getDIFCProxyToIntegrityProxyCodemod creates a codemod that migrates the deprecated 'features.difc-proxy' flag to the new 'tools.github.integrity-proxy' field. Migration rules: - features.difc-proxy: true → remove from features (proxy is enabled by default) - features.difc-proxy: false → remove fro
()
| 16 | // - features.difc-proxy: false → remove from features AND add |
| 17 | // tools.github.integrity-proxy: false (to preserve the opt-out intent) |
| 18 | func getDIFCProxyToIntegrityProxyCodemod() Codemod { |
| 19 | return Codemod{ |
| 20 | ID: "features-difc-proxy-to-tools-github", |
| 21 | Name: "Migrate 'features.difc-proxy' to 'tools.github.integrity-proxy'", |
| 22 | Description: "Removes the deprecated 'features.difc-proxy' flag. The DIFC proxy is now enabled by default when guard policies are configured. If the flag was set to false, adds 'tools.github.integrity-proxy: false' to preserve the opt-out.", |
| 23 | IntroducedIn: "1.0.0", |
| 24 | Apply: func(content string, frontmatter map[string]any) (string, bool, error) { |
| 25 | // Check if features.difc-proxy exists |
| 26 | flagValue, hasDIFCProxy := getDIFCProxyFlagValue(frontmatter) |
| 27 | if !hasDIFCProxy { |
| 28 | return content, false, nil |
| 29 | } |
| 30 | |
| 31 | // Determine if we need to add integrity-proxy: false to tools.github |
| 32 | addDisableFlag := !flagValue && hasToolsGithubMap(frontmatter) |
| 33 | |
| 34 | newContent, applied, err := applyFrontmatterLineTransform(content, func(lines []string) ([]string, bool) { |
| 35 | // Step 1: remove features.difc-proxy |
| 36 | result, modified := removeFieldFromBlock(lines, "difc-proxy", "features") |
| 37 | if !modified { |
| 38 | return lines, false |
| 39 | } |
| 40 | difcProxyCodemodLog.Print("Removed features.difc-proxy") |
| 41 | |
| 42 | // Step 2: add integrity-proxy: false to tools.github if needed |
| 43 | if addDisableFlag { |
| 44 | result = addIntegrityProxyFalseToToolsGitHub(result) |
| 45 | } |
| 46 | |
| 47 | return result, true |
| 48 | }) |
| 49 | if applied { |
| 50 | if addDisableFlag { |
| 51 | difcProxyCodemodLog.Print("Migrated features.difc-proxy: false → tools.github.integrity-proxy: false") |
| 52 | } else { |
| 53 | difcProxyCodemodLog.Print("Removed features.difc-proxy: true (proxy is now enabled by default)") |
| 54 | } |
| 55 | } |
| 56 | return newContent, applied, err |
| 57 | }, |
| 58 | } |
| 59 | } |
| 60 | |
| 61 | // getDIFCProxyFlagValue returns the boolean value of features.difc-proxy and whether it exists. |
| 62 | // Note: string values are checked case-insensitively; "false" returns false, any other non-empty |