#!/bin/bash
# audit-deps.sh — multi-ecosystem dependency audit
set -euo pipefail

SLACK_HOOK="${SLACK_WEBHOOK_URL:-}"
CRITICAL_ONLY="${1:-false}"
REPORT=""
EXIT_CODE=0

# npm audit
if [[ -f package-lock.json ]]; then
  echo "Auditing npm..."
  NPM_RESULT=$(npm audit --json 2>/dev/null || true)
  CRITICAL_COUNT=$(echo "$NPM_RESULT" | jq '.metadata.vulnerabilities.critical // 0')
  HIGH_COUNT=$(echo "$NPM_RESULT" | jq '.metadata.vulnerabilities.high // 0')
  if [[ "$CRITICAL_COUNT" -gt 0 || "$HIGH_COUNT" -gt 0 ]]; then
    REPORT="${REPORT}\n:npm: npm: ${CRITICAL_COUNT} critical, ${HIGH_COUNT} high"
    EXIT_CODE=1
  fi
fi

# pip safety check
if [[ -f requirements.txt ]]; then
  echo "Auditing Python..."
  if command -v safety &>/dev/null; then
    PY_RESULT=$(safety check -r requirements.txt --json 2>/dev/null || true)
    VULN_COUNT=$(echo "$PY_RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('vulnerabilities',[])))" 2>/dev/null || echo 0)
    if [[ "$VULN_COUNT" -gt 0 ]]; then
      REPORT="${REPORT}\n:python: Python: ${VULN_COUNT} vulnerable packages"
      EXIT_CODE=1
    fi
  fi
fi

# Go vulnerability check
if [[ -f go.mod ]]; then
  echo "Auditing Go..."
  if command -v govulncheck &>/dev/null; then
    GO_RESULT=$(govulncheck -json ./... 2>/dev/null || echo '{"vulns":[]}')
    VULN_COUNT=$(echo "$GO_RESULT" | jq '[.vulns? // [] | .[]] | length')
    if [[ "$VULN_COUNT" -gt 0 ]]; then
      REPORT="${REPORT}\n:go: Go: ${VULN_COUNT} vulnerable modules"
      EXIT_CODE=1
    fi
  fi
fi

# Ruby bundler audit
if [[ -f Gemfile.lock ]]; then
  echo "Auditing Ruby..."
  if command -v bundle-audit &>/dev/null; then
    if ! bundle-audit check --update -q 2>/dev/null; then
      VULN_COUNT=$(bundle-audit check --update 2>/dev/null | grep -c "Name:" || echo 1)
      REPORT="${REPORT}\n:ruby: Ruby: ${VULN_COUNT} vulnerable gems"
      EXIT_CODE=1
    fi
  fi
fi

if [[ -n "$REPORT" ]]; then
  echo -e "VULNERABILITIES FOUND:$REPORT"
  if [[ -n "$SLACK_HOOK" ]]; then
    curl -s -X POST "$SLACK_HOOK" \
      -H "Content-Type: application/json" \
      -d "{\"text\": \":rotating_light: *Dependency Audit: vulnerabilities found*\n$(echo -e "$REPORT")\"}"
  fi
fi

exit $EXIT_CODE

#!/bin/bash
# hooks/pre-merge-audit.sh
# Run before merging a feature branch

set -e

echo "Running dependency audit..."

if [[ -f package-lock.json ]]; then
  AUDIT=$(npm audit --json 2>/dev/null)
  CRITICAL=$(echo "$AUDIT" | jq '.metadata.vulnerabilities.critical // 0')
  HIGH=$(echo "$AUDIT" | jq '.metadata.vulnerabilities.high // 0')

  if [[ "$CRITICAL" -gt 0 ]] || [[ "$HIGH" -gt 0 ]]; then
    echo "BLOCKED: $CRITICAL critical and $HIGH high vulnerabilities in npm dependencies"
    echo "Run 'npm audit fix' or update the affected packages before merging"
    exit 1
  fi
fi

if [[ -f go.sum ]]; then
  if command -v govulncheck &>/dev/null; then
    VULNS=$(govulncheck -json ./... 2>/dev/null | jq '[.vulns? // [] | .[]] | length')
    if [[ "$VULNS" -gt 0 ]]; then
      echo "BLOCKED: $VULNS vulnerable Go modules found"
      govulncheck ./...
      exit 1
    fi
  fi
fi

echo "Dependency audit passed"

#!/bin/bash
# outdated-report.sh — weekly summary of outdated packages

if [[ -f package.json ]]; then
  echo "=== npm outdated ==="
  npm outdated --json | jq -r 'to_entries[] | "\(.key): \(.value.current) → \(.value.latest) (\(.value.type))"' 2>/dev/null | head -20
fi

if [[ -f requirements.txt ]]; then
  echo "=== pip outdated ==="
  pip list --outdated --format=columns 2>/dev/null | head -20
fi

if [[ -f go.mod ]]; then
  echo "=== Go outdated ==="
  go list -u -m -json all 2>/dev/null | jq -r 'select(.Update) | "\(.Path): \(.Version) → \(.Update.Version)"' | head -20
fi