{"_id":"@condensetech/cdk-ecr-scan-alert","_rev":"3-43b467935a21f277554f9f764fb16d89","name":"@condensetech/cdk-ecr-scan-alert","dist-tags":{"latest":"0.0.0"},"versions":{"0.0.0":{"name":"@condensetech/cdk-ecr-scan-alert","version":"0.0.0","keywords":["cdk"],"author":{"name":"CoNDENSE.tech","email":"tech@condense.tech"},"license":"MIT","_id":"@condensetech/cdk-ecr-scan-alert@0.0.0","maintainers":[{"name":"gawaine","email":"nicola.racco@gmail.com"},{"name":"diomedet","email":"diomede.tripicchio@gmail.com"}],"homepage":"https://github.com/condensetech/cdk-ecr-scan-alert#readme","bugs":{"url":"https://github.com/condensetech/cdk-ecr-scan-alert/issues"},"//":"~~ Generated by projen. To modify, edit .projenrc.ts and run \"npx projen\".","dist":{"shasum":"29a9458315a41ec30a1e742508e36eca38722e15","tarball":"https://registry.npmjs.org/@condensetech/cdk-ecr-scan-alert/-/cdk-ecr-scan-alert-0.0.0.tgz","fileCount":14,"integrity":"sha512-i8UnpYqWJq1JYkJXbk84A80GHJ9WxhPcwCwj5M+DaRMPZSpM2S+uE6d5oACZcyUyEy2ow5HkPHDQCBn/aZaSTA==","signatures":[{"sig":"MEUCIEegHGtTrwvBgzBG4hEkCooQI0JljrN0nf/aDtwTUxgKAiEAw52XIrFC3NvFxxvarZopxpuL6tza/euF5xXf9rriGIE=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":177949},"jest":{"reporters":["default",["jest-junit",{"outputDirectory":"test-reports"}]],"testMatch":["<rootDir>/@(src|test)/**/*(*.)@(spec|test).ts?(x)","<rootDir>/@(src|test)/**/__tests__/**/*.ts?(x)","<rootDir>/@(projenrc)/**/*(*.)@(spec|test).ts?(x)","<rootDir>/@(projenrc)/**/__tests__/**/*.ts?(x)"],"transform":{"^.+\\.[t]sx?$":["ts-jest",{"tsconfig":"tsconfig.dev.json"}]},"clearMocks":true,"collectCoverage":true,"coverageProvider":"v8","coverageDirectory":"coverage","coverageReporters":["json","lcov","clover","cobertura","text"],"testPathIgnorePatterns":["/node_modules/"],"watchPathIgnorePatterns":["/node_modules/"],"coveragePathIgnorePatterns":["/node_modules/"]},"jsii":{"tsc":{"outDir":"lib","rootDir":"src"},"outdir":"dist","targets":{}},"main":"lib/index.js","pnpm":{"onlyBuiltDependencies":["esbuild","unrs-resolver"]},"types":"lib/index.d.ts","gitHead":"3afe1bafc3c403328f1c58cd9d90696daa730668","scripts":{"bump":"npx projen bump","test":"npx projen test","build":"npx projen build","eject":"npx projen eject","watch":"npx projen watch","compat":"npx projen compat","docgen":"npx projen docgen","eslint":"npx projen eslint","projen":"npx projen","unbump":"npx projen unbump","clobber":"npx projen clobber","compile":"npx projen compile","default":"npx projen default","package":"npx projen package","release":"npx projen release","upgrade":"npx projen upgrade","package:js":"npx projen package:js","test:watch":"npx projen test:watch","package-all":"npx projen package-all","pre-compile":"npx projen pre-compile","post-compile":"npx projen post-compile","post-upgrade":"npx projen post-upgrade"},"_npmUser":{"name":"gawaine","email":"nicola.racco@gmail.com"},"stability":"stable","repository":{"url":"git+ssh://git@github.com/condensetech/cdk-ecr-scan-alert.git","type":"git"},"_npmVersion":"11.6.2","description":"AWS CDK construct that runs ECR image vulnerability scans during deployment and reports findings to GitHub. Blocks deployment when critical or high-severity vulnerabilities are found (configurable).","directories":{},"_nodeVersion":"24.12.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^30.2.0","jsii":"~5.9.0","eslint":"^9","projen":"^0.99.17","esbuild":"^0.27.3","ts-jest":"^29.4.6","ts-node":"^10.9.2","jsii-diff":"^1.127.0","constructs":"10.5.1","jest-junit":"^16","typescript":"^5.9.3","@types/jest":"^30.0.0","@types/node":"^25.3.1","aws-cdk-lib":"2.189.1","jsii-docgen":"^10.5.0","jsii-pacmak":"^1.127.0","jsii-rosetta":"~5.9.0","@aws-sdk/client-ecr":"^3.998.0","eslint-plugin-import":"^2.32.0","commit-and-tag-version":"^12","@stylistic/eslint-plugin":"^2","@typescript-eslint/parser":"^8","@aws-sdk/client-cloudformation":"^3.998.0","@aws-sdk/client-secrets-manager":"^3.998.0","@typescript-eslint/eslint-plugin":"^8","eslint-import-resolver-typescript":"^4.4.4"},"peerDependencies":{"constructs":"^10.5.1","aws-cdk-lib":"^2.189.1"},"_npmOperationalInternal":{"tmp":"tmp/cdk-ecr-scan-alert_0.0.0_1772128548403_0.3112950338460452","host":"s3://npm-registry-packages-npm-production"}}},"time":{"created":"2026-02-26T17:55:48.271Z","modified":"2026-04-22T07:48:11.422Z","0.0.0":"2026-02-26T17:55:48.552Z"},"bugs":{"url":"https://github.com/condensetech/cdk-ecr-scan-alert/issues"},"author":{"name":"CoNDENSE.tech","email":"tech@condense.tech"},"license":"MIT","homepage":"https://github.com/condensetech/cdk-ecr-scan-alert#readme","keywords":["cdk"],"repository":{"url":"git+ssh://git@github.com/condensetech/cdk-ecr-scan-alert.git","type":"git"},"description":"AWS CDK construct that runs ECR image vulnerability scans during deployment and reports findings to GitHub. Blocks deployment when critical or high-severity vulnerabilities are found (configurable).","maintainers":[{"email":"nicola.racco@gmail.com","name":"gawaine"},{"email":"ema.serafini@gmail.com","name":"emaserafini"}],"readme":"# cdk-ecr-scan-alert\n\nAWS CDK construct that runs ECR image vulnerability scans during deployment and reports findings to GitHub. Blocks deployment when critical or high-severity vulnerabilities are found (configurable).\n\n## Features\n\n- **Scans ECR images** via `StartImageScan` and polls until completion\n- **Blocks deployment** by default if vulnerabilities exceed the severity threshold\n- **GitHub integration** — posts formatted reports as PR comments or creates issues\n- **Configurable severity thresholds** — CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNDEFINED\n- **Rollback-safe** — suppresses errors during CloudFormation rollback to avoid `ROLLBACK_FAILED`\n\n## Prerequisites\n\n- (Optional) ECR scan on push. If not present the construct will require a scan\n- (Optional) GitHub token in Secrets Manager for posting alerts\n\n## Installation\n\n```bash\n# Using pnpm\npnpm add @condensetech/cdk-ecr-scan-alert\n\n# Using npm\nnpm install @condensetech/cdk-ecr-scan-alert\n\n# Using yarn\nyarn add @condensetech/cdk-ecr-scan-alert\n```\n\n## Usage\n\n```typescript\nimport * as ecr from 'aws-cdk-lib/aws-ecr';\nimport { EcrScanAlert } from '@condensetech/cdk-ecr-scan-alert';\n\n// In your stack:\nconst repo = ecr.Repository.fromRepositoryName(this, 'Repo', 'my-ecr-repo');\n\nnew EcrScanAlert(this, 'ScanAlert', {\n  imageUri: '123456789012.dkr.ecr.us-east-1.amazonaws.com/my-ecr-repo:v1.2.3',\n  repository: repo,\n  github: {\n    owner: 'my-org',\n    repo: 'my-app',\n    tokenSecretName: 'github/token',\n    prNumber: 42, // optional: comment on PR instead of creating an issue\n  },\n});\n```\n\n### Minimal (no GitHub integration)\n\n```typescript\nnew EcrScanAlert(this, 'ScanAlert', {\n  imageUri: '123456789012.dkr.ecr.us-east-1.amazonaws.com/my-repo:latest',\n  repository: repo,\n});\n```\n\n## API Reference\n\n| Property | Type | Required | Default | Description |\n|----------|------|----------|---------|-------------|\n| `imageUri` | string | Yes | — | Full ECR image URI (e.g. `account.dkr.ecr.region.amazonaws.com/repo:tag`) |\n| `repository` | `IRepository` | Yes | — | ECR repository (used for IAM permissions) |\n| `github` | `EcrScanAlertGitHubProps` | No | — | GitHub integration: `{ owner, repo, tokenSecretName, prNumber? }` |\n| `severityThreshold` | string[] | No | `['CRITICAL', 'HIGH']` | Severities that cause failure |\n| `suppressErrorOnRollback` | boolean | No | `true` | Suppress errors during rollback to avoid ROLLBACK_FAILED |\n| `blockDeployment` | boolean | No | `true` | When `true`, deployment fails on findings; when `false`, deployment proceeds but GitHub alerts still post |\n\n### `EcrScanAlertGitHubProps` (when using `github`)\n\n| Property | Type | Required | Description |\n|----------|------|----------|-------------|\n| `owner` | string | Yes | GitHub org or username |\n| `repo` | string | Yes | GitHub repository name |\n| `tokenSecretName` | string | Yes | Secrets Manager secret name containing the GitHub token |\n| `prNumber` | number | No | If set, comment on this PR instead of creating an issue |\n\n## GitHub Integration\n\n1. Create a [GitHub fine-grained token](https://github.com/settings/tokens) or classic PAT with:\n   - **Repository access**: the target repo(s)\n   - **Permissions**: `Issues: Read and write`, `Pull requests: Read and write`, `Metadata: Read-only`\n\n2. Store the token in AWS Secrets Manager:\n   ```bash\n   aws secretsmanager create-secret \\\n     --name github/token \\\n     --secret-string \"ghp_xxxx\"\n   ```\n\n3. Pass the `github` prop to the construct with `owner`, `repo`, and `tokenSecretName`.\n\n### PR vs Issue\n\n- **With `prNumber`**: Posts/updates a single comment on the PR (ideal for CI deployments from PRs)\n- **Without `prNumber`**: Creates a new GitHub issue for each failure\n\n## License\n\nApache-2.0\n","readmeFilename":"README.md"}