From 09c51e60b062b691dcb78e6b9f7c38a8128c14f8 Mon Sep 17 00:00:00 2001
From: afeez <afeezorobsco@gmail.com>
Date: Wed, 21 Oct 2026 06:58:49 +0100
Subject: [PATCH] fix(ci): scan Vue/Svelte/Astro/Go files as code, not as
 disguised payloads

The disguised-code rule flags JavaScript inside a file whose extension
isn't a known code type. .vue single-file components legitimately
contain <script> blocks, so docforum-core #207 was blocked by a false
positive. Add vue, svelte, astro, less, sass, go, mod and sum to the
text/code extension list; every line rule still runs on them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/scripts/pr-malware-scan.cjs         | 2 +-
 changelog.d/scanner-component-extensions.md | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/scanner-component-extensions.md

diff --git a/.github/scripts/pr-malware-scan.cjs b/.github/scripts/pr-malware-scan.cjs
index fdd0fc6c..c94892b7 100644
--- a/.github/scripts/pr-malware-scan.cjs
+++ b/.github/scripts/pr-malware-scan.cjs
@@ -32,7 +32,7 @@ const POPULAR_PACKAGES = [
   'workbox-core', 'vite-plugin-pwa', 'msw', 'supertest', 'zxcvbn', 'otplib', 'speakeasy', 'nodemailer',
 ];
 
-const TEXT_EXT = /\.(c|m)?(j|t)sx?$|\.(json|jsonc|md|mdx|rs|toml|ya?ml|css|scss|html|sql|prisma|lock|svg|txt|snap|sh|py|graphql|spec|example|env|xml|csv|ini|cfg|conf|dict|gitignore|gitattributes|editorconfig|nvmrc|npmrc|dockerignore|mts|cts)$/i;
+const TEXT_EXT = /\.(c|m)?(j|t)sx?$|\.(json|jsonc|md|mdx|rs|toml|ya?ml|css|scss|html|sql|prisma|lock|svg|txt|snap|sh|py|graphql|spec|example|env|xml|csv|ini|cfg|conf|dict|gitignore|gitattributes|editorconfig|nvmrc|npmrc|dockerignore|mts|cts|vue|svelte|astro|less|sass|go|mod|sum)$/i;
 const MEDIA_EXT = /\.(woff2?|ttf|otf|eot|png|jpe?g|gif|ico|webp|bmp|pdf|mp3|mp4|wav|zip|gz|tgz|wasm)$/i;
 const DOC_EXT = /\.(md|mdx|txt)$/i;
 const GENERATED = /(^|\/)(package-lock\.json|Cargo\.lock|yarn\.lock|pnpm-lock\.yaml)$|(^|\/)test_snapshots\/|(^|\/)generated\/|\.snap$|\.min\.(js|css)$|\.svg$/;
diff --git a/changelog.d/scanner-component-extensions.md b/changelog.d/scanner-component-extensions.md
new file mode 100644
index 00000000..d7d72c84
--- /dev/null
+++ b/changelog.d/scanner-component-extensions.md
@@ -0,0 +1,5 @@
+Malware scan: `.vue`, `.svelte`, `.astro`, `.less`, `.sass`, `.go`,
+`go.mod` and `go.sum` files are now scanned as code. Before this, a Vue
+single-file component was flagged HIGH as "disguised code" (JavaScript
+inside a file with a non-code extension), which wrongly blocked
+docforum-core #207. The same line rules still apply to these files.