Move config into its own file.

src/config.ts

@@ -0,0 +1,30 @@
+import * as fs from 'fs'
+import YAML from 'yaml'
+import * as z from 'zod'
+
+const CONFIG_FILEPATH = "./.github/dep-review.yml"
+const SEVERITIES = ["critical", "high", "moderate", "low"]
+
+// TODO check for file not existing
+// TODO check for file with both extensions
+// TODO parse yaml format, validate keys
+
+var severity: string
+var allowlist, blocklist: [string]
+
+var data = fs.readFile(CONFIG_FILEPATH, "utf-8", (err, data) => {
+    const values = YAML.parse(data)
+    const parsed = z.object({
+        fail_on_severity: z.enum(SEVERITIES),
+        allow_licenses: z.array(z.string()),
+        deny_licenses: z.array(z.string())
+    })
+        .partial()
+        .refine(obj => !(obj.allow_licenses && obj.deny_licenses), "Can't specify both allow_licenses and deny_licenses")
+        .parse(values)
+
+    // vlaidate licenses dynamically
+    core.info(parsed.fail_on_severity!)
+    //core.info(values["allow_licenses"])
+    //core.info(values["deny_licenses"])
+})

src/main.ts

@@ -4,7 +4,7 @@ import * as github from '@actions/github'
 import styles from 'ansi-styles'
 import { RequestError } from '@octokit/request-error'
 import { PullRequestSchema } from './schemas'
-import * as fs from 'fs'
+
 
 async function run(): Promise<void> {
   try {
@@ -35,8 +35,7 @@ async function run(): Promise<void> {
       ) {
         for (const vuln of change.vulnerabilities) {
           core.info(
-            `${styles.bold.open}${change.manifest} » ${change.name}@${
+            `${styles.bold.open}${change.manifest} » ${change.name}@${change.version
-              change.version
             }${styles.bold.close} – ${vuln.advisory_summary} ${renderSeverity(
               vuln.severity
             )}`
@@ -47,16 +46,6 @@ async function run(): Promise<void> {
       }
     }
 
-    // TODO check for file not existing
-    // TODO check for file with both extensions
-
-    var severity: string
-    var allowlist, blocklist: [string]
-
-    var data = fs.readFile("./.github/dep-review.yml", "utf-8", (err, data) => { 
-      core.info(data)
-    })
-
     if (failed) {
       throw new Error('Dependency review detected vulnerable packages.')
     } else {