feat: add NX workspace fixtures and documentation#755
Open
Demiserular wants to merge 1 commit into
Open
Conversation
- Add examples/nx-integrated fixture for NX integrated repos - Add examples/nx-package-based fixture for NX package-based repos - Add examples/nx-mixed fixture demonstrating mixed scenario gap - Add website/docs/nx-workspaces.md with NX scanning guide - Update examples/readme.md with NX fixtures Scope: Fixtures and docs only. No code changes for mixed scenario handling (out of scope - will be handled separately using these fixtures for testing).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I added NX workspace fixtures and documentation to demonstrate CVE Lite CLI compatibility with NX integrated and package-based monorepo configurations, including a fixture that documents the known gap in mixed scenario handling.
Why this change
CVE Lite CLI needed verified NX workspace examples and documentation to help users understand how to scan NX monorepos. Testing revealed a known gap in mixed scenarios (root lockfile + nested lockfiles) that needed to be documented with workarounds.
What changed
examples/nx-integratedfixture for NX integrated repos (single root lockfile)examples/nx-mixedfixture demonstrating mixed scenario gap with README documenting the workaroundcve-lite . --search-depth 4Validation
Tested all three fixtures:
nx-integrated: Successfully scans root lockfile and finds vulnerable axios@0.19.0--search-depth 4, discovers both nested lockfiles, scans independently, labels findings by folder path, provides project-specific fix commandsnx-mixed: Confirms documented gap - only root lockfile scanned, nested lockfile not discovered (expected behavior)User-facing impact
Does this change:
Notes
Fixes #688
Scope: Fixtures and docs only. No code changes for mixed scenario handling (out of scope - will be handled separately using these fixtures for testing). The mixed scenario gap is documented in both the docs and the fixture README with workarounds provided.