feat: add bun.lock scanning support

- Support text-based bun.lock format (Bun v1.2+)
- Parse scoped packages correctly (@scope/package)
- Add 6 new test cases for bun.lock
- Update documentation with lockfile support details

Author: Prince Tripathi

.github/workflows/ci.yml

@@ -12,46 +12,59 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [18.x, 20.x]
+        node-version: [18.x, 20.x, 22.x]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ matrix.node-version }}
 
-    - name: Test CLI Commands
+    - name: Verify CLI Commands
       run: |
-        # Test version
+        # Test version (must succeed)
         node bin/cli.mjs --version
         
-        # Test help
+        # Test help (must succeed)
         node bin/cli.mjs --help
         
-        # Test status
+        # Test status (must succeed)
         node bin/cli.mjs status
-        
-        # Test scan (safe package)
-        node bin/cli.mjs scan express --logMode=quiet || true
-        
-        # Test list
-        node bin/cli.mjs list --logMode=quiet || true
     
-    - name: Test Scan Commands
+    - name: Test Safe Package Scan
       run: |
-        # Create test package.json
-        echo '{"name":"test","version":"1.0.0","dependencies":{"express":"^4.18.0"}}' > package.json
-        
-        # Test scanning package.json
-        node bin/cli.mjs scan package.json --logMode=quiet || true
-        
-        # Test scanning lockfile (if exists)
-        if [ -f package-lock.json ]; then
-          node bin/cli.mjs scan package-lock.json --logMode=quiet || true
+        # Scan safe package (should pass, exit 0)
+        node bin/cli.mjs scan lodash@4.17.21 --skipNpmAudit=true --enableOsv=false --enableGitHub=false --logMode=quiet
+    
+    - name: Test Compromised Package Detection
+      run: |
+        # Scan compromised package (should fail, exit 1)
+        if node bin/cli.mjs scan get-them-args@1.3.3 --skipNpmAudit=true --enableOsv=false --enableGitHub=false --logMode=quiet 2>&1; then
+          echo "ERROR: Compromised package was NOT blocked!"
+          exit 1
+        else
+          echo "SUCCESS: Compromised package was correctly blocked"
         fi
+    
+    - name: Test List Command
+      run: |
+        # List compromised packages (must succeed)
+        node bin/cli.mjs list --logMode=quiet
+    
+    - name: Test Repository Scan
+      run: |
+        # Create test package.json with safe dependencies
+        mkdir -p test-repo
+        echo '{"name":"test","version":"1.0.0","dependencies":{"lodash":"4.17.21"}}' > test-repo/package.json
+        
+        # Scan test repository (should pass)
+        node bin/cli.mjs scan test-repo --skipNpmAudit=true --enableOsv=false --enableGitHub=false --logMode=quiet
         
-        # Test scanning repository
-        node bin/cli.mjs scan --logMode=quiet || true
+        # Cleanup
+        rm -rf test-repo
+    
+    - name: Run Smoke Tests
+      run: npm run test:smoke
 

CONTRIBUTING.md

@@ -5,7 +5,7 @@ Thank you for your interest in contributing! This document provides guidelines f
 ## Getting Started
 
 1. Fork the repository
-2. Clone your fork: `git clone <your-fork-url>`
+2. Clone your fork: `git clone https://github.com/YOUR-USERNAME/sentinel.git`
 3. Create a branch: `git checkout -b feature/your-feature-name`
 4. Make your changes
 5. Test your changes
@@ -15,7 +15,7 @@ Thank you for your interest in contributing! This document provides guidelines f
 
 ```bash
 # Clone the repository
-git clone <repository-url>
+git clone https://github.com/ds-horizon/sentinel.git
 cd sentinel
 
 # No dependencies needed - uses only Node.js built-ins
@@ -26,15 +26,19 @@ cd sentinel
 
 ```bash
 # Run comprehensive test suite (recommended)
-npm test
+npm test                      # Host + local source
 
-# Or run from tests folder
-./tests/test.sh
+# Docker testing (safe isolation)
+npm run test:docker           # Docker + local source
+npm run test:docker:npm       # Docker + npm package
 
 # Quick smoke tests
 npm run test:smoke
 
-# All tests are automated - see tests/README.md for details
+# Or directly from sample-test-repo/
+./tests/test.sh               # Host + local source
+./tests/test.sh --docker      # Docker + local source
+./tests/test.sh --docker --npm # Docker + npm package
 ```
 
 ## Code Style

README.md

@@ -45,7 +45,7 @@ Sentinel Package Manager is the **ONLY tool** that blocks compromised packages *
 |--------|----------|---------|
 | **npm Global** | Individual developers | `npm install -g sentinel` |
 | **Dev Dependency** | Team projects, CI/CD | `npm install --save-dev sentinel` |
-| **Git Clone** | Development, contributing | `git clone <repo> && ./bin/install.sh` |
+| **Git Clone** | Development, contributing | `git clone https://github.com/ds-horizon/sentinel.git && cd sentinel && ./bin/install.sh` |
 
 ---
 
@@ -91,7 +91,7 @@ npx sentinel scan
 ### Option 3: Git Clone & Install (Manual Setup)
 ```bash
 # Clone and install
-git clone <repository-url>
+git clone https://github.com/ds-horizon/sentinel.git
 cd sentinel
 ./bin/install.sh
 
@@ -115,12 +115,14 @@ yarn add package-name
 
 ## 📋 Supported Package Managers
 
-| Package Manager | Support | Auto-Validation |
-|----------------|---------|-----------------|
-| **npm** | ✅ Full | ✅ Yes |
-| **yarn** | ✅ Full | ✅ Yes |
-| **pnpm** | ✅ Full | ✅ Yes |
-| **bun** | ✅ Full | ✅ Yes |
+| Package Manager | Support | Auto-Validation | Lockfile Scanning |
+|----------------|---------|-----------------|-------------------|
+| **npm** | ✅ Full | ✅ Yes | ✅ `package-lock.json` |
+| **yarn** | ✅ Full | ✅ Yes | ✅ `yarn.lock` (v1 + v4) |
+| **pnpm** | ✅ Full | ✅ Yes | ✅ `pnpm-lock.yaml` (v5 + v6) |
+| **bun** | ✅ Full | ✅ Yes | ✅ `bun.lock` (v1.2+) |
+
+> **Note:** Bun's binary lockfile (`bun.lockb`) is not supported. Use the text-based `bun.lock` format (default in Bun v1.2+) or run `bun install --save-text-lockfile` to migrate.
 
 ## ✨ Key Features