return package_json_files
         except Exception as e:
             logger.error(f"Error finding package.json files in deps/ folder: {e}")