product:frontend:audit

Table of contents

1. Introduction
2. Writing the SBOM
3. Running it in CI
4. How it decides
5. Reference
6. See also

---

Introduction

product:frontend:audit checks every npm package your features’ bundles ship, as one set, against npm’s advisory database. It names the features you need to release again. It needs a selected product (SPLENT_APP) and the network.

splent product:frontend:audit

  Auditing what the bundles of my_first_app ship...

     ⚠️  chart.js 2.9.3 (high): Prototype pollution in chart.js https://github.com/advisories/GHSA-h68q-55jf-x68w. Shipped by charts, to release again with a fixed version.

A feature with frontend/ audits its own lock when it is released, and its bundle never changes after that. An advisory published later reaches your product only through a new release of every feature that ships the package. This command finds them.

---

Writing the SBOM

splent product:frontend:audit --sbom frontend.sbom.cdx.json

--sbom also writes the CycloneDX 1.5 SBOM of your product’s bundles. It has one component for each feature with frontend/ (pkg:pypi/<distribution>@<version>, with the sha256 of its manifest), and one for each package a bundle ships (pkg:npm/<name>@<version>, with its licence). Each feature depends on what its bundle ships.

A file a feature vendors outside npm, declared in splent.vendored, comes from the SBOM of its release, when the snapshot is in the workspace. The document carries a timestamp and a serial number, so keep it with the run and do not version it.

---

Running it in CI

The validate job of your product’s CI runs it after product:build --no-image, which writes docker/frontend.lock.json from the pins.

- name: Audit what the features' bundles ship
  run: splent product:frontend:audit --sbom frontend.sbom.cdx.json

---

How it decides

It reads docker/frontend.lock.json, which product:build writes, and sends the names and versions to the registry’s bulk advisory endpoint, the one npm audit asks. Nothing is installed. The registry is NPM_CONFIG_REGISTRY when it is set, and https://registry.npmjs.org otherwise.

Finding	Result
A critical advisory	Error. The command exits 1, as a critical one stops a feature’s release
A high advisory	Warning
A moderate, low or informational one	Counted in one line
The registry cannot be asked	Error. An audit that did not run passes nothing

---

Reference

Option	Description
--sbom FILE	Also write the CycloneDX 1.5 SBOM of the product’s bundles to this file

Error	What to do
<product> has no docker/frontend.lock.json. Run splent product:build, which writes it.	Run splent product:build, or product:build --no-image

See also

• product:validate checks what the bundles need from the page, offline.
• feature:release audits one feature’s lock when it is released.