Merge branch 'main' into comment-on-failure

dist/index.js

@@ -135,6 +135,84 @@ function findCommentByMarker(commentBodyIncludes) {
 }
 
 
+/***/ }),
+
+/***/ 2134:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getDeniedChanges = void 0;
+const core = __importStar(__nccwpck_require__(2186));
+function getDeniedChanges(changes, deniedPackages, deniedGroups) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const changesDenied = [];
+        let failed = false;
+        for (const change of changes) {
+            change.name = change.name.toLowerCase();
+            const packageUrl = change.package_url.toLowerCase().split('@')[0];
+            if (deniedPackages) {
+                for (const denied of deniedPackages) {
+                    if (packageUrl === denied.split('@')[0].toLowerCase()) {
+                        changesDenied.push(change);
+                        failed = true;
+                    }
+                }
+            }
+            if (deniedGroups) {
+                for (const denied of deniedGroups) {
+                    if (packageUrl.startsWith(denied.toLowerCase())) {
+                        changesDenied.push(change);
+                        failed = true;
+                    }
+                }
+            }
+        }
+        if (failed) {
+            core.setFailed('Dependency review detected denied packages.');
+        }
+        else {
+            core.info('Dependency review did not detect any denied packages');
+        }
+        return changesDenied;
+    });
+}
+exports.getDeniedChanges = getDeniedChanges;
+
+
 /***/ }),
 
 /***/ 4966:
@@ -485,6 +563,7 @@ const summary = __importStar(__nccwpck_require__(8608));
 const git_refs_1 = __nccwpck_require__(1086);
 const utils_1 = __nccwpck_require__(918);
 const comment_pr_1 = __nccwpck_require__(5842);
+const deny_1 = __nccwpck_require__(2134);
 function run() {
     return __awaiter(this, void 0, void 0, function* () {
         try {
@@ -513,7 +592,10 @@ function run() {
                 deny: config.deny_licenses,
                 licenseExclusions: config.allow_dependencies_licenses
             });
-            summary.addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, config);
+            core.debug(`Filtered Changes: ${JSON.stringify(filteredChanges)}`);
+            core.debug(`Config Deny Packages: ${JSON.stringify(config)}`);
+            const deniedChanges = yield (0, deny_1.getDeniedChanges)(filteredChanges, config.deny_packages, config.deny_groups);
+            summary.addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, deniedChanges, config);
             if (snapshot_warnings) {
                 summary.addSnapshotWarnings(snapshot_warnings);
             }
@@ -525,6 +607,10 @@ function run() {
                 summary.addLicensesToSummary(invalidLicenseChanges, config);
                 printLicensesBlock(invalidLicenseChanges);
             }
+            if (config.deny_packages || config.deny_groups) {
+                summary.addDeniedToSummary(deniedChanges);
+                printDeniedDependencies(deniedChanges, config);
+            }
             summary.addScannedDependencies(changes);
             printScannedDependencies(changes);
             if (config.comment_summary_in_pr === 'always' ||
@@ -642,6 +728,17 @@ function printScannedDependencies(changes) {
         }
     }));
 }
+function printDeniedDependencies(changes, config) {
+    core.group('Denied', () => __awaiter(this, void 0, void 0, function* () {
+        for (const denied of config.deny_packages) {
+            core.info(`Config: ${denied}`);
+        }
+        for (const change of changes) {
+            core.info(`Change: ${change.name}@${change.version} is denied`);
+            core.info(`Change: ${change.package_url} is denied`);
+        }
+    }));
+}
 run();
 
 
@@ -676,10 +773,15 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.ComparisonResponseSchema = exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SeveritySchema = exports.SCOPES = exports.SEVERITIES = void 0;
+exports.ComparisonResponseSchema = exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SeveritySchema = exports.COMMENT_SUMMARY_OPTIONS = exports.SCOPES = exports.SEVERITIES = void 0;
 const z = __importStar(__nccwpck_require__(3301));
 exports.SEVERITIES = ['critical', 'high', 'moderate', 'low'];
 exports.SCOPES = ['unknown', 'runtime', 'development'];
+exports.COMMENT_SUMMARY_OPTIONS = [
+    'always',
+    'never',
+    'on-failure'
+];
 exports.SeveritySchema = z.enum(exports.SEVERITIES).default('low');
 exports.ChangeSchema = z.object({
     change_type: z.enum(['added', 'removed']),
@@ -714,12 +816,25 @@ exports.ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).optional(),
     allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
+    deny_packages: z.array(z.string()).default([]),
+    deny_groups: z.array(z.string()).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),
     config_file: z.string().optional(),
     base_ref: z.string().optional(),
     head_ref: z.string().optional(),
-    comment_summary_in_pr: z.enum(['always', 'never', 'on-failure']).default('never'),
+    comment_summary_in_pr: z
+        .union([z.boolean(), z.enum(exports.COMMENT_SUMMARY_OPTIONS)])
+        .default('never')
+})
+    .transform(config => {
+    if (config.comment_summary_in_pr === true) {
+        config.comment_summary_in_pr = 'always';
+    }
+    else if (config.comment_summary_in_pr === false) {
+        config.comment_summary_in_pr = 'never';
+    }
+    return config;
 })
     .superRefine((config, context) => {
     if (config.allow_licenses && config.deny_licenses) {
@@ -780,7 +895,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.addSnapshotWarnings = exports.addScannedDependencies = exports.addLicensesToSummary = exports.addChangeVulnerabilitiesToSummary = exports.addSummaryToSummary = void 0;
+exports.addDeniedToSummary = exports.addSnapshotWarnings = exports.addScannedDependencies = exports.addLicensesToSummary = exports.addChangeVulnerabilitiesToSummary = exports.addSummaryToSummary = void 0;
 const core = __importStar(__nccwpck_require__(2186));
 const utils_1 = __nccwpck_require__(918);
 const icons = {
@@ -788,10 +903,11 @@ const icons = {
     cross: '❌',
     warning: '⚠️'
 };
-function addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, config) {
+function addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, deniedChanges, config) {
     core.summary.addHeading('Dependency Review', 1);
     if (vulnerableChanges.length === 0 &&
-        countLicenseIssues(invalidLicenseChanges) === 0) {
+        countLicenseIssues(invalidLicenseChanges) === 0 &&
+        deniedChanges.length === 0) {
         if (!config.license_check) {
             core.summary.addRaw(`${icons.check} No vulnerabilities found.`);
         }
@@ -817,6 +933,11 @@ function addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, config) {
                 `${checkOrFailIcon(invalidLicenseChanges.unresolved.length)} ${invalidLicenseChanges.unresolved.length} package(s) with invalid SPDX license definitions`,
                 `${checkOrWarnIcon(invalidLicenseChanges.unlicensed.length)} ${invalidLicenseChanges.unlicensed.length} package(s) with unknown licenses.`
             ]
+            : []),
+        ...(deniedChanges.length > 0
+            ? [
+                `${checkOrWarnIcon(deniedChanges.length)} ${deniedChanges.length} package(s) denied.`
+            ]
             : [])
     ])
         .addRaw('See the Details below.');
@@ -958,6 +1079,24 @@ exports.addSnapshotWarnings = addSnapshotWarnings;
 function countLicenseIssues(invalidLicenseChanges) {
     return Object.values(invalidLicenseChanges).reduce((acc, val) => acc + val.length, 0);
 }
+function addDeniedToSummary(deniedChanges) {
+    if (deniedChanges.length === 0) {
+        return;
+    }
+    core.summary.addHeading('Denied dependencies', 2);
+    for (const change of deniedChanges) {
+        core.summary.addHeading(`<em>Denied dependencies</em>`, 4);
+        core.summary.addTable([
+            ['Package', 'Version', 'License'],
+            [
+                (0, utils_1.renderUrl)(change.source_repository_url, change.name),
+                change.version,
+                change.license || ''
+            ]
+        ]);
+    }
+}
+exports.addDeniedToSummary = addDeniedToSummary;
 function checkOrFailIcon(count) {
     return count === 0 ? icons.check : icons.cross;
 }
@@ -47823,6 +47962,8 @@ function readInlineConfig() {
     const allow_licenses = parseList(getOptionalInput('allow-licenses'));
     const deny_licenses = parseList(getOptionalInput('deny-licenses'));
     const allow_dependencies_licenses = parseList(getOptionalInput('allow-dependencies-licenses'));
+    const deny_packages = parseList(getOptionalInput('deny-packages'));
+    const deny_groups = parseList(getOptionalInput('deny-groups'));
     const allow_ghsas = parseList(getOptionalInput('allow-ghsas'));
     const license_check = getOptionalBoolean('license-check');
     const vulnerability_check = getOptionalBoolean('vulnerability-check');
@@ -47837,6 +47978,8 @@ function readInlineConfig() {
         fail_on_scopes,
         allow_licenses,
         deny_licenses,
+        deny_packages,
+        deny_groups,
         allow_dependencies_licenses,
         allow_ghsas,
         license_check,
@@ -47907,7 +48050,9 @@ function parseConfigFile(configData) {
             'deny-licenses',
             'fail-on-scopes',
             'allow-ghsas',
-            'allow-dependencies-licenses'
+            'allow-dependencies-licenses',
+            'deny-packages',
+            'deny-groups'
         ];
         for (const key of Object.keys(data)) {
             // strings can contain list values (e.g. 'MIT, Apache-2.0'). In this
@@ -48083,10 +48228,15 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.ComparisonResponseSchema = exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SeveritySchema = exports.SCOPES = exports.SEVERITIES = void 0;
+exports.ComparisonResponseSchema = exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SeveritySchema = exports.COMMENT_SUMMARY_OPTIONS = exports.SCOPES = exports.SEVERITIES = void 0;
 const z = __importStar(__nccwpck_require__(3301));
 exports.SEVERITIES = ['critical', 'high', 'moderate', 'low'];
 exports.SCOPES = ['unknown', 'runtime', 'development'];
+exports.COMMENT_SUMMARY_OPTIONS = [
+    'always',
+    'never',
+    'on-failure'
+];
 exports.SeveritySchema = z.enum(exports.SEVERITIES).default('low');
 exports.ChangeSchema = z.object({
     change_type: z.enum(['added', 'removed']),
@@ -48121,12 +48271,25 @@ exports.ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).optional(),
     allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
+    deny_packages: z.array(z.string()).default([]),
+    deny_groups: z.array(z.string()).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),
     config_file: z.string().optional(),
     base_ref: z.string().optional(),
     head_ref: z.string().optional(),
-    comment_summary_in_pr: z.enum(['always', 'never', 'on-failure']).default('never'),
+    comment_summary_in_pr: z
+        .union([z.boolean(), z.enum(exports.COMMENT_SUMMARY_OPTIONS)])
+        .default('never')
+})
+    .transform(config => {
+    if (config.comment_summary_in_pr === true) {
+        config.comment_summary_in_pr = 'always';
+    }
+    else if (config.comment_summary_in_pr === false) {
+        config.comment_summary_in_pr = 'never';
+    }
+    return config;
 })
     .superRefine((config, context) => {
     if (config.allow_licenses && config.deny_licenses) {