Use SPDX license expressions

src/config.ts

@@ -9,6 +9,9 @@ import {
   SeveritySchema,
   SCOPES
 } from './schemas'
+import {isSPDXValid} from './utils'
+
+type licenseKey = 'allow-licenses' | 'deny-licenses'
 
 function getOptionalInput(name: string): string | undefined {
   const value = core.getInput(name)
@@ -23,6 +26,26 @@ function parseList(list: string | undefined): string[] | undefined {
   }
 }
 
+function getInvalidLicenses(licenses: string[]): string[] {
+  return licenses.filter(license => !isSPDXValid(license))
+}
+
+function validateLicenses(
+  key: licenseKey,
+  licenses: string[] | undefined
+): void {
+  if (licenses === undefined) {
+    return
+  }
+  const invalid_licenses = getInvalidLicenses(licenses)
+
+  if (invalid_licenses.length > 0) {
+    throw new Error(
+      `Invalid license(s) in ${key}: ${invalid_licenses.join(', ')}`
+    )
+  }
+}
+
 export function readConfig(): ConfigurationOptions {
   const externalConfig = getOptionalInput('config-file')
   if (externalConfig !== undefined) {
@@ -53,6 +76,8 @@ export function readInlineConfig(): ConfigurationOptions {
   if (allow_licenses !== undefined && deny_licenses !== undefined) {
     throw new Error("Can't specify both allow_licenses and deny_licenses")
   }
+  validateLicenses('allow-licenses', allow_licenses)
+  validateLicenses('deny-licenses', deny_licenses)
 
   const allow_ghsas = parseList(getOptionalInput('allow-ghsas'))
 
@@ -80,8 +105,11 @@ export function readConfigFile(filePath: string): ConfigurationOptions {
   }
   data = YAML.parse(data)
 
-  // get rid of the ugly dashes from the actions conventions
   for (const key of Object.keys(data)) {
+    if (key === 'allow-licenses' || key === 'deny-licenses') {
+      validateLicenses(key, data[key])
+    }
+    // get rid of the ugly dashes from the actions conventions
     if (key.includes('-')) {
       data[key.replace(/-/g, '_')] = data[key]
       delete data[key]