document; code style;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "3.0.4",
+  "version": "3.0.5",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",

src/config.ts

@@ -40,7 +40,7 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   const head_ref = getOptionalInput('head-ref')
   const comment_summary_in_pr = getOptionalBoolean('comment-summary-in-pr')
 
-  validatepurl(allow_dependencies_licenses)
+  validatePURL(allow_dependencies_licenses)
   validateLicenses('allow-licenses', allow_licenses)
   validateLicenses('deny-licenses', deny_licenses)
 
@@ -158,7 +158,7 @@ function parseConfigFile(configData: string): ConfigurationOptionsPartial {
 
       // validate purls from the allow-dependencies-licenses
       if (key === 'allow-dependencies-licenses') {
-        validatepurl(data[key])
+        validatePURL(data[key])
       }
 
       // get rid of the ugly dashes from the actions conventions
@@ -199,7 +199,7 @@ async function getRemoteConfig(configOpts: {
     throw new Error('Error fetching remote config file')
   }
 }
-function validatepurl(allow_dependencies_licenses: string[] | undefined): void {
+function validatePURL(allow_dependencies_licenses: string[] | undefined): void {
   //validate that the provided elements of the string are in valid purl format
   if (allow_dependencies_licenses === undefined) {
     return

src/licenses.ts

@@ -1,6 +1,6 @@
 import spdxSatisfies from 'spdx-satisfies'
 import {Change, Changes} from './schemas'
-import {isSPDXValid, octokitClient, isDefined} from './utils'
+import {isSPDXValid, octokitClient} from './utils'
 import {PackageURL} from 'packageurl-js'
 
 /**
@@ -37,18 +37,23 @@ export async function getInvalidLicenseChanges(
 
   const groupedChanges = await groupChanges(changes)
 
-  // filter out changes that are part of exclusions list - config.allow_dependencies_licenses
+  // Takes the changes from the groupedChanges object and filters out the ones that are part of the exclusions list
+  // It does by creating a new PackageURL object from the change and comparing it to the exclusions list
   groupedChanges.licensed = groupedChanges.licensed.filter(change => {
     const changeAsPackageURL = new PackageURL(
       change.ecosystem,
-      undefined,
+      null,
       change.name,
       change.version,
-      undefined,
+      null,
-      undefined
+      null
     )
+    // We want to find if the licenseExclussion list contains the PackageURL of the change
+    // If it does, we want to filter it out and therefore return false
+    // If it doesn't, we want to keep it and therefore return true
     if (
-      isDefined(licenseExclusions) &&
+      licenseExclusions !== null &&
+      licenseExclusions !== undefined &&
       licenseExclusions.findIndex(
         exclusion =>
           exclusion.type === changeAsPackageURL.type &&

src/utils.ts

@@ -41,11 +41,6 @@ export function isSPDXValid(license: string): boolean {
   }
 }
 
-// function to check if a value is not null or undefined
-export function isDefined<T>(value: T | null | undefined): value is T {
-  return value !== null && value !== undefined
-}
-
 function isEnterprise(): boolean {
   const serverUrl = new URL(
     process.env['GITHUB_SERVER_URL'] ?? 'https://github.com'