Merge pull request #544 from adrienpessu/main

Add an option to deny packages or groups of packages

README.md

@@ -67,7 +67,7 @@ jobs:
 Configure this action by either inlining these options in your workflow file, or by using an external configuration file. All configuration options are optional.
 
 | Option                          | Usage                                                                                                                                                                             | Possible values                                                                                | Default value |
-| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------- |
+|---------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------|---------------|
 | `fail-on-severity`              | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher.              | `low`, `moderate`, `high`, `critical`                                                          | `low`         |
 | `allow-licenses`\*              | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list.                                  | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/)                                 | none          |
 | `deny-licenses`\*               | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list.                                      | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/)                                 | none          |
@@ -78,6 +78,8 @@ Configure this action by either inlining these options in your workflow file, or
 | `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks.                                                                                                            | Any package(s) in [purl](https://github.com/package-url/purl-spec) format                      | none          |
 | `base-ref`/`head-ref`           | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`.  | Any valid git ref(s) in your project                                                           | none          |
 | `comment-summary-in-pr`         | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`.                 | `true`, `false`                                                                                | `false`       |
+| `deny-packages`                 | Any number of packages to block in a PR.                                                                                                                                           | Package(s) in [purl](https://github.com/package-url/purl-spec) format            | empty         |
+| `deny-groups`                   | Any number of groups (namespaces) to block in a PR.                                                                                                                                   | Namespace(s) in [purl](https://github.com/package-url/purl-spec) format (no package name, no version number) | empty         |
 
 \*not supported for use with GitHub Enterprise Server
 

__tests__/deny.test.ts

@@ -0,0 +1,166 @@
+import {expect, jest, test} from '@jest/globals'
+import {Change, Changes} from '../src/schemas'
+
+let getDeniedChanges: Function
+
+const npmChange: Change = {
+  manifest: 'package.json',
+  change_type: 'added',
+  ecosystem: 'npm',
+  name: 'Reeuhq',
+  version: '1.0.2',
+  package_url: 'pkg:npm/[email protected]',
+  license: 'MIT',
+  source_repository_url: 'github.com/some-repo',
+  scope: 'runtime',
+  vulnerabilities: [
+    {
+      severity: 'critical',
+      advisory_ghsa_id: 'first-random_string',
+      advisory_summary: 'very dangerous',
+      advisory_url: 'github.com/future-funk'
+    }
+  ]
+}
+
+const rubyChange: Change = {
+  change_type: 'added',
+  manifest: 'Gemfile.lock',
+  ecosystem: 'rubygems',
+  name: 'actionsomething',
+  version: '3.2.0',
+  package_url: 'pkg:gem/[email protected]',
+  license: 'BSD',
+  source_repository_url: 'github.com/some-repo',
+  scope: 'runtime',
+  vulnerabilities: [
+    {
+      severity: 'moderate',
+      advisory_ghsa_id: 'second-random_string',
+      advisory_summary: 'not so dangerous',
+      advisory_url: 'github.com/future-funk'
+    },
+    {
+      severity: 'low',
+      advisory_ghsa_id: 'third-random_string',
+      advisory_summary: 'dont page me',
+      advisory_url: 'github.com/future-funk'
+    }
+  ]
+}
+
+const pipChange: Change = {
+  change_type: 'added',
+  manifest: 'requirements.txt',
+  ecosystem: 'pip',
+  name: 'package-1',
+  version: '1.1.1',
+  package_url: 'pkg:pip/[email protected]',
+  license: 'MIT',
+  source_repository_url: 'github.com/some-repo',
+  scope: 'runtime',
+  vulnerabilities: [
+    {
+      severity: 'moderate',
+      advisory_ghsa_id: 'second-random_string',
+      advisory_summary: 'not so dangerous',
+      advisory_url: 'github.com/future-funk'
+    },
+    {
+      severity: 'low',
+      advisory_ghsa_id: 'third-random_string',
+      advisory_summary: 'dont page me',
+      advisory_url: 'github.com/future-funk'
+    }
+  ]
+}
+
+const mvnChange: Change = {
+  change_type: 'added',
+  manifest: 'pom.xml',
+  ecosystem: 'maven',
+  name: 'org.apache.logging.log4j:log4j-core',
+  version: '2.15.0',
+  package_url: 'pkg:maven/org.apache.logging.log4j/[email protected]',
+  license: 'Apache-2.0',
+  source_repository_url:
+    'https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core',
+  scope: 'unknown',
+  vulnerabilities: [
+    {
+      severity: 'critical',
+      advisory_ghsa_id: 'second-random_string',
+      advisory_summary: 'not so dangerous',
+      advisory_url: 'github.com/future-funk'
+    }
+  ]
+}
+
+jest.mock('@actions/core')
+
+const mockOctokit = {
+  rest: {
+    licenses: {
+      getForRepo: jest
+        .fn()
+        .mockReturnValue({data: {license: {spdx_id: 'AGPL'}}})
+    }
+  }
+}
+
+jest.mock('octokit', () => {
+  return {
+    // eslint-disable-next-line @typescript-eslint/no-extraneous-class
+    Octokit: class {
+      constructor() {
+        return mockOctokit
+      }
+    }
+  }
+})
+
+beforeEach(async () => {
+  jest.resetModules()
+  jest.doMock('spdx-satisfies', () => {
+    // mock spdx-satisfies return value
+    // true for BSD, false for all others
+    return jest.fn((license: string, _: string): boolean => license === 'BSD')
+  })
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  ;({getDeniedChanges} = require('../src/deny'))
+})
+
+test('it adds packages in the deny packages list', async () => {
+  const changes: Changes = [npmChange, rubyChange]
+  const deniedChanges = await getDeniedChanges(
+    changes,
+    ['pkg:gem/actionsomething'],
+    []
+  )
+
+  expect(deniedChanges[0]).toBe(rubyChange)
+  expect(deniedChanges.length).toEqual(1)
+})
+
+test('it adds packages in the deny group list', async () => {
+  const changes: Changes = [mvnChange, rubyChange]
+  const deniedChanges = await getDeniedChanges(
+    changes,
+    [],
+    ['pkg:maven/org.apache.logging.log4j']
+  )
+
+  expect(deniedChanges[0]).toBe(mvnChange)
+  expect(deniedChanges.length).toEqual(1)
+})
+
+test('it adds packages outside of the deny lists', async () => {
+  const changes: Changes = [npmChange, pipChange]
+  const deniedChanges = await getDeniedChanges(
+    changes,
+    ['pkg:gem/actionsomething'],
+    ['pkg:maven:org.apache.logging.log4j']
+  )
+
+  expect(deniedChanges.length).toEqual(0)
+})

__tests__/summary.test.ts

@@ -24,6 +24,8 @@ const defaultConfig: ConfigurationOptions = {
   allow_ghsas: [],
   allow_licenses: [],
   deny_licenses: [],
+  deny_packages: [],
+  deny_groups: [],
   comment_summary_in_pr: true
 }
 
@@ -70,6 +72,7 @@ test('prints headline as h1', () => {
   summary.addSummaryToSummary(
     emptyChanges,
     emptyInvalidLicenseChanges,
+    emptyChanges,
     defaultConfig
   )
   const text = core.summary.stringify()
@@ -81,6 +84,7 @@ test('only includes "No vulnerabilities or license issues found"-message if both
   summary.addSummaryToSummary(
     emptyChanges,
     emptyInvalidLicenseChanges,
+    emptyChanges,
     defaultConfig
   )
   const text = core.summary.stringify()
@@ -90,7 +94,12 @@ test('only includes "No vulnerabilities or license issues found"-message if both
 
 test('only includes "No vulnerabilities found"-message if "license_check" is set to false and nothing was found', () => {
   const config = {...defaultConfig, license_check: false}
-  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, config)
+  summary.addSummaryToSummary(
+    emptyChanges,
+    emptyInvalidLicenseChanges,
+    emptyChanges,
+    config
+  )
   const text = core.summary.stringify()
 
   expect(text).toContain('✅ No vulnerabilities found.')
@@ -98,7 +107,12 @@ test('only includes "No vulnerabilities found"-message if "license_check" is set
 
 test('only includes "No license issues found"-message if "vulnerability_check" is set to false and nothing was found', () => {
   const config = {...defaultConfig, vulnerability_check: false}
-  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, config)
+  summary.addSummaryToSummary(
+    emptyChanges,
+    emptyInvalidLicenseChanges,
+    emptyChanges,
+    config
+  )
   const text = core.summary.stringify()
 
   expect(text).toContain('✅ No license issues found.')
@@ -108,6 +122,7 @@ test('groups dependencies with empty manifest paths together', () => {
   summary.addSummaryToSummary(
     changesWithEmptyManifests,
     emptyInvalidLicenseChanges,
+    emptyChanges,
     defaultConfig
   )
   summary.addScannedDependencies(changesWithEmptyManifests)
@@ -124,6 +139,7 @@ test('does not include status section if nothing was found', () => {
   summary.addSummaryToSummary(
     emptyChanges,
     emptyInvalidLicenseChanges,
+    emptyChanges,
     defaultConfig
   )
   const text = core.summary.stringify()
@@ -142,7 +158,12 @@ test('includes count and status icons for all findings', () => {
     unlicensed: [createTestChange(), createTestChange(), createTestChange()]
   }
 
-  summary.addSummaryToSummary(vulnerabilities, licenseIssues, defaultConfig)
+  summary.addSummaryToSummary(
+    vulnerabilities,
+    licenseIssues,
+    emptyChanges,
+    defaultConfig
+  )
 
   const text = core.summary.stringify()
   expect(text).toContain('❌ 2 vulnerable package(s)')
@@ -159,6 +180,7 @@ test('uses checkmarks for license issues if only vulnerabilities were found', ()
   summary.addSummaryToSummary(
     vulnerabilities,
     emptyInvalidLicenseChanges,
+    emptyChanges,
     defaultConfig
   )
 
@@ -178,7 +200,12 @@ test('uses checkmarks for vulnerabilities if only license issues were found', ()
     unlicensed: []
   }
 
-  summary.addSummaryToSummary(emptyChanges, licenseIssues, defaultConfig)
+  summary.addSummaryToSummary(
+    emptyChanges,
+    licenseIssues,
+    emptyChanges,
+    defaultConfig
+  )
 
   const text = core.summary.stringify()
   expect(text).toContain('✅ 0 vulnerable package(s)')

action.yml

@@ -47,6 +47,12 @@ inputs:
   comment-summary-in-pr:
     description: A boolean to determine if the report should be posted as a comment in the PR itself. Setting this to true requires you to give the workflow the write permissions for pull-requests
     required: false
+  deny-packages:
+    description: A comma-separated list of package URLs to deny (e.g. "pkg:npm/express, pkg:pip/pycrypto")
+    required: false
+  deny-groups:
+    description: A comma-separated list of package URLs for group(s)/namespace(s) to deny (e.g. "pkg:npm/express, pkg:pip/pycrypto")
+    required: false
 runs:
   using: 'node16'
   main: 'dist/index.js'

dist/index.js

@@ -135,6 +135,84 @@ function findCommentByMarker(commentBodyIncludes) {
 }
 
 
+/***/ }),
+
+/***/ 2134:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getDeniedChanges = void 0;
+const core = __importStar(__nccwpck_require__(2186));
+function getDeniedChanges(changes, deniedPackages, deniedGroups) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const changesDenied = [];
+        let failed = false;
+        for (const change of changes) {
+            change.name = change.name.toLowerCase();
+            const packageUrl = change.package_url.toLowerCase().split('@')[0];
+            if (deniedPackages) {
+                for (const denied of deniedPackages) {
+                    if (packageUrl === denied.split('@')[0].toLowerCase()) {
+                        changesDenied.push(change);
+                        failed = true;
+                    }
+                }
+            }
+            if (deniedGroups) {
+                for (const denied of deniedGroups) {
+                    if (packageUrl.startsWith(denied.toLowerCase())) {
+                        changesDenied.push(change);
+                        failed = true;
+                    }
+                }
+            }
+        }
+        if (failed) {
+            core.setFailed('Dependency review detected denied packages.');
+        }
+        else {
+            core.info('Dependency review did not detect any denied packages');
+        }
+        return changesDenied;
+    });
+}
+exports.getDeniedChanges = getDeniedChanges;
+
+
 /***/ }),
 
 /***/ 4966:
@@ -485,6 +563,7 @@ const summary = __importStar(__nccwpck_require__(8608));
 const git_refs_1 = __nccwpck_require__(1086);
 const utils_1 = __nccwpck_require__(918);
 const comment_pr_1 = __nccwpck_require__(5842);
+const deny_1 = __nccwpck_require__(2134);
 function run() {
     return __awaiter(this, void 0, void 0, function* () {
         try {
@@ -513,7 +592,10 @@ function run() {
                 deny: config.deny_licenses,
                 licenseExclusions: config.allow_dependencies_licenses
             });
-            summary.addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, config);
+            core.debug(`Filtered Changes: ${JSON.stringify(filteredChanges)}`);
+            core.debug(`Config Deny Packages: ${JSON.stringify(config)}`);
+            const deniedChanges = yield (0, deny_1.getDeniedChanges)(filteredChanges, config.deny_packages, config.deny_groups);
+            summary.addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, deniedChanges, config);
             if (snapshot_warnings) {
                 summary.addSnapshotWarnings(snapshot_warnings);
             }
@@ -525,6 +607,10 @@ function run() {
                 summary.addLicensesToSummary(invalidLicenseChanges, config);
                 printLicensesBlock(invalidLicenseChanges);
             }
+            if (config.deny_packages || config.deny_groups) {
+                summary.addDeniedToSummary(deniedChanges);
+                printDeniedDependencies(deniedChanges, config);
+            }
             summary.addScannedDependencies(changes);
             printScannedDependencies(changes);
             if (config.comment_summary_in_pr) {
@@ -640,6 +726,17 @@ function printScannedDependencies(changes) {
         }
     }));
 }
+function printDeniedDependencies(changes, config) {
+    core.group('Denied', () => __awaiter(this, void 0, void 0, function* () {
+        for (const denied of config.deny_packages) {
+            core.info(`Config: ${denied}`);
+        }
+        for (const change of changes) {
+            core.info(`Change: ${change.name}@${change.version} is denied`);
+            core.info(`Change: ${change.package_url} is denied`);
+        }
+    }));
+}
 run();
 
 
@@ -712,6 +809,8 @@ exports.ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).optional(),
     allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
+    deny_packages: z.array(z.string()).default([]),
+    deny_groups: z.array(z.string()).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),
     config_file: z.string().optional(),
@@ -778,7 +877,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.addSnapshotWarnings = exports.addScannedDependencies = exports.addLicensesToSummary = exports.addChangeVulnerabilitiesToSummary = exports.addSummaryToSummary = void 0;
+exports.addDeniedToSummary = exports.addSnapshotWarnings = exports.addScannedDependencies = exports.addLicensesToSummary = exports.addChangeVulnerabilitiesToSummary = exports.addSummaryToSummary = void 0;
 const core = __importStar(__nccwpck_require__(2186));
 const utils_1 = __nccwpck_require__(918);
 const icons = {
@@ -786,10 +885,11 @@ const icons = {
     cross: '❌',
     warning: '⚠️'
 };
-function addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, config) {
+function addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, deniedChanges, config) {
     core.summary.addHeading('Dependency Review', 1);
     if (vulnerableChanges.length === 0 &&
-        countLicenseIssues(invalidLicenseChanges) === 0) {
+        countLicenseIssues(invalidLicenseChanges) === 0 &&
+        deniedChanges.length === 0) {
         if (!config.license_check) {
             core.summary.addRaw(`${icons.check} No vulnerabilities found.`);
         }
@@ -815,6 +915,11 @@ function addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, config) {
                 `${checkOrFailIcon(invalidLicenseChanges.unresolved.length)} ${invalidLicenseChanges.unresolved.length} package(s) with invalid SPDX license definitions`,
                 `${checkOrWarnIcon(invalidLicenseChanges.unlicensed.length)} ${invalidLicenseChanges.unlicensed.length} package(s) with unknown licenses.`
             ]
+            : []),
+        ...(deniedChanges.length > 0
+            ? [
+                `${checkOrWarnIcon(deniedChanges.length)} ${deniedChanges.length} package(s) denied.`
+            ]
             : [])
     ])
         .addRaw('See the Details below.');
@@ -956,6 +1061,24 @@ exports.addSnapshotWarnings = addSnapshotWarnings;
 function countLicenseIssues(invalidLicenseChanges) {
     return Object.values(invalidLicenseChanges).reduce((acc, val) => acc + val.length, 0);
 }
+function addDeniedToSummary(deniedChanges) {
+    if (deniedChanges.length === 0) {
+        return;
+    }
+    core.summary.addHeading('Denied dependencies', 2);
+    for (const change of deniedChanges) {
+        core.summary.addHeading(`<em>Denied dependencies</em>`, 4);
+        core.summary.addTable([
+            ['Package', 'Version', 'License'],
+            [
+                (0, utils_1.renderUrl)(change.source_repository_url, change.name),
+                change.version,
+                change.license || ''
+            ]
+        ]);
+    }
+}
+exports.addDeniedToSummary = addDeniedToSummary;
 function checkOrFailIcon(count) {
     return count === 0 ? icons.check : icons.cross;
 }
@@ -47821,6 +47944,8 @@ function readInlineConfig() {
     const allow_licenses = parseList(getOptionalInput('allow-licenses'));
     const deny_licenses = parseList(getOptionalInput('deny-licenses'));
     const allow_dependencies_licenses = parseList(getOptionalInput('allow-dependencies-licenses'));
+    const deny_packages = parseList(getOptionalInput('deny-packages'));
+    const deny_groups = parseList(getOptionalInput('deny-groups'));
     const allow_ghsas = parseList(getOptionalInput('allow-ghsas'));
     const license_check = getOptionalBoolean('license-check');
     const vulnerability_check = getOptionalBoolean('vulnerability-check');
@@ -47835,6 +47960,8 @@ function readInlineConfig() {
         fail_on_scopes,
         allow_licenses,
         deny_licenses,
+        deny_packages,
+        deny_groups,
         allow_dependencies_licenses,
         allow_ghsas,
         license_check,
@@ -47905,7 +48032,9 @@ function parseConfigFile(configData) {
             'deny-licenses',
             'fail-on-scopes',
             'allow-ghsas',
-            'allow-dependencies-licenses'
+            'allow-dependencies-licenses',
+            'deny-packages',
+            'deny-groups'
         ];
         for (const key of Object.keys(data)) {
             // strings can contain list values (e.g. 'MIT, Apache-2.0'). In this
@@ -48119,6 +48248,8 @@ exports.ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).optional(),
     allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
+    deny_packages: z.array(z.string()).default([]),
+    deny_groups: z.array(z.string()).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),
     config_file: z.string().optional(),

docs/examples.md

@@ -230,3 +230,31 @@ jobs:
           comment-summary-in-pr: true
           license-check: false
 ```
+
+## Exclude dependencies from their name or groups
+
+Using the `deny-packages` option you can exclude dependencies by their PURL. You can add multiple values separated by a commas.
+Using the `deny-groups` option you can exclude dependencies by their group name/namespace. You can add multiple values separated by a comma.
+
+In this example, we are excluding `pkg:maven/org.apache.logging.log4j:log4j-api` and `pkg:maven/org.apache.logging.log4j/log4j-core` from `maven` and all packages in the group `pkg:maven/com.bazaarvoice.maven`
+
+```yaml
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@v3
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@v3
+        with:
+          deny-packages: 'pkg:maven/org.apache.logging.log4j/log4j-api,pkg:maven/org.apache.logging.log4j/log4j-core'
+          deny-groups: 'pkg:maven/com.bazaarvoice.jolt'
+```

scripts/create_summary.ts

@@ -6,7 +6,7 @@
  * npx ts-node scripts/create_summary.ts
  */
 
-import {Changes, ConfigurationOptions} from '../src/schemas'
+import {Change, Changes, ConfigurationOptions} from '../src/schemas'
 import {createTestChange} from '../__tests__/fixtures/create-test-change'
 import {InvalidLicenseChanges} from '../src/licenses'
 import * as fs from 'fs'
@@ -22,6 +22,8 @@ const defaultConfig: ConfigurationOptions = {
   allow_ghsas: [],
   allow_licenses: ['MIT'],
   deny_licenses: [],
+  deny_packages: [],
+  deny_groups: [],
   allow_dependencies_licenses: [
     'pkg:npm/[email protected]',
     'pkg:pip/requests',
@@ -44,6 +46,7 @@ const createNonIssueSummary = async (): Promise<void> => {
   await createSummary(
     [],
     {forbidden: [], unresolved: [], unlicensed: []},
+    [],
     defaultConfig,
     'non-issue-summary.md'
   )
@@ -85,16 +88,17 @@ const createFullSummary = async (): Promise<void> => {
     ]
   }
 
-  await createSummary(changes, licenses, defaultConfig, 'full-summary.md')
+  await createSummary(changes, licenses, [], defaultConfig, 'full-summary.md')
 }
 
 async function createSummary(
   vulnerabilities: Changes,
   licenseIssues: InvalidLicenseChanges,
+  denied: Change[],
   config: ConfigurationOptions,
   fileName: string
 ): Promise<void> {
-  summary.addSummaryToSummary(vulnerabilities, licenseIssues, config)
+  summary.addSummaryToSummary(vulnerabilities, licenseIssues, denied, config)
   summary.addChangeVulnerabilitiesToSummary(
     vulnerabilities,
     config.fail_on_severity

src/config.ts

@@ -33,6 +33,8 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   const allow_dependencies_licenses = parseList(
     getOptionalInput('allow-dependencies-licenses')
   )
+  const deny_packages = parseList(getOptionalInput('deny-packages'))
+  const deny_groups = parseList(getOptionalInput('deny-groups'))
   const allow_ghsas = parseList(getOptionalInput('allow-ghsas'))
   const license_check = getOptionalBoolean('license-check')
   const vulnerability_check = getOptionalBoolean('vulnerability-check')
@@ -49,6 +51,8 @@ function readInlineConfig(): ConfigurationOptionsPartial {
     fail_on_scopes,
     allow_licenses,
     deny_licenses,
+    deny_packages,
+    deny_groups,
     allow_dependencies_licenses,
     allow_ghsas,
     license_check,
@@ -137,7 +141,9 @@ function parseConfigFile(configData: string): ConfigurationOptionsPartial {
       'deny-licenses',
       'fail-on-scopes',
       'allow-ghsas',
-      'allow-dependencies-licenses'
+      'allow-dependencies-licenses',
+      'deny-packages',
+      'deny-groups'
     ]
 
     for (const key of Object.keys(data)) {

src/deny.ts

@@ -0,0 +1,42 @@
+import {Change} from './schemas'
+import * as core from '@actions/core'
+
+export async function getDeniedChanges(
+  changes: Change[],
+  deniedPackages: string[],
+  deniedGroups: string[]
+): Promise<Change[]> {
+  const changesDenied: Change[] = []
+
+  let failed = false
+  for (const change of changes) {
+    change.name = change.name.toLowerCase()
+    const packageUrl = change.package_url.toLowerCase().split('@')[0]
+
+    if (deniedPackages) {
+      for (const denied of deniedPackages) {
+        if (packageUrl === denied.split('@')[0].toLowerCase()) {
+          changesDenied.push(change)
+          failed = true
+        }
+      }
+    }
+
+    if (deniedGroups) {
+      for (const denied of deniedGroups) {
+        if (packageUrl.startsWith(denied.toLowerCase())) {
+          changesDenied.push(change)
+          failed = true
+        }
+      }
+    }
+  }
+
+  if (failed) {
+    core.setFailed('Dependency review detected denied packages.')
+  } else {
+    core.info('Dependency review did not detect any denied packages')
+  }
+
+  return changesDenied
+}

src/main.ts

@@ -3,7 +3,7 @@ import * as dependencyGraph from './dependency-graph'
 import * as github from '@actions/github'
 import styles from 'ansi-styles'
 import {RequestError} from '@octokit/request-error'
-import {Change, Severity, Changes} from './schemas'
+import {Change, Severity, Changes, ConfigurationOptions} from './schemas'
 import {readConfig} from '../src/config'
 import {
   filterChangesBySeverity,
@@ -16,6 +16,7 @@ import {getRefs} from './git-refs'
 
 import {groupDependenciesByManifest} from './utils'
 import {commentPr} from './comment-pr'
+import {getDeniedChanges} from './deny'
 
 async function run(): Promise<void> {
   try {
@@ -63,9 +64,19 @@ async function run(): Promise<void> {
       }
     )
 
+    core.debug(`Filtered Changes: ${JSON.stringify(filteredChanges)}`)
+    core.debug(`Config Deny Packages: ${JSON.stringify(config)}`)
+
+    const deniedChanges = await getDeniedChanges(
+      filteredChanges,
+      config.deny_packages,
+      config.deny_groups
+    )
+
     summary.addSummaryToSummary(
       vulnerableChanges,
       invalidLicenseChanges,
+      deniedChanges,
       config
     )
 
@@ -81,6 +92,10 @@ async function run(): Promise<void> {
       summary.addLicensesToSummary(invalidLicenseChanges, config)
       printLicensesBlock(invalidLicenseChanges)
     }
+    if (config.deny_packages || config.deny_groups) {
+      summary.addDeniedToSummary(deniedChanges)
+      printDeniedDependencies(deniedChanges, config)
+    }
 
     summary.addScannedDependencies(changes)
     printScannedDependencies(changes)
@@ -239,4 +254,20 @@ function printScannedDependencies(changes: Changes): void {
   })
 }
 
+function printDeniedDependencies(
+  changes: Change[],
+  config: ConfigurationOptions
+): void {
+  core.group('Denied', async () => {
+    for (const denied of config.deny_packages) {
+      core.info(`Config: ${denied}`)
+    }
+
+    for (const change of changes) {
+      core.info(`Change: ${change.name}@${change.version} is denied`)
+      core.info(`Change: ${change.package_url} is denied`)
+    }
+  })
+}
+
 run()

src/schemas.ts

@@ -42,6 +42,8 @@ export const ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).optional(),
     allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
+    deny_packages: z.array(z.string()).default([]),
+    deny_groups: z.array(z.string()).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),
     config_file: z.string().optional(),

src/summary.ts

@@ -1,5 +1,5 @@
 import * as core from '@actions/core'
-import {ConfigurationOptions, Changes} from './schemas'
+import {ConfigurationOptions, Changes, Change} from './schemas'
 import {SummaryTableRow} from '@actions/core/lib/summary'
 import {InvalidLicenseChanges, InvalidLicenseChangeTypes} from './licenses'
 import {groupDependenciesByManifest, getManifestsSet, renderUrl} from './utils'
@@ -13,13 +13,15 @@ const icons = {
 export function addSummaryToSummary(
   vulnerableChanges: Changes,
   invalidLicenseChanges: InvalidLicenseChanges,
+  deniedChanges: Changes,
   config: ConfigurationOptions
 ): void {
   core.summary.addHeading('Dependency Review', 1)
 
   if (
     vulnerableChanges.length === 0 &&
-    countLicenseIssues(invalidLicenseChanges) === 0
+    countLicenseIssues(invalidLicenseChanges) === 0 &&
+    deniedChanges.length === 0
   ) {
     if (!config.license_check) {
       core.summary.addRaw(`${icons.check} No vulnerabilities found.`)
@@ -56,6 +58,13 @@ export function addSummaryToSummary(
               invalidLicenseChanges.unlicensed.length
             } package(s) with unknown licenses.`
           ]
+        : []),
+      ...(deniedChanges.length > 0
+        ? [
+            `${checkOrWarnIcon(deniedChanges.length)} ${
+              deniedChanges.length
+            } package(s) denied.`
+          ]
         : [])
     ])
     .addRaw('See the Details below.')
@@ -248,6 +257,25 @@ function countLicenseIssues(
   )
 }
 
+export function addDeniedToSummary(deniedChanges: Change[]): void {
+  if (deniedChanges.length === 0) {
+    return
+  }
+
+  core.summary.addHeading('Denied dependencies', 2)
+  for (const change of deniedChanges) {
+    core.summary.addHeading(`<em>Denied dependencies</em>`, 4)
+    core.summary.addTable([
+      ['Package', 'Version', 'License'],
+      [
+        renderUrl(change.source_repository_url, change.name),
+        change.version,
+        change.license || ''
+      ]
+    ])
+  }
+}
+
 function checkOrFailIcon(count: number): string {
   return count === 0 ? icons.check : icons.cross
 }