actions/dependency-review-action
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

change from name of the package to the package url to avoid conflict between 2 dependencies with the same name but for different ecosystems

Browse Source
This commit is contained in:
Adrien Pessu
2023-08-08 16:34:23 +02:00
parent c462e2e50e
commit 1db9156f85
6 changed files with 34 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+14 -14
View File
@@ -66,20 +66,20 @@ jobs:
Configure this action by either inlining these options in your workflow file, or by using an external configuration file. All configuration options are optional. Configure this action by either inlining these options in your workflow file, or by using an external configuration file. All configuration options are optional.
| Option | Usage | Possible values | Default value | | Option | Usage | Possible values | Default value |
|---------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------|---------------| |---------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------|---------------|
| `fail-on-severity` | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. | `low`, `moderate`, `high`, `critical` | `low` | | `fail-on-severity` | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. | `low`, `moderate`, `high`, `critical` | `low` |
| `allow-licenses`\* | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none | | `allow-licenses`\* | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
| `deny-licenses`\* | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none | | `deny-licenses`\* | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
| `fail-on-scopes`† | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown` | `runtime` | | `fail-on-scopes`† | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown` | `runtime` |
| `allow-ghsas` | Contains a list of GitHub Advisory Database IDs that can be skipped during detection. | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none | | `allow-ghsas` | Contains a list of GitHub Advisory Database IDs that can be skipped during detection. | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none |
| `license-check` | Enable or disable the license check performed by the action. | `true`, `false` | `true` | | `license-check` | Enable or disable the license check performed by the action. | `true`, `false` | `true` |
| `vulnerability-check` | Enable or disable the vulnerability check performed by the action. | `true`, `false` | `true` | | `vulnerability-check` | Enable or disable the vulnerability check performed by the action. | `true`, `false` | `true` |
| `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks. | Any package(s) in [purl](https://github.com/package-url/purl-spec) format | none | | `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks. | Any package(s) in [purl](https://github.com/package-url/purl-spec) format | none |
| `base-ref`/`head-ref` | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`. | Any valid git ref(s) in your project | none | | `base-ref`/`head-ref` | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`. | Any valid git ref(s) in your project | none |
| `comment-summary-in-pr` | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`. | `true`, `false` | `false` | | `comment-summary-in-pr` | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`. | `true`, `false` | `false` |
| `deny-packages` | Contains a list of denied package's name. | Any packages complete names | empty | | `deny-packages` | Contains a list of denied package's URL. | Any packages [purl](https://github.com/package-url/purl-spec) without the version | empty |
| `deny-groups` | Contains a list of denied groups package's name. | Any packages's group names | empty | | `deny-groups` | Contains a list of denied groups package's name. | Any packages [purl](https://github.com/package-url/purl-spec) without the version and the name | empty |
\*not supported for use with GitHub Enterprise Server \*not supported for use with GitHub Enterprise Server
__tests__/deny.test.ts
+9 -5
View File
@@ -81,7 +81,7 @@ const mvnChange: Change = {
ecosystem: 'maven', ecosystem: 'maven',
name: 'org.apache.logging.log4j:log4j-core', name: 'org.apache.logging.log4j:log4j-core',
version: '2.15.0', version: '2.15.0',
package_url: 'pkg:org.apache.logging.log4j:log4j-core@1.1.1', package_url: 'pkg:maven/org.apache.logging.log4j/log4j-core@2.14.7',
license: 'Apache-2.0', license: 'Apache-2.0',
source_repository_url: source_repository_url:
'https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core', 'https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core',
@@ -132,7 +132,11 @@ beforeEach(async () => {
test('it adds packages in the deny packages list', async () => { test('it adds packages in the deny packages list', async () => {
const changes: Changes = [npmChange, rubyChange] const changes: Changes = [npmChange, rubyChange]
const deniedChanges = await getDeniedChanges(changes, ['actionsomething'], []) const deniedChanges = await getDeniedChanges(
changes,
['pkg:gem/actionsomething'],
[]
)
expect(deniedChanges[0]).toBe(rubyChange) expect(deniedChanges[0]).toBe(rubyChange)
expect(deniedChanges.length).toEqual(1) expect(deniedChanges.length).toEqual(1)
@@ -143,7 +147,7 @@ test('it adds packages in the deny group list', async () => {
const deniedChanges = await getDeniedChanges( const deniedChanges = await getDeniedChanges(
changes, changes,
[], [],
['org.apache.logging.log4j'] ['pkg:maven/org.apache.logging.log4j']
) )
expect(deniedChanges[0]).toBe(mvnChange) expect(deniedChanges[0]).toBe(mvnChange)
@@ -154,8 +158,8 @@ test('it adds packages outside of the deny lists', async () => {
const changes: Changes = [npmChange, pipChange] const changes: Changes = [npmChange, pipChange]
const deniedChanges = await getDeniedChanges( const deniedChanges = await getDeniedChanges(
changes, changes,
['actionsomething'], ['pkg:gem/actionsomething'],
['org.apache.logging.log4j'] ['pkg:maven:org.apache.logging.log4j']
) )
expect(deniedChanges.length).toEqual(0) expect(deniedChanges.length).toEqual(0)
dist/index.js
Generated Vendored
+3 -3
View File
@@ -183,10 +183,10 @@ function getDeniedChanges(changes, deniedPackages, deniedGroups) {
let failed = false; let failed = false;
for (const change of changes) { for (const change of changes) {
change.name = change.name.toLowerCase(); change.name = change.name.toLowerCase();
change.package_url = change.package_url.toLowerCase(); const packageUrl = change.package_url.toLowerCase().split('@')[0];
if (deniedPackages) { if (deniedPackages) {
for (const denied of deniedPackages) { for (const denied of deniedPackages) {
if (change.name === denied.toLowerCase()) { if (packageUrl === denied.split('@')[0].toLowerCase()) {
changesDenied.push(change); changesDenied.push(change);
failed = true; failed = true;
} }
@@ -194,7 +194,7 @@ function getDeniedChanges(changes, deniedPackages, deniedGroups) {
} }
if (deniedGroups) { if (deniedGroups) {
for (const denied of deniedGroups) { for (const denied of deniedGroups) {
if (change.name.startsWith(denied.toLowerCase())) { if (packageUrl.startsWith(denied.toLowerCase())) {
changesDenied.push(change); changesDenied.push(change);
failed = true; failed = true;
} }
dist/index.js.map
Generated Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
docs/examples.md
+4 -4
View File
@@ -233,8 +233,8 @@ jobs:
## Exclude dependencies from their name or groups ## Exclude dependencies from their name or groups
Using the `deny-packages` you can exclude dependencies by their full name. You can add multiple values separated by a comma. Using the `deny-packages` you can exclude dependencies by their full package name. You can add multiple values separated by a comma.
Using the `deny-groups` you can exclude dependencies by their group name. You can add multiple values separated by a comma. Using the `deny-groups` you can exclude dependencies by their package group name. You can add multiple values separated by a comma.
In this example, we are excluding `log4j-api` and `log4j-code` from `maven` and `requests` from `pip` dependencies from the license check In this example, we are excluding `log4j-api` and `log4j-code` from `maven` and `requests` from `pip` dependencies from the license check
@@ -255,6 +255,6 @@ jobs:
- name: 'Dependency Review' - name: 'Dependency Review'
uses: actions/dependency-review-action@v3 uses: actions/dependency-review-action@v3
with: with:
deny-packages: 'org.apache.logging.log4j:log4j-api,org.apache.logging.log4j:log4j-core' deny-packages: 'pkg:maven/org.apache.logging.log4j:log4j-api,pkg:maven/org.apache.logging.log4j:log4j-core'
deny-groups: 'com.bazaarvoice.maven' deny-groups: 'pkg:maven/com.bazaarvoice.maven'
``` ```
src/deny.ts
+3 -3
View File
@@ -11,11 +11,11 @@ export async function getDeniedChanges(
let failed = false let failed = false
for (const change of changes) { for (const change of changes) {
change.name = change.name.toLowerCase() change.name = change.name.toLowerCase()
change.package_url = change.package_url.toLowerCase() const packageUrl = change.package_url.toLowerCase().split('@')[0]
if (deniedPackages) { if (deniedPackages) {
for (const denied of deniedPackages) { for (const denied of deniedPackages) {
if (change.name === denied.toLowerCase()) { if (packageUrl === denied.split('@')[0].toLowerCase()) {
changesDenied.push(change) changesDenied.push(change)
failed = true failed = true
} }
@@ -24,7 +24,7 @@ export async function getDeniedChanges(
if (deniedGroups) { if (deniedGroups) {
for (const denied of deniedGroups) { for (const denied of deniedGroups) {
if (change.name.startsWith(denied.toLowerCase())) { if (packageUrl.startsWith(denied.toLowerCase())) {
changesDenied.push(change) changesDenied.push(change)
failed = true failed = true
} }