ClaudeandClaude Haiku 4.5
f8adf0669c
This commit establishes the foundation for a comprehensive security audit tool for macOS developer machines. It audits all installed software, detects vulnerabilities via OSV.dev, and provides Claude-powered mitigation recommendations. ## Architecture - System inventory collection (Homebrew, pip, npm, Go, Rust, apps) - CVE scanning via OSV.dev API (no auth, unlimited rate limits) - Claude integration (CLI or SDK) for mitigation analysis - JSON + HTML report generation - Full test suite (34+ tests, 7 benchmarks) - Production-grade linting (11 linters via golangci-lint) - Vulnerability scanning (govulncheck) - GitHub Actions CI/CD pipeline ## Key Components - cmd/audit/: CLI entry point - internal/inventory/: System inventory parsing - internal/security/: OSV.dev querying, Claude integration, audit logic - internal/report/: JSON and HTML report generation - scripts/collect-inventory.sh: Bash script for system enumeration ## MVP Features - Homebrew package scanning - Python/Node/Go/Rust ecosystem scanning - CVSS-based severity filtering - Claude-powered recommendations (update/replace/protect/monitor) - Makefile automation (test, lint, vulnerability checks) - Pre-commit hooks configuration ## Testing & Quality - 34+ unit tests with table-driven patterns - 7 benchmark tests for performance - 11 configured linters (staticcheck, gosec, revive, etc.) - Code coverage reporting - GitHub Actions CI (tests on Go 1.22 & 1.23) - Pre-commit hook framework ## Documentation - README.md: Full feature and usage documentation - QUICKSTART.md: 3-minute setup guide - TESTING.md: Testing and code quality guide - QA_SETUP.md: Analysis tooling reference - DATA_SOURCES_SPEC.md: Vulnerability data source documentation ## Data Sources - OSV.dev: Primary CVE database (1.8 day latency, no auth needed) - GitHub Advisories: Supplement for maintainer-created advisories - OpenSSF Scorecard: Trust signals (repo health/practices) - Homebrew Formulae API: Package metadata - CISA KEV: Active exploitation tracking ## Next Steps Phase 1 (MVP): Complete and tested ✓ Phase 2 (planned): Third-party app scanning, VirusTotal integration Phase 3 (planned): Historical monitoring, scheduled audits, webhooks Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
92 lines
2.2 KiB
YAML
92 lines
2.2 KiB
YAML
run:
|
|
timeout: 5m
|
|
tests: true
|
|
skip-dirs-use-default: true
|
|
|
|
linters:
|
|
enable:
|
|
# Core linters
|
|
- staticcheck # Go vet on steroids
|
|
- gosec # Security analyzer
|
|
- revive # Linter alternative to golint
|
|
- errcheck # Unchecked error returns
|
|
- ineffassign # Ineffectual assignments
|
|
- unused # Unused variables/constants/functions
|
|
- misspell # Common misspellings
|
|
- gofmt # Code formatting
|
|
- goimports # Import organization
|
|
- typecheck # Type checking (catches bugs)
|
|
|
|
# Code quality
|
|
- goprintffunc # Printf-style functions
|
|
- godox # TODO/FIXME comments
|
|
- testableexample # Testable examples
|
|
- gocritic # Advanced linter
|
|
- cyclop # Cyclomatic complexity
|
|
- dupl # Code duplication
|
|
- stylecheck # Style consistency
|
|
|
|
# Performance
|
|
- prealloc # Slice pre-allocation hints
|
|
- unconvert # Unnecessary type conversions
|
|
|
|
# Best practices
|
|
- exportloopref # Loop variable capture
|
|
- nolintlint # Invalid nolint directives
|
|
|
|
# Disable problematic linters for MVP
|
|
disable:
|
|
- exhaustruct # Too strict for initial development
|
|
- wsl # Whitespace linting (style preference)
|
|
- gocyclo # Using cyclop instead
|
|
|
|
linters-settings:
|
|
staticcheck:
|
|
checks:
|
|
- all
|
|
- -SA5008 # Wrong number of type parameters
|
|
- -SA1019 # Using deprecated function
|
|
|
|
gosec:
|
|
severity: high
|
|
confidence: high
|
|
|
|
revive:
|
|
rules:
|
|
- name: unused-parameter
|
|
disabled: true # Allow unused params in interfaces
|
|
- name: receiver-naming
|
|
arguments: ["skipInterface"]
|
|
|
|
cyclop:
|
|
max-complexity: 10
|
|
package-average: 5
|
|
|
|
gocritic:
|
|
enabled-checks:
|
|
- rangeValCopy
|
|
- appendAssign
|
|
- captLocal
|
|
- caseOrder
|
|
- deferInLoop
|
|
- duplicateImport
|
|
- evalOrder
|
|
- ifElseChain
|
|
- regexpMust
|
|
- uncheckedInlineErr
|
|
- unnamedResult
|
|
- unnecessaryBlock
|
|
- weakCond
|
|
|
|
issues:
|
|
exclude-rules:
|
|
# Test files are allowed more lenient rules
|
|
- path: _test\.go
|
|
linters:
|
|
- gosec
|
|
- gocritic
|
|
- errcheck
|
|
|
|
max-issues-per-linter: 50
|
|
max-same-issues: 5
|