qua

qualscan

A CLI, and API, tool to run many quality check-ups on your javascript project.

Showing:

Popularity

Downloads/wk

104

GitHub Stars

20

Maintenance

Last Commit

2mos ago

Contributors

0

Package

Dependencies

9

License

MIT

Type Definitions

Built-In

Tree-Shakeable

No?

Categories

Readme

GitHub release GitHub license Opened PR Opened issues DeepScan grade CI pipeline Code coverage Dependencies updates Dependencies updates Node version

Qualscan = Quality Scanner

Qualscan analizes any type of project built on Javascript (NPM module, backend app, frontend app, etc).

Qualscan example

PurposeInstallationUsageUsing config fileReportersAPIBudgetCI / CDTestLicense

Purpose

A CLI tool to run multiple plugins in order to check the quality of your Javascript project.
List of features:

  • security audit of your dependencies
  • check dependencies updates
  • check code duplications
  • check project's size (bundle's size, number of files)
  • check project's structure (readme, license, etc)
  • check exact version of dependencies
  • check dependencies (missing or unused)
  • check dependencies size (number of dep, actual size, tree's depth)
  • require time of entrypoint (loading time when we require your project)

In addition you can run all you custom scripts.
It will give you a global score based on the number of successful tasks.

Output

This tool will basically returns 1 if, at least, one task has failed, otherwise it returns 0.

Basic error output: Qualscan error

A task is considered as successful if the fail threhsold (see budgets) has not been exceeded. warn of info thresholds will bring you more information but the task will be considered as successful even if the thresholds are exceeded.

Installation

$ npm install qualscan -g

Usage

$ qualscan

Options

Display all existing options

$ qualscan -h

Run only a set of tasks

$ qualscan --tasks security-audit updates

Run only a set of scripts

$ qualscan --scripts test

Display tasks messages

$ qualscan -v

Display tasks messages by level

$ qualscan -v -l warn
LevelDescription
all(default) display all logs
errorDisplay errors only
warnDisplay warnings & errors
infoDisplay info & errors & warnings

Send custom args to jscpd

$ qualscan -cda "--ignore tests/resources/code_duplication_failed/*"

For a full list of possible arguments, please follow this documentation: Jscpd doc.

Check exact version for dev dependencies

$ qualscan -devd

Export current configuration

$ qualscan exportConf

Using Config file

Qualscan can use a configuration file instead of a list of options.

You can specify your configuration file in two different ways:

  1. Use .qualscanrc file
    By default, Qualscan will check if .qualscanrc file is present in the current directory. You can find an example here.
{
    "scripts": ["linter"],
    "tasks": [
      "code-duplication",
      "security-audit",
      "updates",
      "package-check",
      "dependencies-exact-version",
      "project-size",
      "dependencies-check",
      "dependencies-size",
      "require-time"
    ],
    "code-duplication": {
        "args": "--ignore */resources/code_duplication_failed/* --gitignore"
    },
    "verbose": true,
    "level": "error"
}
  1. Use the option -c
$ qualscan -c /pathTo/MyConfigFile.json

Reporters

By default qualscan will use text reporter and display results in the console.
Allowed reporters:

  • text
  • json
  • json in console
qualscan --reporters json

By default the default path to store the report is: [workingDir]/report/qualscan_report.json

Define another report directory

qualscan --reporters json --reportPath "myCustomDir/"

To display json in console

qualscan --reporters json --reportPath ""

API

const qualscan = require('qualscan')
const report = await qualscan.run({
  tasks: ['code-duplication', 'project-size'],
  scripts: ['linter'],
  reporters: ['json'],
  reportPath: '' // return the report as JSON object
}, 'path/to/my/project')

Budget

The notion of budget comes from the Webperf budget principle.
With this powerful tool you can define your own thresholds for each plugin.
The principle is the following:

  • for each plugin, define your thresholds: fail, warn or info
  • for each threshold set a value for every metrics

Example in config file (for project's size plugin):

{
  "project-size": {
    "budget": {
      "fail": {
        "entryCount": 150,
        "size": 3000000,
        "unpackedSize": 60000000
      },
      "warn": {
        "entryCount": 100,
        "size": 300000,
        "unpackedSize": 6000000
      }
    }
  }
}

Basic budgets output: Budgets example

For a task:

  • successful: if fail threshold has not been exceeded
  • otherwise the task has failed

For a threshold:

  • successful if all metrics are under their maximum value
  • otherwise it has failed

So a task can lead to an error, a warning or an information.
Thresholds can only be passed or failed.

Budgets errors example

List of all metrics per plugin

PluginKeyMetricUnit
Code duplicationcode-duplicationpercentageTokenspercentage of duplicated tokens
percentagepercentage of duplicated lines
Exact versiondependencies-exact-versiondependenciesnumber of range version in dependencies
devDependenciesnumber of range version in dev dependencies
Security auditsecurity-auditcriticalnumber of critical vulnerabilities
highnumber of high vulnerabilities
moderatenumber of moderate vulnerabilities
lownumber of low vulnerabilities
infonumber of info
Project's sizeproject-sizeentryCountnumber of files
sizesize in bytes (only files in final bundle)
unpackedSizeunpacked size in bytes (only files in final bundle)
Dependencies updatesupdatesmajornumber of major updates
minornumber of minor updates
patchnumber of patch
Check dependenciesdependencies-checkmissingnumber of missing dependencies
dependenciesnumber of unused dependencies
devDependenciesnumber of unused dev dependencies
Dependencies sizedependencies-sizedependenciesnumber of all dependencies
directDependenciesnumber of direct dependencies
weighttotal weight of node_modules folder (production)
depthmaximum dependencies tree's depth (production)
Require timerequire-timeentrypointTimeloading time of the entrypoint : require('myModule')

CI/CD

Qualscan can be easily integrated with any CI pipeline.
You can look at this basic example with github actions.

To see a typical output you can have a look at this page: actions page, and click on step "run the qualscan tool".

Basic CI output with Github actions: CI example

Compatibility

VersionSupportedTested
14.xyesyes
12.xyesyes

Test

$ npm test

Run with coverage

$ npm run coverage

Coverage report can be found in coverage/.

License

MIT

Rate & Review

Great Documentation0
Easy to Use0
Performant0
Highly Customizable0
Bleeding Edge0
Responsive Maintainers0
Poor Documentation0
Hard to Use0
Slow0
Buggy0
Abandoned0
Unwelcoming Community0
100