security(repo): Configure cargo-crev (#3124)

.github/workflows/crate-publish.yml

@@ -1,34 +0,0 @@
-on: workflow_dispatch
-
-name: Managment
-
-jobs:
-  publish-crates:
-    name: Publish crates
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2
-
-      - uses: actions/cache@v2
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: cargo-publish-crates
-
-      - name: Install cargo-mono
-        continue-on-error: true
-        run: |
-          cargo install cargo-mono
-
-      - name: Login
-        run: |
-          cargo login ${{ secrets.CARGO_TOKEN }}
-
-      - name: Publish crates
-        run: |
-          cargo mono publish

.github/workflows/crev.yml

@@ -0,0 +1,26 @@
+name: "crev: Dependencies"
+
+on: [push, pull_request]
+
+jobs:
+  check-deps:
+    name: Check dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Install Rust
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+
+      - name: Configure cargo-crev
+        run: |
+          cargo install cargo-crev
+          git config --global user.name 'SWC bot'
+          git config --global user.email 'bot@swc.rs'
+          cargo crev trust --level high https://github.com/kdy1/crev-proofs
+
+      - name: Check dependencies
+        run: |
+          ./scripts/crev/verify.sh

Cargo.lock

@@ -635,19 +635,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "env_logger"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aafcde04e90a5226a6443b7aabdb016ba2f8307c847d524724bd9b346dd1a2d3"
-dependencies = [
- "atty",
- "humantime",
- "log",
- "regex",
- "termcolor",
-]
-
 [[package]]
 name = "env_logger"
 version = "0.7.1"
@@ -1048,7 +1035,7 @@ dependencies = [
  "dashmap",
  "nom 5.1.2",
  "serde",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_parser",
@@ -1138,15 +1125,6 @@ dependencies = [
  "hashbrown",
 ]
 
-[[package]]
-name = "matchers"
-version = "0.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f099785f7595cc4b4553a174ce30dd7589ef93391ff414dbb67f62392b9e0ce1"
-dependencies = [
- "regex-automata",
-]
-
 [[package]]
 name = "matchers"
 version = "0.1.0"
@@ -1335,10 +1313,11 @@ dependencies = [
  "napi-derive",
  "path-clean",
  "proc-macro2",
+ "quote",
  "serde",
  "serde_json",
  "swc",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_bundler",
  "swc_common",
  "swc_ecma_ast",
@@ -1347,7 +1326,7 @@ dependencies = [
  "swc_node_base",
  "swc_node_bundler",
  "tracing",
- "tracing-subscriber 0.3.4",
+ "tracing-subscriber",
 ]
 
 [[package]]
@@ -1772,17 +1751,6 @@ dependencies = [
  "output_vt100",
 ]
 
-[[package]]
-name = "pretty_env_logger"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "717ee476b1690853d222af4634056d830b5197ffd747726a9a1eee6da9f49074"
-dependencies = [
- "chrono",
- "env_logger 0.6.2",
- "log",
-]
-
 [[package]]
 name = "proc-macro-crate"
 version = "0.1.5"
@@ -1839,9 +1807,9 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
 [[package]]
 name = "quote"
-version = "1.0.11"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dff9853339d4a5b75094c8edd65c3a0e81da8281855332d79559ddd8591b236"
+checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
 dependencies = [
  "proc-macro2",
 ]
@@ -2597,7 +2565,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sourcemap",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen",
@@ -2631,16 +2599,6 @@ dependencies = [
  "string_cache_codegen",
 ]
 
-[[package]]
-name = "swc_atoms"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f5229fe227ff0060e13baa386d6e368797700eab909523f730008d191ee53ae"
-dependencies = [
- "string_cache",
- "string_cache_codegen",
-]
-
 [[package]]
 name = "swc_bundler"
 version = "0.93.0"
@@ -2663,7 +2621,7 @@ dependencies = [
  "reqwest",
  "retain_mut",
  "sha-1",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen",
@@ -2747,7 +2705,7 @@ dependencies = [
  "is-macro",
  "serde",
  "string_enum",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
 ]
 
@@ -2757,7 +2715,7 @@ version = "0.42.1"
 dependencies = [
  "auto_impl 0.4.1",
  "bitflags",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_css_ast",
  "swc_css_codegen_macros",
@@ -2781,7 +2739,7 @@ dependencies = [
 name = "swc_css_minifier"
 version = "0.6.0"
 dependencies = [
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_css_ast",
  "swc_css_codegen",
@@ -2799,7 +2757,7 @@ dependencies = [
  "lexical",
  "serde",
  "serde_json",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_css_ast",
  "swc_css_visit",
@@ -2811,7 +2769,7 @@ dependencies = [
 name = "swc_css_utils"
 version = "0.37.0"
 dependencies = [
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_css_ast",
  "swc_css_visit",
@@ -2821,7 +2779,7 @@ dependencies = [
 name = "swc_css_visit"
 version = "0.39.0"
 dependencies = [
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_css_ast",
  "swc_visit",
@@ -2837,7 +2795,7 @@ dependencies = [
  "serde",
  "serde_json",
  "string_enum",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "unicode-xid",
 ]
@@ -2851,7 +2809,7 @@ dependencies = [
  "num-bigint",
  "once_cell",
  "sourcemap",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen_macros",
@@ -2876,7 +2834,7 @@ dependencies = [
 name = "swc_ecma_dep_graph"
 version = "0.52.0"
 dependencies = [
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_parser",
@@ -2892,7 +2850,7 @@ dependencies = [
  "auto_impl 0.5.0",
  "num-bigint",
  "string_cache",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen",
@@ -2907,7 +2865,7 @@ name = "swc_ecma_ext_transforms"
 version = "0.42.0"
 dependencies = [
  "phf",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_parser",
@@ -2922,7 +2880,7 @@ dependencies = [
  "auto_impl 0.5.0",
  "parking_lot 0.11.1",
  "rayon",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_utils",
@@ -2943,7 +2901,7 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "testing",
  "tracing",
@@ -2966,7 +2924,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_regex",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen",
@@ -2989,14 +2947,14 @@ version = "0.82.5"
 dependencies = [
  "either",
  "enum_kind",
- "env_logger 0.7.1",
+ "env_logger",
  "lexical",
  "num-bigint",
  "pretty_assertions 0.6.1",
  "serde",
  "serde_json",
  "smallvec 1.7.0",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_visit",
@@ -3017,7 +2975,7 @@ dependencies = [
  "rplugin",
  "serde",
  "serde_json",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_parser",
@@ -3041,7 +2999,7 @@ dependencies = [
  "serde_json",
  "st-map",
  "string_enum",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen",
@@ -3059,7 +3017,7 @@ version = "0.103.6"
 dependencies = [
  "pretty_assertions 0.6.1",
  "sourcemap",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen",
@@ -3089,7 +3047,7 @@ dependencies = [
  "rayon",
  "scoped-tls",
  "smallvec 1.7.0",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen",
@@ -3105,7 +3063,7 @@ dependencies = [
 name = "swc_ecma_transforms_classes"
 version = "0.36.1"
 dependencies = [
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_transforms_base",
@@ -3127,7 +3085,7 @@ dependencies = [
  "serde",
  "serde_json",
  "smallvec 1.7.0",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_parser",
@@ -3162,7 +3120,7 @@ dependencies = [
  "indexmap",
  "pathdiff",
  "serde",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_loader",
@@ -3186,7 +3144,7 @@ dependencies = [
  "rayon",
  "retain_mut",
  "serde_json",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_parser",
@@ -3212,7 +3170,7 @@ dependencies = [
  "serde",
  "serde_json",
  "smallvec 1.7.0",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_loader",
@@ -3241,7 +3199,7 @@ dependencies = [
  "serde",
  "sha-1",
  "string_enum",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen",
@@ -3282,7 +3240,7 @@ name = "swc_ecma_transforms_typescript"
 version = "0.69.1"
 dependencies = [
  "serde",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen",
@@ -3305,7 +3263,7 @@ version = "0.56.1"
 dependencies = [
  "once_cell",
  "rayon",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_parser",
@@ -3320,7 +3278,7 @@ name = "swc_ecma_visit"
 version = "0.46.0"
 dependencies = [
  "num-bigint",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_visit",
@@ -3359,7 +3317,7 @@ dependencies = [
  "scoped-tls",
  "serde",
  "serde_json",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
 ]
 
@@ -3375,7 +3333,7 @@ dependencies = [
  "serde",
  "serde_json",
  "swc",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_parser",
@@ -3437,13 +3395,12 @@ dependencies = [
  "is-macro",
  "once_cell",
  "pretty_assertions 0.6.1",
- "pretty_env_logger",
  "regex",
  "serde",
  "serde_json",
  "string_enum",
  "swc",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_bundler",
  "swc_common",
  "swc_ecma_ast",
@@ -3478,7 +3435,7 @@ dependencies = [
  "rplugin",
  "serde",
  "serde_json",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_plugin_ast",
@@ -3495,7 +3452,7 @@ dependencies = [
  "anyhow",
  "serde",
  "serde_json",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_plugin_ast",
 ]
@@ -3512,7 +3469,7 @@ dependencies = [
  "rplugin",
  "serde",
  "serde_json",
- "swc_atoms 0.2.9 (registry+https://github.com/rust-lang/crates.io-index)",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen",
@@ -3527,7 +3484,7 @@ name = "swc_plugin_testing"
 version = "0.24.0"
 dependencies = [
  "anyhow",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen",
@@ -3540,7 +3497,7 @@ dependencies = [
 name = "swc_stylis"
 version = "0.41.1"
 dependencies = [
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_css_ast",
  "swc_css_codegen",
@@ -3586,7 +3543,7 @@ dependencies = [
  "rayon",
  "serde",
  "serde_json",
- "swc_atoms 0.2.9",
+ "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_parser",
@@ -3649,7 +3606,7 @@ dependencies = [
  "swc_common",
  "testing_macros",
  "tracing",
- "tracing-subscriber 0.2.25",
+ "tracing-subscriber",
 ]
 
 [[package]]
@@ -3835,38 +3792,6 @@ dependencies = [
  "tracing-core",
 ]
 
-[[package]]
-name = "tracing-serde"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb65ea441fbb84f9f6748fd496cf7f63ec9af5bca94dd86456978d055e8eb28b"
-dependencies = [
- "serde",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-subscriber"
-version = "0.2.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e0d2eaa99c3c2e41547cfa109e910a68ea03823cccad4a0525dcbc9b01e8c71"
-dependencies = [
- "ansi_term 0.12.1",
- "chrono",
- "lazy_static",
- "matchers 0.0.1",
- "regex",
- "serde",
- "serde_json",
- "sharded-slab",
- "smallvec 1.7.0",
- "thread_local",
- "tracing",
- "tracing-core",
- "tracing-log",
- "tracing-serde",
-]
-
 [[package]]
 name = "tracing-subscriber"
 version = "0.3.4"
@@ -3875,7 +3800,7 @@ checksum = "d5e6136799e1079699e0d9784c883e03af55cf6a1bee48fe1d79ca552c1bc36f"
 dependencies = [
  "ansi_term 0.12.1",
  "lazy_static",
- "matchers 0.1.0",
+ "matchers",
  "regex",
  "sharded-slab",
  "smallvec 1.7.0",

crates/node/Cargo.toml

@@ -26,6 +26,7 @@ napi = {version = "2", default-features = false, features = ["napi3", "serde-jso
 napi-derive = {version = "2", default-features = false, features = ["type-def"]}
 path-clean = "0.1"
 proc-macro2 = "=1.0.32"
+quote = "=1.0.10"
 serde = {version = "1", features = ["derive"]}
 serde_json = {version = "1", features = ["unbounded_depth"]}
 swc = {path = "../swc", features = ["concurrent", "plugin", "node"]}
@@ -38,4 +39,4 @@ swc_ecma_parser = {path = "../swc_ecma_parser"}
 swc_node_base = {path = "../swc_node_base"}
 swc_node_bundler = {path = "../swc_node_bundler"}
 tracing = {version = "0.1.28", features = ["release_max_level_info"]}
-tracing-subscriber = {version = "0.3.2", features = ["env-filter"]}
+tracing-subscriber = {version = "0.3.4", features = ["env-filter"]}

crates/swc_node_bundler/Cargo.toml

@@ -40,7 +40,6 @@ tracing = "0.1.28"
 
 [dev-dependencies]
 pretty_assertions = "0.6.1"
-pretty_env_logger = "0.3"
 tempfile = "3"
 testing = {path = "../testing"}
 walkdir = "2.3.1"

crates/swc_node_bundler/tests/fixture.rs

@@ -22,8 +22,6 @@ use testing::NormalizedOutput;
 
 #[testing::fixture("tests/pass/**/input")]
 fn pass(input_dir: PathBuf) {
-    let _ = pretty_env_logger::try_init();
-
     let entry = input_dir.parent().unwrap().to_path_buf();
 
     let _ = create_dir_all(entry.join("output"));

crates/swc_plugin_runner/Cargo.toml

@@ -18,7 +18,7 @@ parking_lot = "0.7"
 rplugin = {version = "0.3.0", path = "../rplugin"}
 serde = {version = "1.0.126", features = ["derive"]}
 serde_json = "1.0.64"
-swc_atoms = "0.2.7"
+swc_atoms = {version = "0.2.7", path = '../swc_atoms'}
 swc_common = {version = "0.15.0", path = "../swc_common", features = ["plugin-rt"]}
 swc_ecma_ast = {version = "0.60.0", path = "../swc_ecma_ast"}
 swc_ecma_parser = {version = "0.82.0", path = "../swc_ecma_parser"}

crates/testing/Cargo.toml

@@ -18,4 +18,4 @@ serde_json = "1.0.71"
 swc_common = {version = "0.15.0", path = "../swc_common", features = ["tty-emitter"]}
 testing_macros = {version = "0.2.0", path = "../testing_macros"}
 tracing = "0.1.28"
-tracing-subscriber = {version = "0.2.24", features = ["env-filter"]}
+tracing-subscriber = { version = "0.3.4", features = ["env-filter"] }

scripts/crev/verify.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+#
+# Script used to verify the depdencies of the project.
+#
+
+set -eu
+
+# Exclude local crates.
+TEXT=$(\
+    cargo crev verify --show-latest-trusted --skip-verified --recursive --skip-known-owners |\
+    grep -v "^local" |\
+    grep -v "↑" |\
+    grep -v "=[ ]*$" |\
+    tee /dev/stderr \
+)
+
+if [ ! -z "${1-}" ] ; then
+    echo "Opening the crate $1"
+
+    cargo crev open $@
+    cargo crev review $@
+
+else
+    if [ ! -z "$TEXT" ]; then
+        echo "Found a depenedncy requires verification"
+        exit 1
+    else
+        echo "All dependencies are verified"
+    fi
+fi