actions/dependency-review-action
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

change from name of the package to the package url to avoid conflict between 2 dependencies with the same name but for different ecosystems

Browse Source
This commit is contained in:
Adrien Pessu
2023-08-08 16:34:23 +02:00
parent c462e2e50e
commit 1db9156f85
6 changed files with 34 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+14 -14
View File
@@ -66,20 +66,20 @@ jobs:
Configure this action by either inlining these options in your workflow file, or by using an external configuration file. All configuration options are optional.
| Option | Usage | Possible values | Default value |
|---------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------|---------------|
| `fail-on-severity` | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. | `low`, `moderate`, `high`, `critical` | `low` |
| `allow-licenses`\* | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
| `deny-licenses`\* | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
| `fail-on-scopes`† | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown` | `runtime` |
| `allow-ghsas` | Contains a list of GitHub Advisory Database IDs that can be skipped during detection. | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none |
| `license-check` | Enable or disable the license check performed by the action. | `true`, `false` | `true` |
| `vulnerability-check` | Enable or disable the vulnerability check performed by the action. | `true`, `false` | `true` |
| `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks. | Any package(s) in [purl](https://github.com/package-url/purl-spec) format | none |
| `base-ref`/`head-ref` | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`. | Any valid git ref(s) in your project | none |
| `comment-summary-in-pr` | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`. | `true`, `false` | `false` |
| `deny-packages` | Contains a list of denied package's name. | Any packages complete names | empty |
| `deny-groups` | Contains a list of denied groups package's name. | Any packages's group names | empty |
| Option | Usage | Possible values | Default value |
|---------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------|---------------|
| `fail-on-severity` | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. | `low`, `moderate`, `high`, `critical` | `low` |
| `allow-licenses`\* | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
| `deny-licenses`\* | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
| `fail-on-scopes`† | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown` | `runtime` |
| `allow-ghsas` | Contains a list of GitHub Advisory Database IDs that can be skipped during detection. | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none |
| `license-check` | Enable or disable the license check performed by the action. | `true`, `false` | `true` |
| `vulnerability-check` | Enable or disable the vulnerability check performed by the action. | `true`, `false` | `true` |
| `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks. | Any package(s) in [purl](https://github.com/package-url/purl-spec) format | none |
| `base-ref`/`head-ref` | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`. | Any valid git ref(s) in your project | none |
| `comment-summary-in-pr` | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`. | `true`, `false` | `false` |
| `deny-packages` | Contains a list of denied package's URL. | Any packages [purl](https://github.com/package-url/purl-spec) without the version | empty |
| `deny-groups` | Contains a list of denied groups package's name. | Any packages [purl](https://github.com/package-url/purl-spec) without the version and the name | empty |
\*not supported for use with GitHub Enterprise Server
__tests__/deny.test.ts
+9 -5
View File
@@ -81,7 +81,7 @@ const mvnChange: Change = {
ecosystem: 'maven',
name: 'org.apache.logging.log4j:log4j-core',
version: '2.15.0',
package_url: 'pkg:org.apache.logging.log4j:log4j-core@1.1.1',
package_url: 'pkg:maven/org.apache.logging.log4j/log4j-core@2.14.7',
license: 'Apache-2.0',
source_repository_url:
'https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core',
@@ -132,7 +132,11 @@ beforeEach(async () => {
test('it adds packages in the deny packages list', async () => {
const changes: Changes = [npmChange, rubyChange]
const deniedChanges = await getDeniedChanges(changes, ['actionsomething'], [])
const deniedChanges = await getDeniedChanges(
changes,
['pkg:gem/actionsomething'],
[]
)
expect(deniedChanges[0]).toBe(rubyChange)
expect(deniedChanges.length).toEqual(1)
@@ -143,7 +147,7 @@ test('it adds packages in the deny group list', async () => {
const deniedChanges = await getDeniedChanges(
changes,
[],
['org.apache.logging.log4j']
['pkg:maven/org.apache.logging.log4j']
)
expect(deniedChanges[0]).toBe(mvnChange)
@@ -154,8 +158,8 @@ test('it adds packages outside of the deny lists', async () => {
const changes: Changes = [npmChange, pipChange]
const deniedChanges = await getDeniedChanges(
changes,
['actionsomething'],
['org.apache.logging.log4j']
['pkg:gem/actionsomething'],
['pkg:maven:org.apache.logging.log4j']
)
expect(deniedChanges.length).toEqual(0)
dist/index.js
Generated Vendored
+3 -3
View File
@@ -183,10 +183,10 @@ function getDeniedChanges(changes, deniedPackages, deniedGroups) {
let failed = false;
for (const change of changes) {
change.name = change.name.toLowerCase();
change.package_url = change.package_url.toLowerCase();
const packageUrl = change.package_url.toLowerCase().split('@')[0];
if (deniedPackages) {
for (const denied of deniedPackages) {
if (change.name === denied.toLowerCase()) {
if (packageUrl === denied.split('@')[0].toLowerCase()) {
changesDenied.push(change);
failed = true;
}
@@ -194,7 +194,7 @@ function getDeniedChanges(changes, deniedPackages, deniedGroups) {
}
if (deniedGroups) {
for (const denied of deniedGroups) {
if (change.name.startsWith(denied.toLowerCase())) {
if (packageUrl.startsWith(denied.toLowerCase())) {
changesDenied.push(change);
failed = true;
}
dist/index.js.map
Generated Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
docs/examples.md
+4 -4
View File
@@ -233,8 +233,8 @@ jobs:
## Exclude dependencies from their name or groups
Using the `deny-packages` you can exclude dependencies by their full name. You can add multiple values separated by a comma.
Using the `deny-groups` you can exclude dependencies by their group name. You can add multiple values separated by a comma.
Using the `deny-packages` you can exclude dependencies by their full package name. You can add multiple values separated by a comma.
Using the `deny-groups` you can exclude dependencies by their package group name. You can add multiple values separated by a comma.
In this example, we are excluding `log4j-api` and `log4j-code` from `maven` and `requests` from `pip` dependencies from the license check
@@ -255,6 +255,6 @@ jobs:
- name: 'Dependency Review'
uses: actions/dependency-review-action@v3
with:
deny-packages: 'org.apache.logging.log4j:log4j-api,org.apache.logging.log4j:log4j-core'
deny-groups: 'com.bazaarvoice.maven'
deny-packages: 'pkg:maven/org.apache.logging.log4j:log4j-api,pkg:maven/org.apache.logging.log4j:log4j-core'
deny-groups: 'pkg:maven/com.bazaarvoice.maven'
```
src/deny.ts
+3 -3
View File
@@ -11,11 +11,11 @@ export async function getDeniedChanges(
let failed = false
for (const change of changes) {
change.name = change.name.toLowerCase()
change.package_url = change.package_url.toLowerCase()
const packageUrl = change.package_url.toLowerCase().split('@')[0]
if (deniedPackages) {
for (const denied of deniedPackages) {
if (change.name === denied.toLowerCase()) {
if (packageUrl === denied.split('@')[0].toLowerCase()) {
changesDenied.push(change)
failed = true
}
@@ -24,7 +24,7 @@ export async function getDeniedChanges(
if (deniedGroups) {
for (const denied of deniedGroups) {
if (change.name.startsWith(denied.toLowerCase())) {
if (packageUrl.startsWith(denied.toLowerCase())) {
changesDenied.push(change)
failed = true
}