switched to purl format

src/config.ts

@@ -5,6 +5,7 @@ import * as core from '@actions/core'
 import * as z from 'zod'
 import {ConfigurationOptions, ConfigurationOptionsSchema} from './schemas'
 import {isSPDXValid, octokitClient} from './utils'
+import {PackageURL} from 'packageurl-js'
 
 type ConfigurationOptionsPartial = Partial<ConfigurationOptions>
 
@@ -29,6 +30,9 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   const fail_on_scopes = parseList(getOptionalInput('fail-on-scopes'))
   const allow_licenses = parseList(getOptionalInput('allow-licenses'))
   const deny_licenses = parseList(getOptionalInput('deny-licenses'))
+  const allow_dependencies_licenses = parseList(
+    getOptionalInput('allow-dependencies-licenses')
+  )
   const allow_ghsas = parseList(getOptionalInput('allow-ghsas'))
   const license_check = getOptionalBoolean('license-check')
   const vulnerability_check = getOptionalBoolean('vulnerability-check')
@@ -36,6 +40,7 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   const head_ref = getOptionalInput('head-ref')
   const comment_summary_in_pr = getOptionalBoolean('comment-summary-in-pr')
 
+  validatepurl(allow_dependencies_licenses)
   validateLicenses('allow-licenses', allow_licenses)
   validateLicenses('deny-licenses', deny_licenses)
 
@@ -44,6 +49,7 @@ function readInlineConfig(): ConfigurationOptionsPartial {
     fail_on_scopes,
     allow_licenses,
     deny_licenses,
+    allow_dependencies_licenses,
     allow_ghsas,
     license_check,
     vulnerability_check,
@@ -150,17 +156,9 @@ function parseConfigFile(configData: string): ConfigurationOptionsPartial {
         validateLicenses(key, data[key])
       }
 
-      // parse the allow-dependencies-licenses configs value
-      // per-ecosystem: ['pkg1', 'pkg2']
+      // validate purls from the allow-dependencies-licenses
       if (key === 'allow-dependencies-licenses') {
-        const val = data[key]
-        for (const ecosystem of Object.keys(val)) {
-          const pkgs = val[ecosystem]
-          if (typeof pkgs === 'string') {
-            val[ecosystem] = pkgs.split(',').map(x => x.trim())
-          }
-        }
-        data[key] = val
+        validatepurl(data[key])
       }
 
       // get rid of the ugly dashes from the actions conventions
@@ -201,3 +199,19 @@ async function getRemoteConfig(configOpts: {
     throw new Error('Error fetching remote config file')
   }
 }
+function validatepurl(allow_dependencies_licenses: string[] | undefined): void {
+  //validate that the provided elements of the string are in valid purl format
+  if (allow_dependencies_licenses === undefined) {
+    return
+  }
+  const invalid_purls = allow_dependencies_licenses.filter(
+    purl => !PackageURL.fromString(purl)
+  )
+
+  if (invalid_purls.length > 0) {
+    throw new Error(
+      `Invalid purl(s) in allow-dependencies-licenses: ${invalid_purls}`
+    )
+  }
+  return
+}

src/licenses.ts

@@ -1,6 +1,8 @@
 import spdxSatisfies from 'spdx-satisfies'
 import {Change, Changes} from './schemas'
 import {isSPDXValid, octokitClient, isDefined} from './utils'
+import {PackageURL} from 'packageurl-js'
+import * as core from '@actions/core'
 
 /**
  * Loops through a list of changes, filtering and returning the
@@ -24,22 +26,49 @@ export async function getInvalidLicenseChanges(
   licenses: {
     allow?: string[]
     deny?: string[]
-    exception?: Record<string, string[]>
+    licenseExclusions?: string[]
   }
 ): Promise<InvalidLicenseChanges> {
-  const {allow, deny, exception} = licenses
+  const {allow, deny} = licenses
+
+  // licenseExclusions = licenseExclusions.map((pkgUrl: string) => {
+  //   return PackageURL.fromString(pkgUrl)
+  // })
+  const licenseExclusions = licenses.licenseExclusions?.map(
+    (pkgUrl: string) => {
+      return PackageURL.fromString(pkgUrl)
+    }
+  )
 
   const groupedChanges = await groupChanges(changes)
-  // filter out changes that are part of exclusions list - config.allow_license_exceptions
+  core.info(
+    `Grouped changes BEFORE filter size: ${groupedChanges.licensed.length}`
+  )
+  // filter out changes that are part of exclusions list - config.allow_dependencies_licenses
   groupedChanges.licensed = groupedChanges.licensed.filter(change => {
+    const changeAsPackageURL = new PackageURL(
+      change.ecosystem,
+      undefined,
+      change.name,
+      change.version,
+      undefined,
+      undefined
+    )
     if (
-      isDefined(exception) &&
-      exception[change.ecosystem].includes(change.name)
+      isDefined(licenseExclusions) &&
+      licenseExclusions.findIndex(
+        exclusion =>
+          exclusion.type === changeAsPackageURL.type &&
+          exclusion.name === changeAsPackageURL.name
+      ) !== -1
     ) {
       return false
     }
     return true
   })
+  core.info(
+    `Grouped changes after filter size: ${groupedChanges.licensed.length}`
+  )
   const licensedChanges: Changes = groupedChanges.licensed
 
   const invalidLicenseChanges: InvalidLicenseChanges = {

src/main.ts

@@ -16,10 +16,12 @@ import {getRefs} from './git-refs'
 
 import {groupDependenciesByManifest} from './utils'
 import {commentPr} from './comment-pr'
+import {PackageURL} from 'packageurl-js'
 
 async function run(): Promise<void> {
   try {
     const config = await readConfig()
+
     const refs = getRefs(config, github.context)
 
     const changes = await dependencyGraph.compare({
@@ -56,7 +58,7 @@ async function run(): Promise<void> {
       {
         allow: config.allow_licenses,
         deny: config.deny_licenses,
-        exception: config.allow_dependencies_licenses
+        licenseExclusions: config.allow_dependencies_licenses
       }
     )
 

src/schemas.ts

@@ -40,9 +40,7 @@ export const ConfigurationOptionsSchema = z
     fail_on_scopes: z.array(z.enum(SCOPES)).default(['runtime']),
     allow_licenses: z.array(z.string()).optional(),
     deny_licenses: z.array(z.string()).optional(),
-    allow_dependencies_licenses: z
-      .record(z.string(), z.array(z.string()))
-      .optional(),
+    allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),

src/summary.ts

@@ -149,9 +149,7 @@ export function addLicensesToSummary(
     for (const [ecosystem, dependencies] of Object.entries(
       config.allow_dependencies_licenses
     )) {
-      core.summary.addRaw(
-        `<li> ${ecosystem}</strong>: ${dependencies.join(', ')} </li>`
-      )
+      core.summary.addRaw(`<li> ${ecosystem}</strong>: ${dependencies} </li>`)
     }
   }