From 6c5425e69c8b97a9e083642a3c1f1109b85165ce Mon Sep 17 00:00:00 2001
From: VitoAlbano <vito.albano@hyland.com>
Date: Tue, 2 Jun 2026 19:11:13 +0100
Subject: [PATCH] [ci:force] - Fixed sonar comments and added correct version
 to sha pinned action

---
 .github/actions/setup/action.yml     |  2 +-
 scripts/security/lockfile-parser.mjs | 38 ++++++++++++++++++++++------
 2 files changed, 31 insertions(+), 9 deletions(-)

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index c309693b5e..81cb0c4c37 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -34,7 +34,7 @@ runs:
         shell: bash
         run: echo "nx-github-actions" | sudo tee /etc/machine-id > /dev/null
       - name: Setup pnpm
-        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
diff --git a/scripts/security/lockfile-parser.mjs b/scripts/security/lockfile-parser.mjs
index 7d95e8a0aa..6a51511cbd 100644
--- a/scripts/security/lockfile-parser.mjs
+++ b/scripts/security/lockfile-parser.mjs
@@ -54,8 +54,9 @@ function parsePackageFromDiffLine(line) {
     }
 
     const isScoped = fullPath.startsWith('@');
+    const lastAtIndex = fullPath.lastIndexOf('@');
     const packageName = isScoped
-        ? fullPath.replace(/@[^/]+$/, '')
+        ? fullPath.substring(0, lastAtIndex)
         : fullPath.split('@')[0];
 
     return { name: packageName, version: versionMatch[1] };
@@ -65,18 +66,39 @@ function parsePackageFromDiffLine(line) {
 // LOCKFILE READING
 // ============================================================================
 
+function extractPackagePathFromLine(line) {
+    const trimmed = line.trim();
+
+    if (!trimmed.startsWith("'/") && !trimmed.startsWith('/')) {
+        return null;
+    }
+
+    const startIndex = trimmed.indexOf('/') + 1;
+    const endQuoteIndex = trimmed.indexOf("'", startIndex);
+    const endParenIndex = trimmed.indexOf('(', startIndex);
+
+    let endIndex = trimmed.length;
+    if (endQuoteIndex > 0) endIndex = Math.min(endIndex, endQuoteIndex);
+    if (endParenIndex > 0) endIndex = Math.min(endIndex, endParenIndex);
+
+    return trimmed.substring(startIndex, endIndex);
+}
+
 export function readAllPackagesFromLockfile(lockfilePath) {
     try {
         const lockfileContent = readFileSync(lockfilePath, 'utf-8');
         const packages = [];
-        const packagePathRegex = /^\s+'?\/([^'(]+)'/gm;
+        const lines = lockfileContent.split('\n');
 
-        let match;
-        while ((match = packagePathRegex.exec(lockfileContent)) !== null) {
-            const parsedPackage = parsePackagePathEntry(match[1]);
+        for (const line of lines) {
+            const packagePath = extractPackagePathFromLine(line);
 
-            if (parsedPackage) {
-                packages.push(parsedPackage);
+            if (packagePath) {
+                const parsedPackage = parsePackagePathEntry(packagePath);
+
+                if (parsedPackage) {
+                    packages.push(parsedPackage);
+                }
             }
         }
 
@@ -88,7 +110,7 @@ export function readAllPackagesFromLockfile(lockfilePath) {
 
 export function readChangedPackagesFromGitDiff() {
     try {
-        const diffOutput = execSync('git diff --cached pnpm-lock.yaml', { encoding: 'utf-8' });
+        const diffOutput = execSync('/usr/bin/git diff --cached pnpm-lock.yaml', { encoding: 'utf-8' });
         const changedPackages = [];
         const diffLines = diffOutput.split('\n');