add tests and docs

src/config.ts

@@ -33,7 +33,8 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   const allow_dependencies_licenses = parseList(
     getOptionalInput('allow-dependencies-licenses')
   )
-  const deny_list = parseList(getOptionalInput('deny-list'))
+  const deny_packages = parseList(getOptionalInput('deny-packages'))
+  const deny_groups = parseList(getOptionalInput('deny-groups'))
   const allow_ghsas = parseList(getOptionalInput('allow-ghsas'))
   const license_check = getOptionalBoolean('license-check')
   const vulnerability_check = getOptionalBoolean('vulnerability-check')
@@ -50,7 +51,8 @@ function readInlineConfig(): ConfigurationOptionsPartial {
     fail_on_scopes,
     allow_licenses,
     deny_licenses,
-    deny_list,
+    deny_packages,
+    deny_groups,
     allow_dependencies_licenses,
     allow_ghsas,
     license_check,
@@ -139,7 +141,9 @@ function parseConfigFile(configData: string): ConfigurationOptionsPartial {
       'deny-licenses',
       'fail-on-scopes',
       'allow-ghsas',
-      'allow-dependencies-licenses'
+      'allow-dependencies-licenses',
+      'deny-packages',
+      'deny-groups'
     ]
 
     for (const key of Object.keys(data)) {

src/deny.ts

@@ -3,7 +3,8 @@ import * as core from '@actions/core'
 
 export async function getDeniedChanges(
   changes: Change[],
-  deniedList: string[]
+  deniedPackages: string[],
+  deniedGroups: string[]
 ): Promise<Change[]> {
   const changesDenied: Change[] = []
 
@@ -12,10 +13,21 @@ export async function getDeniedChanges(
     change.name = change.name.toLowerCase()
     change.package_url = change.package_url.toLowerCase()
 
-    for (const denied of deniedList) {
-      if (change.name.includes(denied)) {
-        changesDenied.push(change)
-        failed = true
+    if (deniedPackages) {
+      for (const denied of deniedPackages) {
+        if (change.name === denied.toLowerCase()) {
+          changesDenied.push(change)
+          failed = true
+        }
+      }
+    }
+
+    if (deniedGroups) {
+      for (const denied of deniedGroups) {
+        if (change.name.startsWith(denied.toLowerCase())) {
+          changesDenied.push(change)
+          failed = true
+        }
       }
     }
   }

src/main.ts

@@ -16,7 +16,7 @@ import {getRefs} from './git-refs'
 
 import {groupDependenciesByManifest} from './utils'
 import {commentPr} from './comment-pr'
-import {getDeniedChanges} from './denylist'
+import {getDeniedChanges} from './deny'
 
 async function run(): Promise<void> {
   try {
@@ -66,13 +66,10 @@ async function run(): Promise<void> {
 
     const deniedChanges = await getDeniedChanges(
       filteredChanges,
-      config.deny_list
+      config.deny_packages,
+      config.deny_groups
     )
 
-    core.debug(`config: ${JSON.stringify(config)}`)
-    core.debug(`filteredChanges: ${JSON.stringify(filteredChanges)}`)
-    core.debug(`deniedChanges: ${JSON.stringify(deniedChanges)}`)
-
     summary.addSummaryToSummary(
       vulnerableChanges,
       invalidLicenseChanges,
@@ -92,7 +89,7 @@ async function run(): Promise<void> {
       summary.addLicensesToSummary(invalidLicenseChanges, config)
       printLicensesBlock(invalidLicenseChanges)
     }
-    if (config.deny_list) {
+    if (config.deny_packages || config.deny_groups) {
       summary.addDeniedToSummary(deniedChanges)
       printDeniedDependencies(deniedChanges, config)
     }
@@ -259,7 +256,7 @@ function printDeniedDependencies(
   config: ConfigurationOptions
 ): void {
   core.group('Denied', async () => {
-    for (const denied of config.deny_list) {
+    for (const denied of config.deny_packages) {
       core.info(`Config: ${denied}`)
     }
 

src/schemas.ts

@@ -42,7 +42,8 @@ export const ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).optional(),
     allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
-    deny_list: z.array(z.string()).default([]),
+    deny_packages: z.array(z.string()).default([]),
+    deny_groups: z.array(z.string()).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),
     config_file: z.string().optional(),