Merge pull request #1 from l3montree-dev/git-hooks-and-inline-features

Git hooks and inline features

Author: seb-kw

.github/workflows/release.yml

@@ -0,0 +1,48 @@
+name: Build and Release VS Code Extension
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install VSCE
+        run: npm install -g @vscode/vsce
+
+      - name: Package extension
+        run: vsce package
+
+      - name: Rename VSIX
+        id: vsix
+        run: |
+          file=$(ls *.vsix | head -n1)
+          mv "$file" DevGuard-VS-Code-Companion.vsix
+          echo "file=DevGuard-VS-Code-Companion.vsix" >> "$GITHUB_OUTPUT"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844
+        with:
+          files: ${{ steps.vsix.outputs.file }}
+          generate_release_notes: true

README.md

@@ -4,9 +4,9 @@
 > **Proof of Concept** This integration is not yet production-ready. It is intended for experimentation and feedback only.
 
 
-Inline npm dependency-risk insights in your `package.json`, powered by [DevGuard](https://devguard.org).
+Inline dependency risk insights for npm and go (malicious flag, known vulnerabilities, release age, transitive dependency count and OpenSSF scorecard), dependency proxy setup, Git-hooks setup and background SAST scan on-save. Powered by [DevGuard](https://devguard.org).
 
-While you edit `package.json`, each dependency gets a **color-coded** end-of-line badge (red = malicious / low scorecard, amber = vulnerabilities / weak scorecard / stale, green = clean) and a rich hover card showing:
+While you edit `package.json` and `go.mod`, each dependency gets a **color-coded** end-of-line badge (red = malicious / low scorecard, amber = vulnerabilities / weak scorecard / stale, green = clean) and a rich hover card showing:
 
 - **⚠ malicious** — whether the package version is flagged in DevGuard's malicious-package feed
 - **known vulnerabilities** — count of CVEs affecting the resolved version (with IDs and fixed versions)
@@ -21,12 +21,20 @@ The inline insights work **without signing in** — they use DevGuard's public p
 
 ## Requirements
 
-- A DevGuard backend. For local development this defaults to `http://localhost:8080` (configurable via `devguard.apiUrl`).
-- For asset selection / SBOM / asset overlays: a DevGuard **personal access token** (PAT).
+- Docker
+- A DevGuard backend
+- For asset selection / SBOM / asset overlays: a DevGuard **personal access token** (PAT)
 
 ## Getting started
 
-1. Open a project with a `package.json`. Badges appear automatically (no sign-in required).
+### Installation
+
+1. Download the `DevGuard-VS-Code-Companion.vsix` from our [release notes](https://github.com/l3montree-dev/devguard-vs-code-extension/releases).
+2. Open VS-Code and import the downloaded file to VS-Code under the `"Extensions-Tab"` (`Ctrl+K Ctrl+S (Windows/Linux)` or `Cmd+K Cmd+S (Mac)`) > `"..."` > `"Install from VSIX"`. Alternatively drag-and-drop the file into the extension-tab.
+
+### Using the extension
+5
+1. Open a project with a `package.json` or `go.mod`. Badges appear automatically (no sign-in required).
 2. Run **DevGuard: Connect (Personal Access Token)** and paste your PAT. It is validated against the backend and stored in VS Code Secret Storage.
 3. Run **DevGuard: Select Organization / Project / Asset** (or click the status-bar item) to connect the workspace to an asset. Hovers then show that asset's open risks per package.
 
@@ -37,10 +45,12 @@ The inline insights work **without signing in** — they use DevGuard's public p
 | `DevGuard: Connect (Personal Access Token)` | Store and validate a PAT. |
 | `DevGuard: Disconnect` | Remove the stored token and asset selection. |
 | `DevGuard: Select Organization / Project / Asset` | Pick the asset to overlay. |
-| `DevGuard: Refresh Dependency Insights` | Clear the cache and re-fetch for visible `package.json` files. |
+| `DevGuard: Refresh Dependency Insights` | Clear the cache and re-fetch for visible `package.json` and `go.mod` files. |
 | `DevGuard: Set Up Dependency Proxy (.npmrc)` | Point the project's npm registry at DevGuard's dependency proxy, which blocks malicious packages at install time. |
 | `DevGuard: View SBOM for Selected Asset` | Open the connected asset's CycloneDX SBOM as a read-only document. |
 | `DevGuard: Generate SBOM (Run devguard-scanner SCA)` | Run the `devguard-scanner sca` CLI on the project to generate and upload an SBOM to the selected asset, then refresh insights. |
+| `DevGuard: Setup Pre-Git-Commit-Hooks` | Bootstraps your locale `.git` folder with a pre-commit-hook for secret-scanning | 
+| `DevGuard: Removes Pre-Git-Commit-Hooks that were previously setup by DevGuard` | Removes the pre-commit-hooks that were previously set up using the `devguard.setupGitHooks` command | 
 
 ## Settings
 
@@ -53,6 +63,7 @@ The inline insights work **without signing in** — they use DevGuard's public p
 | `devguard.request.timeoutMs` | `8000` | Per-request timeout. |
 | `devguard.cache.ttlMinutes` | `720` | How long package results are cached. |
 | `devguard.scannerPath` | `devguard-scanner` | Path to the `devguard-scanner` CLI used by "Generate SBOM". |
+| `devguard.sast.enabled` | `true` | Enables automatic sast-scans for file on save |
 
 ## How the version is resolved
 
@@ -67,4 +78,9 @@ For accurate per-version data, the extension resolves each dependency to a concr
 
 ## Privacy
 
-Package names and versions from your `package.json` are sent to the configured DevGuard backend to look up risk data. With a local backend (`localhost:8080`) this stays on your machine.
+Package names and versions from your `package.json` and `go.mod` are sent to the configured DevGuard backend to look up risk data. With a local backend (`localhost:8080`) this stays on your machine.
+
+
+## Let us know what you think
+
+If you have question, comments or feedback, you can join our [discussion on GitHub](https://github.com/l3montree-dev/devguard/discussions/2207).

package-lock.json

@@ -1,8 +1,8 @@
 {
   "name": "devguard",
   "displayName": "DevGuard",
-  "description": "Inline npm dependency risk insights (malicious flag, known vulnerabilities, release age, transitive dependency count and OpenSSF scorecard) powered by DevGuard.",
-  "version": "0.0.1",
+  "description": "Inline dependency risk insights for npm and go (malicious flag, known vulnerabilities, release age, transitive dependency count and OpenSSF scorecard), dependency proxy setup, Git-hooks setup and background SAST scan on-save. Powered by DevGuard.",
+  "version": "0.1.1",
   "publisher": "l3montree",
   "engines": {
     "vscode": "^1.120.0"
@@ -23,7 +23,8 @@
   "activationEvents": [
     "onLanguage:json",
     "onLanguage:jsonc",
-    "workspaceContains:**/package.json"
+    "workspaceContains:**/package.json",
+    "workspaceContains:**/go.mod"
   ],
   "main": "./out/extension.js",
   "contributes": {
@@ -56,14 +57,22 @@
       {
         "command": "devguard.generateSbom",
         "title": "DevGuard: Generate SBOM (Run devguard-scanner SCA)"
+      },
+      {
+        "command": "devguard.setupGitHooks",
+        "title": "DevGuard: Setup Pre-Commit-Hooks for git"
+      },
+      {
+        "command": "devguard.removeGitHooks",
+        "title": "DevGuard: Removes Pre-Commit-Hooks for git that were previously setup by DevGuard"
       }
     ],
     "configuration": {
       "title": "DevGuard",
       "properties": {
         "devguard.apiUrl": {
           "type": "string",
-          "default": "http://localhost:8080",
+          "default": "http://api.main.devguard.org",
           "markdownDescription": "Base URL of the DevGuard backend. Only requests to this host are signed with your personal access token."
         },
         "devguard.inlineDecorations.enabled": {
@@ -107,6 +116,11 @@
           "type": "string",
           "default": "devguard-scanner",
           "description": "Path to the devguard-scanner CLI used by 'Generate SBOM'. Must be on PATH or an absolute path."
+        },
+        "devguard.sast.enabled": {
+          "type": "boolean",
+          "default": true,
+          "description": "Enable SAST and IaC scanning."
         }
       }
     },

package.json

@@ -115,10 +115,12 @@ export interface DependencyVulnFlat {
 // --- View model the UI consumes ---
 
 export type DepType =
-	| 'dependencies'
-	| 'devDependencies'
-	| 'optionalDependencies'
-	| 'peerDependencies';
+    | 'dependencies'
+    | 'devDependencies'
+    | 'optionalDependencies'
+    | 'peerDependencies'
+    | 'goDirectDependency'
+    | 'goIndirectDependency';
 
 export type VersionSource = 'lockfile' | 'node_modules' | 'range';
 
@@ -163,3 +165,10 @@ export function toNpmPurl(name: string, version: string): string {
 export function encodePurlForPath(purl: string): string {
 	return encodeURIComponent(purl);
 }
+
+// Add this alongside toNpmPurl in api/types.ts:
+// pkg:golang/github.com/gin-gonic/gin@v1.9.1
+export function toGolangPurl(modulePath: string, version: string): string {
+	return `pkg:golang/${modulePath}@${version}`;
+}
+