chore: pimped bin/vulnerability/find-dependencies.sh

Author: kirrg001

bin/vulnerability/find-dependencies.sh

@@ -3,28 +3,76 @@
 set -o pipefail
 
 PACKAGES=(
-  "debug@4"
-  "chalk@5"
+  "debug@4.4.1"
+  "chalk@5.6.0"
   # "debug"
   # "chalk"
-  # "debug@4.4.2"
-  # "chalk@5.6.1"
+  # "debug@4"
+  # "chalk@5"
 )
 
-rm -rf app
-mkdir -p app
-cd app
-npm init -y
+if [[ "${RECREATE:-}" == "false" ]]; then
+  cd app
+else
+  rm -rf app
+  mkdir -p app
+  cd app
+  npm init -y
+fi
 
-# Always do a fresh install to get the latest allowed sub dependencies.
-npm install @instana/collector --save
-npm install @instana/serverless-collector --save
-npm install @instana/aws-lambda --save
-npm install @instana/aws-fargate --save
-npm install @instana/google-cloud-run --save
-npm install @instana/azure-container-services --save
+if [[ "${ONLY_SCAN:-}" != "true" ]]; then
+  if [[ "${MODE:-}" == "local" ]]; then
+    echo -e "\nInstalling local packages from local.\n"
 
-echo "Checking for vulnerable packages..."
+    # Get the version from the package.json in ../../packages/collector
+    CURRENT_VERSION=$(node -p "require('../../../packages/collector/package.json').version")
+
+    instanaPkgs=(
+      "collector"
+      "serverless-collector"
+      "aws-lambda"
+      "aws-fargate"
+      "google-cloud-run"
+      "azure-container-services"
+      # Adding the sub dependencies is important, because otherwise we cannot test changes.
+      "core"
+      "serverless"
+      "shared-metrics"
+    )
+
+    cd "../../../packages"
+
+    for pkg in "${instanaPkgs[@]}"; do
+      cd "$pkg"
+      rm -rf *.tgz
+      npm pack
+      cd ..
+    done
+
+    cd ../bin/vulnerability/app
+
+    npm install ../../../packages/collector/instana-collector-${CURRENT_VERSION}.tgz --save
+    npm install ../../../packages/serverless-collector/instana-serverless-collector-${CURRENT_VERSION}.tgz --save
+    npm install ../../../packages/aws-lambda/instana-aws-lambda-${CURRENT_VERSION}.tgz --save
+    npm install ../../../packages/aws-fargate/instana-aws-fargate-${CURRENT_VERSION}.tgz --save
+    npm install ../../../packages/google-cloud-run/instana-google-cloud-run-${CURRENT_VERSION}.tgz --save
+    npm install ../../../packages/azure-container-services/instana-azure-container-services-${CURRENT_VERSION}.tgz --save
+
+    # Simulate that the sub dependencies got updated (override!)
+    npm install ../../../packages/core/instana-core-${CURRENT_VERSION}.tgz --save
+    npm install ../../../packages/serverless/instana-serverless-${CURRENT_VERSION}.tgz --
+    npm install ../../../packages/shared-metrics/instana-shared-metrics-${CURRENT_VERSION}.tgz --save
+  else
+    npm install @instana/collector --save
+    npm install @instana/serverless-collector --save
+    npm install @instana/aws-lambda --save
+    npm install @instana/aws-fargate --save
+    npm install @instana/google-cloud-run --save
+    npm install @instana/azure-container-services --save
+  fi
+fi
+
+echo "Checking for vulnerable packages in $PWD..."
 
 for pkg in "${PACKAGES[@]}"; do
   out="$(npm ls "$pkg" 2>&1 || true)"