npm-audit-fix-and-push

#!/usr/bin/env bash

# npm-audit-fix-and-push:
# Run "npm audit fix" in a repo. Then, use Git to commit and push the result.
#
# Installation instructions:
# https://github.com/openjck/dotfiles/blob/main/docs/scripts.md#installation
#
# Usage instructions:
# https://github.com/openjck/dotfiles/blob/main/docs/scripts.md#usage

# MIT License
#
# Copyright (c) 2024, 2025, 2026 John Karahalis
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

# Use Bash's unofficial "strict mode."
#
# http://redsymbol.net/articles/unofficial-bash-strict-mode/
set -o errexit
set -o nounset
set -o pipefail
IFS=$'\n\t'

if [[ ${DEBUG:-} == 1 ]]; then
  set -o xtrace
fi

COMMAND_NAME=$(basename "$0")

##########################
# BEGIN DEPENDENCY CHECK #
##########################

DEPENDENCIES=(
  docopts
  npm
  git
)

MISSING_DEPENDENCIES=()

for DEPENDENCY in "${DEPENDENCIES[@]}"; do
  if ! command -v "$DEPENDENCY" >/dev/null; then
    MISSING_DEPENDENCIES+=("$DEPENDENCY")
  fi
done

if ((${#MISSING_DEPENDENCIES[@]} > 0)); then
  fold >&2 --spaces <<EOF
FATAL ERROR: The following are not installed. You must install them on your \
own for "$COMMAND_NAME" to function properly.

EOF
  for DEPENDENCY in "${MISSING_DEPENDENCIES[@]}"; do
    echo >&2 "  - $DEPENDENCY"
  done
  exit 1
fi

########################
# END DEPENDENCY CHECK #
########################

eval "$(
  docopts --help=- -A ARGS : "$@" <<EOF
Run "npm audit fix" in a repo. Then, use Git to commit and push the result.

Git command output is not hidden. Additionally, "npm audit" is run before "npm
audit fix" to display the issues that will be fixed.

Usage:
  $COMMAND_NAME [-b BRANCH] [-m MESSAGE]
  $COMMAND_NAME -h | --help

Options:
  -b BRANCH, --branch BRANCH
      The branch that "npm audit fix" should be run on [default: main]
  -m MESSAGE, --message MESSAGE
      The commit message to use when committing the change
      [default: Run "npm audit fix"]
  -h, --help
      Show this documentation
EOF
)"

if [[ -t 1 ]]; then
  OUTPUT_IS_TERMINAL=true
else
  OUTPUT_IS_TERMINAL=false
fi

# Running "git rev-parse" prints an error if we are not in a Git repo. If the
# command is successful, however, it is silent and we continue.
if git rev-parse; then
  if [[ -n "$(git status --porcelain)" ]]; then
    cat >&2 <<'EOF'
FATAL ERROR: Working directory is dirty. Stash or commit any changes. Then, run
this command again.
EOF
    exit 1
  fi

  STARTING_BRANCH=$(git branch --show-current)

  if [[ $STARTING_BRANCH == "${ARGS[--branch]}" ]]; then
    DIFFERENT_STARTING_BRANCH=false
  else
    DIFFERENT_STARTING_BRANCH=true
  fi

  if [[ $DIFFERENT_STARTING_BRANCH == true ]]; then
    echo "Switching to branch \"${ARGS[--branch]}\"..."
    git switch --quiet "${ARGS[--branch]}"
  else
    echo "Already on branch \"${ARGS[--branch]}\"."
  fi

  echo -n 'Running "git pull"... '
  git pull --quiet
  echo 'done.'

  echo -n 'Running "npm clean-install"... '
  npm clean-install >/dev/null
  echo 'done.'

  echo -n 'Running "npm audit"... '

  # When there are vulnerabilities, "audit" prints those error messages to
  # stderr. I don't need to see them when running this script, so redirect all
  # output to /dev/null.
  if npm audit &>/dev/null; then
    echo 'done.'
    echo '"npm audit" reported no issues. There is nothing to do.'
  else
    echo 'done.'
    echo '"npm audit" failed.'

    echo -n 'Running "npm audit fix"... '

    if [[ $OUTPUT_IS_TERMINAL == true ]]; then
      NPM_AUDIT_FIX_FLAGS='--color=always'
    fi

    # We want word splitting here, so that $NPM_AUDIT_FIX_FLAGS is not treated
    # as a single argument to "npm audit fix".
    #
    # shellcheck disable=SC2086
    if NPM_AUDIT_FIX_OUTPUT=$(npm audit fix $NPM_AUDIT_FIX_FLAGS 2>&1); then
      echo 'done.'
    else
      echo >&2
      echo >&2 'FATAL ERROR: "npm audit fix" failed with the following message:'
      echo >&2 "$NPM_AUDIT_FIX_OUTPUT"

      git restore package-lock.json

      exit 1
    fi

    echo -n 'Committing fixes... '
    git add -u
    git commit --quiet -m "${ARGS[--message]}"
    echo 'done.'

    echo -n 'Pushing commit... '
    # When there are vulnerabilities, GitHub might print those vulnerabilities
    # to stderr when the code is pushed up, unaware that the push actually fixes
    # those vulnerabilities. I don't need to see them when running this script,
    # so redirect all output to /dev/null.
    git push &>/dev/null
    echo 'done.'
  fi

  if [[ $DIFFERENT_STARTING_BRANCH == true ]]; then
    echo -n "Switching back to branch \"$STARTING_BRANCH\"... "
    git switch --quiet -
    echo 'done.'
  fi
fi