flowpact

The source is in a public Git repository at https://github.com/ciatlas/flowpact.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Every change lands on main as its own squash-merged pull request, so the repository holds every interim version, not just releases. For example, pull requests #97 to #108 were merged between v0.12.1 and v0.12.2.

Repository on GitHub, which uses git. git is distributed.

Every release has its own version number (vX.Y.Z), and the npm package, the VS Code Marketplace and Open VSX use the same numbers. npm never accepts a version number twice, and since 0.10.0 every GitHub release is immutable, so its tag and files cannot change.

Releases use Semantic Versioning, as stated at the top of https://github.com/ciatlas/flowpact/blob/main/CHANGELOG.md. release-please computes each version from Conventional Commit titles: fix means patch, feat means minor, and breaking means major (minor before 1.0).

Each release has a Git tag vX.Y.Z; from 0.1.1 on, the release automation creates them. A ruleset lets only the release bot and repository admins create, move or delete v* tags.

Every release has human-readable notes in https://github.com/ciatlas/flowpact/blob/main/CHANGELOG.md and on https://github.com/ciatlas/flowpact/releases. They are grouped into breaking changes (with upgrade steps), features, bug fixes and performance, and come from user-facing PR titles, not a raw git log. There is also an upgrade guide at https://ciatlas.github.io/flowpact/docs/upgrading.

No publicly known vulnerability with a CVE or similar ID has ever affected flowpact, so there is nothing for the release notes to list. Future fixes would be published as GitHub security advisories and named in the release notes.

Bugs and feature requests go to GitHub Issues (https://github.com/ciatlas/flowpact/issues), with a bug report form asking for the version, a minimal reproduction and how flowpact was run; the README's 'Feedback and contributing' section says so. Vulnerabilities are reported privately as https://github.com/ciatlas/flowpact/blob/main/SECURITY.md describes.

flowpact tracks bugs, enhancement requests and questions in GitHub Issues, labelled bug, enhancement and question: https://github.com/ciatlas/flowpact/issues.

Every bug report filed so far was fixed and closed within a day: #38 by #58, and #41/#42 (duplicates) by #50. No reports yet fall in the 2-12 month window because the project only went public in October 2026, and so far all bug reports were filed by the maintainer.

The only enhancement request so far, #43 (docs links in --help), was implemented the day it was filed in #50. The question #40 about whether unused outputs deserve a warning was answered by the change in #56. Both were filed by the maintainer, since the project only went public in October 2026.

All issues and pull requests, open and closed, are public and searchable along with their discussions at https://github.com/ciatlas/flowpact/issues and https://github.com/ciatlas/flowpact/pulls.

The security policy at https://github.com/ciatlas/flowpact/blob/main/SECURITY.md (also at https://github.com/ciatlas/flowpact/security/policy and linked from https://ciatlas.github.io/flowpact/docs/security) explains how to report a vulnerability privately, what to include, the response times and what is in scope.

Vulnerabilities are reported privately over HTTPS through GitHub's private vulnerability reporting form (https://github.com/ciatlas/flowpact/security/advisories/new), which is enabled for the repository. https://github.com/ciatlas/flowpact/blob/main/SECURITY.md asks reporters to use it and not public issues.

No vulnerability reports have been received: the repository has no security advisories in any state. SECURITY.md promises an acknowledgement within 3 working days and an assessment within 10.

After pnpm install, pnpm build rebuilds the CLI, the GitHub Action bundle, the language server and the VS Code extension from source, as documented in CONTRIBUTING.md. CI rebuilds on every pull request and fails if the committed action bundle differs from a fresh build.

The build uses the standard Node.js/TypeScript toolchain: pnpm scripts, the TypeScript compiler (tsc) for type checking, and tsup (esbuild) for bundling.

Building needs only FLOSS tools: Node.js and pnpm (MIT), TypeScript (Apache-2.0), and tsup and esbuild (MIT). The extension is packaged with @vscode/vsce (MIT).

The repository includes a Vitest suite (MIT): 866 unit, property and end-to-end tests in 47 files under packages/*/test and scripts/test. CONTRIBUTING.md documents pnpm test and pnpm coverage (https://github.com/ciatlas/flowpact/blob/main/CONTRIBUTING.md), and CI runs the suite on Node 22 and 24.

The tests run with pnpm test, the package.json test script (Vitest), which is the standard way to run tests in a Node.js project.

On main, the suite covers 84% of lines, 83% of statements, 80% of functions and 73% of branches of flowpact's packages. CI fails if line coverage drops below 80% overall or 90% for packages/lint. End-to-end tests also run the packed CLI on Linux, macOS and Windows, and the extension in VS Code.

GitHub Actions runs lint, type checking, the build and the test suite on every pull request and every push to main (.github/workflows/ci.yml). The main branch ruleset requires the 'CI passed' check before a merge.

https://github.com/ciatlas/flowpact/blob/main/CONTRIBUTING.md#pull-requests: a pull request that adds or changes behaviour adds tests for it, and a bug fix adds a test that fails without the fix. The required 'CI passed' check also fails when line coverage drops below 80% overall or 90% in packages/lint.

Recent major features shipped with tests. Examples: the programmatic API in 0.10.0 (https://github.com/ciatlas/flowpact/pull/78, +669 lines in packages/cli/test/api.test.ts), its format functions in 0.11.0 (#84), the action's base-config and plugin inputs (#76), the language server (#35) and the VS Code extension with its end-to-end smoke test (#39).

The contribution instructions say it: a pull request that adds or changes behaviour adds tests for it, next to the code they test, and a bug fix adds a test that fails without the fix (https://github.com/ciatlas/flowpact/blob/main/CONTRIBUTING.md#pull-requests).

TypeScript runs in strict mode (tsconfig.base.json) and the Biome linter (pnpm lint) checks the code. CI runs both on every pull request, together with CodeQL (extended query suite) and fallow (dead code, duplication, architecture).

Type checking passes with no errors and CodeQL has no open alerts. Biome reports only 2 warnings and 1 hint across 203 files on main, all minor style findings (!important in the docs CSS and a property-access style in one test).

TypeScript goes beyond strict (noUncheckedIndexedAccess, noImplicitOverride, verbatimModuleSyntax, isolatedModules), and Biome's recommended rules are on with only three turned off. CodeQL uses the extended query suite, and fallow fails a pull request that adds dead code or duplication compared with main.

The maintainer (rumankazi) knows the secure design principles and applies them in flowpact. Examples: a limited attack surface (no network access or telemetry in the CLI, language server or extension), least privilege (the action needs only contents: read), fail-safe defaults (plugins are skipped on pull_request_target and workflow_run and load in VS Code only in trusted workspaces), and allowlist validation of config and contracts with strict schemas. See https://ciatlas.github.io/flowpact/docs/security.

The maintainer knows the common vulnerabilities for a tool that reads untrusted repository files and runs in CI, and flowpact mitigates each one. It never writes through symlinks (path traversal), escapes control characters and workflow commands in its output (output injection), reads flag values only as values (argument injection), caps YAML alias and matrix expansion (resource exhaustion), and skips plugins on untrusted triggers (code execution). See https://ciatlas.github.io/flowpact/docs/security#what-it-reads-and-writes.

flowpact implements no cryptography of its own and relies only on published, expert-reviewed algorithms: TLS (through Node.js for the GitHub Action's optional artifact upload, and through git for its optional impact-mode fetch), SHA-256 for the uploaded artifact's digest (https://github.com/ciatlas/flowpact/blob/main/packages/action/src/upload.ts), and SHA-1 only to derive non-security finding IDs. The CLI, language server and extension make no network requests (https://ciatlas.github.io/flowpact/docs/security/).

flowpact calls Node.js's built-in node:crypto (OpenSSL) for hashing and UUIDs. Its HTTPS requests go through @actions/http-client over Node's TLS, and the Action's optional impact-mode fetch runs git. It re-implements nothing cryptographic.

All cryptographic functionality comes from Node.js and its bundled OpenSSL, both FLOSS.

flowpact generates, stores and selects no keys. Its only key exchanges are the TLS handshakes of the GitHub Action's optional network requests (the artifact upload through Node.js, the impact-mode fetch through git), which use those tools' default settings; flowpact does not change them.

flowpact uses no broken algorithms (no MD4, MD5, DES, RC4 or Dual_EC_DRBG). Its only hashes are SHA-256, for the digest of the artifact the GitHub Action uploads, and SHA-1, for non-security finding IDs, and it leaves TLS to the default configuration of Node.js and git.

No security mechanism depends on SHA-1 or another weak algorithm, and the artifact integrity digest is SHA-256. SHA-1 is used only to derive 16-character finding IDs (SARIF partialFingerprints and editor diagnostic data), which nothing relies on for integrity or authentication (https://github.com/ciatlas/flowpact/blob/main/packages/lint/src/analyze.ts).

flowpact implements no key agreement protocol. Its only encrypted connections are the GitHub Action's optional HTTPS requests, made through Node.js's TLS stack (artifact upload) and git (impact-mode fetch).

flowpact is a linter with no user accounts or inbound authentication, so it stores no passwords.

flowpact generates no cryptographic keys. The one security-relevant random value in the shipped Action, the output-file delimiter nonce in the bundled @actions/core, comes from Node's CSPRNG (crypto.randomUUID). flowpact's own code uses Math.random only to jitter retry delays.

Every channel is HTTPS: npm (with npm provenance), GitHub (the Action and the release assets, signed with Sigstore; releases are immutable since 0.10.0), the VS Code Marketplace and Open VSX. The docs site redirects HTTP to HTTPS. See https://ciatlas.github.io/flowpact/docs/security/ for how to verify each artifact.

The project publishes no checksum files to be fetched over HTTP. Verification relies on signature-checked Sigstore attestations (gh attestation verify, gh release verify, npm audit signatures), and the release workflow passes SHA-256 values between its own jobs as job outputs, never over HTTP.

There are no unpatched publicly known vulnerabilities in flowpact or its shipped dependencies. The repository has no security advisories, and pnpm audit --prod reports no known vulnerabilities in the production dependency tree.

SECURITY.md commits to acknowledging reports within 3 working days and assessing them within 10, with fixes released as soon as they are ready (https://github.com/ciatlas/flowpact/blob/main/SECURITY.md). In practice, high-severity CodeQL findings were fixed within a day; one, in the bundled @actions/core, was dismissed as not exploitable.

Secret scanning with push protection is enabled and has no alerts, and a search of the tree and the full git history found no private keys or tokens. Publishing to npm, the VS Code Marketplace and Open VSX uses OIDC, so no long-lived publishing token is stored.

CodeQL, with the security-extended suite for JavaScript/TypeScript and GitHub Actions, analyzes every pull request and every push to main, including the release-please release PRs (for example #109 for 0.12.2). Biome's linter runs in the required 'CI passed' check (https://github.com/ciatlas/flowpact/blob/main/.github/workflows/ci.yml).

CodeQL runs its security-extended query suite, which targets common JavaScript/TypeScript and Actions vulnerabilities such as injection, ReDoS, insecure temporary files and untrusted checkouts.

Every confirmed medium-or-higher CodeQL finding was fixed within hours to 3 days. The rest were dismissed as false positives, test fixtures, or a race in the bundled @actions/core that is not exploitable. No medium-or-higher CodeQL alert is open.

CodeQL runs on every pull request, on every push to main and weekly, and Biome runs in CI on every pull request and push to main.

A fast-check property-based fuzz test feeds the analyzer 300 random, often invalid, workflow-shaped repositories and requires that it never throws (https://github.com/ciatlas/flowpact/blob/main/packages/lint/test/robustness.test.ts). It runs in the required CI tests on every pull request, including release PRs.

flowpact is written entirely in TypeScript and runs on Node.js, a memory-safe environment, and ships no C, C++ or other native code.

The tests run flowpact's TypeScript sources and assert heavily: the JSON report of every fixture repository and the CLI's JSON output are validated against flowpact's report schema, and the fuzz test checks invariants on every finding (positive line and column, https docs URL).

The fuzz test has not surfaced any medium-or-higher vulnerability: the repository has no security advisories. The test runs in the required 'CI passed' check, which has no bypass actors, so a failing case blocks merging until it is fixed.