globocom / globocom/huskyCI

Run Yarn Audit on all Yarn.lock files

Open
#427 1 comment 0 reactions 0 assignees View on GitHub
feature-request
Dominant language
Go
Stars
595
Forks
135
PR merge metrics
No merged PRs in 30d

Description

It's possible for a project to have more than one `Yarn.lock` file, which is not contemplated by huskyCI nowadays, as only the `root` directory is being searched for the file.

It would be nice if huskyCI could verify the whole project for all the existing `Yarn.lock` files and analyze them all.

Contributor guide

Open the contributing guide

Research direction

Start by locating the code that searches only the root directory for Yarn.lock and invokes the Yarn audit. Check how the project represents audit results, then verify that every Yarn.lock in the project is analyzed and that the combined results are reported.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.