actions/dependency-review-action
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

switched to purl format

Browse Source
This commit is contained in:
Stefan Petrushevski
2023-04-06 09:37:42 +02:00
parent e17845d155
commit 9ad7edb033
8 changed files with 81 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package-lock.json
Generated
+11
View File
@@ -17,6 +17,7 @@
"got": "^12.6.0",
"nodemon": "^2.0.21",
"octokit": "^2.0.14",
"packageurl-js": "^1.0.2",
"spdx-expression-parse": "^3.0.1",
"spdx-satisfies": "^5.0.1",
"yaml": "^2.2.1",
@@ -7120,6 +7121,11 @@
"node": ">=6"
}
},
"node_modules/packageurl-js": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-1.0.2.tgz",
"integrity": "sha512-fWC4ZPxo80qlh3xN5FxfIoQD3phVY4+EyzTIqyksjhKNDmaicdpxSvkWwIrYTtv9C1/RcUN6pxaTwGmj2NzS6A=="
},
"node_modules/parent-module": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
@@ -13990,6 +13996,11 @@
"integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
"dev": true
},
"packageurl-js": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-1.0.2.tgz",
"integrity": "sha512-fWC4ZPxo80qlh3xN5FxfIoQD3phVY4+EyzTIqyksjhKNDmaicdpxSvkWwIrYTtv9C1/RcUN6pxaTwGmj2NzS6A=="
},
"parent-module": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
package.json
+1 -2
View File
@@ -33,6 +33,7 @@
"got": "^12.6.0",
"nodemon": "^2.0.21",
"octokit": "^2.0.14",
"packageurl-js": "^1.0.2",
"spdx-expression-parse": "^3.0.1",
"spdx-satisfies": "^5.0.1",
"yaml": "^2.2.1",
@@ -41,8 +42,6 @@
"devDependencies": {
"@types/jest": "^27.5.2",
"@types/node": "^16.18.14",
"@typescript-eslint/eslint-plugin": "^5.48.1",
"@typescript-eslint/parser": "^5.48.0",
"@types/spdx-expression-parse": "^3.0.2",
"@types/spdx-satisfies": "^0.1.0",
"@typescript-eslint/eslint-plugin": "^5.54.0",
scripts/create_summary.ts
+6 -4
View File
@@ -22,10 +22,12 @@ const defaultConfig: ConfigurationOptions = {
allow_ghsas: [],
allow_licenses: ['MIT'],
deny_licenses: [],
allow_dependencies_licenses: {
npm: ['pkg1'],
pip: ['pkg2']
},
allow_dependencies_licenses: [
'pkg:npm/[email protected]',
'pkg:pip/requests',
'pkg:pip/certifi',
'pkg:pip/[email protected]'
],
comment_summary_in_pr: true
}
src/config.ts
+24 -10
View File
@@ -5,6 +5,7 @@ import * as core from '@actions/core'
import * as z from 'zod'
import {ConfigurationOptions, ConfigurationOptionsSchema} from './schemas'
import {isSPDXValid, octokitClient} from './utils'
import {PackageURL} from 'packageurl-js'
type ConfigurationOptionsPartial = Partial<ConfigurationOptions>
@@ -29,6 +30,9 @@ function readInlineConfig(): ConfigurationOptionsPartial {
const fail_on_scopes = parseList(getOptionalInput('fail-on-scopes'))
const allow_licenses = parseList(getOptionalInput('allow-licenses'))
const deny_licenses = parseList(getOptionalInput('deny-licenses'))
const allow_dependencies_licenses = parseList(
getOptionalInput('allow-dependencies-licenses')
)
const allow_ghsas = parseList(getOptionalInput('allow-ghsas'))
const license_check = getOptionalBoolean('license-check')
const vulnerability_check = getOptionalBoolean('vulnerability-check')
@@ -36,6 +40,7 @@ function readInlineConfig(): ConfigurationOptionsPartial {
const head_ref = getOptionalInput('head-ref')
const comment_summary_in_pr = getOptionalBoolean('comment-summary-in-pr')
validatepurl(allow_dependencies_licenses)
validateLicenses('allow-licenses', allow_licenses)
validateLicenses('deny-licenses', deny_licenses)
@@ -44,6 +49,7 @@ function readInlineConfig(): ConfigurationOptionsPartial {
fail_on_scopes,
allow_licenses,
deny_licenses,
allow_dependencies_licenses,
allow_ghsas,
license_check,
vulnerability_check,
@@ -150,17 +156,9 @@ function parseConfigFile(configData: string): ConfigurationOptionsPartial {
validateLicenses(key, data[key])
}
// parse the allow-dependencies-licenses configs value
// per-ecosystem: ['pkg1', 'pkg2']
// validate purls from the allow-dependencies-licenses
if (key === 'allow-dependencies-licenses') {
const val = data[key]
for (const ecosystem of Object.keys(val)) {
const pkgs = val[ecosystem]
if (typeof pkgs === 'string') {
val[ecosystem] = pkgs.split(',').map(x => x.trim())
}
}
data[key] = val
validatepurl(data[key])
}
// get rid of the ugly dashes from the actions conventions
@@ -201,3 +199,19 @@ async function getRemoteConfig(configOpts: {
throw new Error('Error fetching remote config file')
}
}
function validatepurl(allow_dependencies_licenses: string[] | undefined): void {
//validate that the provided elements of the string are in valid purl format
if (allow_dependencies_licenses === undefined) {
return
}
const invalid_purls = allow_dependencies_licenses.filter(
purl => !PackageURL.fromString(purl)
)
if (invalid_purls.length > 0) {
throw new Error(
`Invalid purl(s) in allow-dependencies-licenses: ${invalid_purls}`
)
}
return
}
src/licenses.ts
+34 -5
View File
@@ -1,6 +1,8 @@
import spdxSatisfies from 'spdx-satisfies'
import {Change, Changes} from './schemas'
import {isSPDXValid, octokitClient, isDefined} from './utils'
import {PackageURL} from 'packageurl-js'
import * as core from '@actions/core'
/**
* Loops through a list of changes, filtering and returning the
@@ -24,22 +26,49 @@ export async function getInvalidLicenseChanges(
licenses: {
allow?: string[]
deny?: string[]
exception?: Record<string, string[]>
licenseExclusions?: string[]
}
): Promise<InvalidLicenseChanges> {
const {allow, deny, exception} = licenses
const {allow, deny} = licenses
// licenseExclusions = licenseExclusions.map((pkgUrl: string) => {
// return PackageURL.fromString(pkgUrl)
// })
const licenseExclusions = licenses.licenseExclusions?.map(
(pkgUrl: string) => {
return PackageURL.fromString(pkgUrl)
}
)
const groupedChanges = await groupChanges(changes)
// filter out changes that are part of exclusions list - config.allow_license_exceptions
core.info(
`Grouped changes BEFORE filter size: ${groupedChanges.licensed.length}`
)
// filter out changes that are part of exclusions list - config.allow_dependencies_licenses
groupedChanges.licensed = groupedChanges.licensed.filter(change => {
const changeAsPackageURL = new PackageURL(
change.ecosystem,
undefined,
change.name,
change.version,
undefined,
undefined
)
if (
isDefined(exception) &&
exception[change.ecosystem].includes(change.name)
isDefined(licenseExclusions) &&
licenseExclusions.findIndex(
exclusion =>
exclusion.type === changeAsPackageURL.type &&
exclusion.name === changeAsPackageURL.name
) !== -1
) {
return false
}
return true
})
core.info(
`Grouped changes after filter size: ${groupedChanges.licensed.length}`
)
const licensedChanges: Changes = groupedChanges.licensed
const invalidLicenseChanges: InvalidLicenseChanges = {
src/main.ts
+3 -1
View File
@@ -16,10 +16,12 @@ import {getRefs} from './git-refs'
import {groupDependenciesByManifest} from './utils'
import {commentPr} from './comment-pr'
import {PackageURL} from 'packageurl-js'
async function run(): Promise<void> {
try {
const config = await readConfig()
const refs = getRefs(config, github.context)
const changes = await dependencyGraph.compare({
@@ -56,7 +58,7 @@ async function run(): Promise<void> {
{
allow: config.allow_licenses,
deny: config.deny_licenses,
exception: config.allow_dependencies_licenses
licenseExclusions: config.allow_dependencies_licenses
}
)
src/schemas.ts
+1 -3
View File
@@ -40,9 +40,7 @@ export const ConfigurationOptionsSchema = z
fail_on_scopes: z.array(z.enum(SCOPES)).default(['runtime']),
allow_licenses: z.array(z.string()).optional(),
deny_licenses: z.array(z.string()).optional(),
allow_dependencies_licenses: z
.record(z.string(), z.array(z.string()))
.optional(),
allow_dependencies_licenses: z.array(z.string()).optional(),
allow_ghsas: z.array(z.string()).default([]),
license_check: z.boolean().default(true),
vulnerability_check: z.boolean().default(true),
src/summary.ts
+1 -3
View File
@@ -149,9 +149,7 @@ export function addLicensesToSummary(
for (const [ecosystem, dependencies] of Object.entries(
config.allow_dependencies_licenses
)) {
core.summary.addRaw(
`<li> ${ecosystem}</strong>: ${dependencies.join(', ')} </li>`
)
core.summary.addRaw(`<li> ${ecosystem}</strong>: ${dependencies} </li>`)
}
}