From 8704bbcd32abfa71f6ac85d70ff12513e4e61644 Mon Sep 17 00:00:00 2001
From: Susmitha Girumala <susmitha@hashicorp.com>
Date: Mon, 6 Jul 2020 21:05:31 -0400
Subject: [PATCH] =?UTF-8?q?chore:=20=F0=9F=A4=96=20Allow=20known=20audit?=
 =?UTF-8?q?=20vulnerability=20to=20be=20ignored?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/monorepo-validate.yaml |  2 +-
 package.json                             |  3 +-
 scripts/yarn-audit.sh                    | 38 ++++++++++++++++++++++++
 yarn-audit-known-issues                  |  0
 4 files changed, 41 insertions(+), 2 deletions(-)
 create mode 100644 scripts/yarn-audit.sh
 create mode 100644 yarn-audit-known-issues

diff --git a/.github/workflows/monorepo-validate.yaml b/.github/workflows/monorepo-validate.yaml
index 73e179053..f6e52ae2d 100644
--- a/.github/workflows/monorepo-validate.yaml
+++ b/.github/workflows/monorepo-validate.yaml
@@ -22,7 +22,7 @@ jobs:
         with:
           node-version: '12.x'
       - run: yarn install
-      - run: yarn audit
+      - run: yarn run compliance:audit
 
   lint:
     name: Lint
diff --git a/package.json b/package.json
index 3b26ed612..a1052b6be 100644
--- a/package.json
+++ b/package.json
@@ -19,7 +19,8 @@
     "test:addons:auth": "echo \"\n\ntest: addons/auth\n\" && cd addons/auth && yarn test",
     "test:addons:rose": "echo \"\n\ntest: addons/rose\n\" && cd addons/rose && yarn test",
     "test:ui:core": "echo \"\n\ntest: ui/core\n\" && cd ui/core && yarn test",
-    "precommit": "yarn compliance:licenses && yarn audit && yarn lint && yarn test",
+    "compliance:audit": "bash ./scripts/yarn-audit.sh",
+    "precommit": "yarn compliance:licenses && yarn compliance:audit && yarn lint && yarn test",
     "commit": "git-cz",
     "compliance:licenses": "license-checker --onlyAllow 'Apache*;Apache License, Version 2.0;Apache-2.0;BSD;BSD-3-Clause;CC-BY-3.0;CC-BY-4.0;CC0-1.0;ISC;MIT;MPL-2.0;Public Domain;Unicode-TOU;Unlicense;WTFPL' --excludePackages 'watchtower-ui;core@0.0.0;base64-js@0.0.2'",
     "doc:toc": "doctoc README.md"
diff --git a/scripts/yarn-audit.sh b/scripts/yarn-audit.sh
new file mode 100644
index 000000000..4b5bd702c
--- /dev/null
+++ b/scripts/yarn-audit.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Workaround to suppress yarn audit report for issues without known resolutions.
+# Audit level: Moderate
+# https://github.com/yarnpkg/yarn/issues/6669
+
+set -u
+
+set +e
+output=$(yarn audit --level=moderate --json)
+result=$?
+set -e
+
+if [ $result -eq 0 ]; then
+	# everything is fine
+	exit 0
+fi
+
+if [ -f yarn-audit-known-issues ] && echo "$output" | grep auditAdvisory | diff -q yarn-audit-known-issues - > /dev/null 2>&1; then
+	echo
+	echo Ignorning known vulnerabilities
+	exit 0
+fi
+
+echo
+echo Security vulnerabilities were found that were not ignored
+echo
+echo Check to see if these vulnerabilities apply to production
+echo and/or if they have fixes available. If they do not have
+echo fixes and they do not apply to production, you may ignore them
+echo
+echo To ignore these vulnerabilities, run:
+echo
+echo "yarn audit --level=moderate --json | grep auditAdvisory > yarn-audit-known-issues"
+echo
+echo and commit the yarn-audit-known-issues file
+
+exit "$result"
diff --git a/yarn-audit-known-issues b/yarn-audit-known-issues
new file mode 100644
index 000000000..e69de29bb