@flakiness/sdk - npm Package Compare versions

Comparing version 1.0.2 to 1.1.0-alpha.0

types/src/_githubOIDC.d.ts

+export declare class GithubOIDC {
+    private _requestUrl;
+    private _requestToken;
+    static initializeFromEnv(): GithubOIDC | undefined;
+    constructor(_requestUrl: string, _requestToken: string);
+    fetchToken(audience: string): Promise<string>;
+}
+//# sourceMappingURL=_githubOIDC.d.ts.map

types/src/_githubOIDC.d.ts.map

+{"version":3,"file":"_githubOIDC.d.ts","sourceRoot":"","sources":["../../src/_githubOIDC.ts"],"names":[],"mappings":"AAAA,qBAAa,UAAU;IAQnB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,aAAa;IARvB,MAAM,CAAC,iBAAiB,IAAI,UAAU,GAAC,SAAS;gBAOtC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM;IAKzB,UAAU,CAAC,QAAQ,EAAE,MAAM;CAsBlC"}

lib/browser.js

@@ -174,3 +174,3 @@ var __defProp = Object.defineProperty;
 
-// node_modules/.pnpm/@flakiness+flakiness-report@0.22.0/node_modules/@flakiness/flakiness-report/lib/flakinessReport.js
+// node_modules/.pnpm/@flakiness+flakiness-report@0.25.0_zod@4.3.5/node_modules/@flakiness/flakiness-report/lib/flakinessReport.js
 var FlakinessReport;
@@ -183,3 +183,3 @@ ((FlakinessReport22) => {
 
-// node_modules/.pnpm/@flakiness+flakiness-report@0.22.0/node_modules/@flakiness/flakiness-report/lib/schema.js
+// node_modules/.pnpm/@flakiness+flakiness-report@0.25.0_zod@4.3.5/node_modules/@flakiness/flakiness-report/lib/schema.js
 import z from "zod/v4";
@@ -289,3 +289,5 @@ var Schema;
   Schema2.UtilizationTelemetry = z.tuple([Schema2.DurationMS, z.number().min(0).max(100)]);
+  Schema2.FlakinessProject = z.string();
   Schema2.Report = z.object({
+    flakinessProject: Schema2.FlakinessProject.optional(),
     category: z.string().min(1).max(100),
@@ -292,0 +294,0 @@ commitId: Schema2.CommitId,

lib/index.js

@@ -778,3 +778,3 @@ var __defProp = Object.defineProperty;
 
-// node_modules/.pnpm/@flakiness+flakiness-report@0.22.0/node_modules/@flakiness/flakiness-report/lib/flakinessReport.js
+// node_modules/.pnpm/@flakiness+flakiness-report@0.25.0_zod@4.3.5/node_modules/@flakiness/flakiness-report/lib/flakinessReport.js
 var FlakinessReport;
@@ -787,3 +787,3 @@ ((FlakinessReport22) => {
 
-// node_modules/.pnpm/@flakiness+flakiness-report@0.22.0/node_modules/@flakiness/flakiness-report/lib/schema.js
+// node_modules/.pnpm/@flakiness+flakiness-report@0.25.0_zod@4.3.5/node_modules/@flakiness/flakiness-report/lib/schema.js
 import z from "zod/v4";
@@ -893,3 +893,5 @@ var Schema;
   Schema2.UtilizationTelemetry = z.tuple([Schema2.DurationMS, z.number().min(0).max(100)]);
+  Schema2.FlakinessProject = z.string();
   Schema2.Report = z.object({
+    flakinessProject: Schema2.FlakinessProject.optional(),
     category: z.string().min(1).max(100),
@@ -942,2 +944,35 @@ commitId: Schema2.CommitId,
 import { URL as URL2 } from "url";
+
+// src/_githubOIDC.ts
+var GithubOIDC = class _GithubOIDC {
+  constructor(_requestUrl, _requestToken) {
+    this._requestUrl = _requestUrl;
+    this._requestToken = _requestToken;
+  }
+  static initializeFromEnv() {
+    const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    return requestUrl && requestToken ? new _GithubOIDC(requestUrl, requestToken) : void 0;
+  }
+  async fetchToken(audience) {
+    const url = new URL(this._requestUrl);
+    url.searchParams.set("audience", audience);
+    const response = await fetch(url, {
+      headers: {
+        "Authorization": `bearer ${this._requestToken}`,
+        "Accept": "application/json; api-version=2.0"
+      }
+    });
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      throw new Error(`Failed to request GitHub OIDC token: ${response.status} ${body}`);
+    }
+    const json = await response.json();
+    if (!json.value)
+      throw new Error("GitHub OIDC token response did not contain a token value.");
+    return json.value;
+  }
+};
+
+// src/uploadReport.ts
 async function createFileAttachment(contentType, filePath) {
@@ -960,5 +995,24 @@ return {
 async function uploadReport(report, attachments, options) {
-  const flakinessAccessToken = options?.flakinessAccessToken ?? process.env["FLAKINESS_ACCESS_TOKEN"];
-  const flakinessEndpoint = options?.flakinessEndpoint ?? process.env["FLAKINESS_ENDPOINT"] ?? "https://flakiness.io";
+  let flakinessAccessToken = options?.flakinessAccessToken ?? process.env["FLAKINESS_ACCESS_TOKEN"];
   const logger = options?.logger ?? console;
+  const githubOIDC = GithubOIDC.initializeFromEnv();
+  if (!flakinessAccessToken && githubOIDC) {
+    if (!report.flakinessProject) {
+      const reason = "`flakinessProject` is not configured to upload using Github OIDC.";
+      if (process.env.CI)
+        logger.warn(`[flakiness.io] \u26A0 Skipping upload: ${reason}`);
+      return { status: "skipped", reason };
+    }
+    try {
+      flakinessAccessToken = await githubOIDC.fetchToken(report.flakinessProject);
+      if (!flakinessAccessToken)
+        throw new Error("token is empty");
+    } catch (e) {
+      const errorMessage = e.message || String(e);
+      logger.error(`[flakiness.io] \u2715 Unexpected error while fetching Github OIDC token: ${errorMessage}`);
+      if (options?.throwOnFailure)
+        throw e;
+      return { status: "failed", error: errorMessage };
+    }
+  }
   if (!flakinessAccessToken) {
@@ -971,2 +1025,3 @@ const reason = "No FLAKINESS_ACCESS_TOKEN found";
   try {
+    const flakinessEndpoint = options?.flakinessEndpoint ?? process.env["FLAKINESS_ENDPOINT"] ?? "https://flakiness.io";
     const upload = new ReportUpload(report, attachments, { flakinessAccessToken, flakinessEndpoint });
@@ -973,0 +1028,0 @@ const uploadResult = await upload.upload();

package.json

 {
   "name": "@flakiness/sdk",
-  "version": "1.0.2",
+  "version": "1.1.0-alpha.0",
   "private": false,
@@ -28,3 +28,3 @@ "repository": {
   "devDependencies": {
-    "@flakiness/flakiness-report": "^0.22.0",
+    "@flakiness/flakiness-report": "^0.25.0",
     "@types/debug": "^4.1.12",
@@ -38,3 +38,3 @@ "@types/node": "^25.0.3",
   "peerDependencies": {
-    "@flakiness/flakiness-report": "^0.22.0"
+    "@flakiness/flakiness-report": "^0.25.0"
   },
@@ -41,0 +41,0 @@ "dependencies": {

types/src/uploadReport.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"uploadReport.d.ts","sourceRoot":"","sources":["../../src/uploadReport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAW9D;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,iEAAiE;IACjE,IAAI,EAAE,QAAQ,CAAC;IACf,4EAA4E;IAC5E,EAAE,EAAE,eAAe,CAAC,YAAY,CAAC;IACjC,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;CACd,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,EAAE,EAAE,eAAe,CAAC,YAAY,CAAC;IACjC,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;CACd,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,cAAc,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAOzG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAOrG;AAED,KAAK,YAAY,GACb;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,UAAU,MAAM;IACd,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,eAAe,CAAC,MAAM,EAC9B,WAAW,EAAE,UAAU,EAAE,EACzB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAiCvB"}
+{"version":3,"file":"uploadReport.d.ts","sourceRoot":"","sources":["../../src/uploadReport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAY9D;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,iEAAiE;IACjE,IAAI,EAAE,QAAQ,CAAC;IACf,4EAA4E;IAC5E,EAAE,EAAE,eAAe,CAAC,YAAY,CAAC;IACjC,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;CACd,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,EAAE,EAAE,eAAe,CAAC,YAAY,CAAC;IACjC,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;CACd,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,cAAc,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAOzG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAOrG;AAED,KAAK,YAAY,GACb;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,UAAU,MAAM;IACd,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,eAAe,CAAC,MAAM,EAC9B,WAAW,EAAE,UAAU,EAAE,EACzB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAqDvB"}

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 2 instances in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 16 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 2 instances in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 14 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

119042

2.42%

Number of package files

51

4.08%

Lines of code

2725

2.33%

Worsened metrics

Number of low quality alerts

2

100%

Number of low supply chain risk alerts

30

11.11%

Number of medium supply chain risk alerts

10

11.11%

No dependency changes