Merge pull request #540 from sgmurphy/comment-on-failure

Add `on-failure` option to `comment-summary-in-pr` setting

README.md

@@ -67,7 +67,7 @@ jobs:
 Configure this action by either inlining these options in your workflow file, or by using an external configuration file. All configuration options are optional.
 
 | Option                          | Usage                                                                                                                                                                             | Possible values                                                              | Default value |
-|---------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------|---------------|
+| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------- |
 | `fail-on-severity`              | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher.              | `low`, `moderate`, `high`, `critical`                                        | `low`         |
 | `allow-licenses`\*              | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list.                                  | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/)               | none          |
 | `deny-licenses`\*               | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list.                                      | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/)               | none          |
@@ -77,7 +77,7 @@ Configure this action by either inlining these options in your workflow file, or
 | `vulnerability-check`           | Enable or disable the vulnerability check performed by the action.                                                                                                                | `true`, `false`                                                              | `true`        |
 | `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks.                                                                                                            | Any package(s) in [purl](https://github.com/package-url/purl-spec) format    | none          |
 | `base-ref`/`head-ref`           | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`.  | Any valid git ref(s) in your project                                         | none          |
-| `comment-summary-in-pr`         | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`.                 | `true`, `false`                                                                                | `false`       |
+| `comment-summary-in-pr`         | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`.                 | `always`, `on-failure`, `never`                                                              | `never`       |
 | `deny-packages`                 | Any number of packages to block in a PR.                                                                                                                                           | Package(s) in [purl](https://github.com/package-url/purl-spec) format            | empty         |
 | `deny-groups`                   | Any number of groups (namespaces) to block in a PR.                                                                                                                                   | Namespace(s) in [purl](https://github.com/package-url/purl-spec) format (no package name, no version number) | empty         |
 

__tests__/config.test.ts

@@ -171,3 +171,29 @@ describe('licenses that are not valid SPDX licenses', () => {
     )
   })
 })
+
+test('it parses the comment-summary-in-pr input', async () => {
+  setInput('comment-summary-in-pr', 'true')
+  let config = await readConfig()
+  expect(config.comment_summary_in_pr).toBe('always')
+
+  clearInputs()
+  setInput('comment-summary-in-pr', 'false')
+  config = await readConfig()
+  expect(config.comment_summary_in_pr).toBe('never')
+
+  clearInputs()
+  setInput('comment-summary-in-pr', 'always')
+  config = await readConfig()
+  expect(config.comment_summary_in_pr).toBe('always')
+
+  clearInputs()
+  setInput('comment-summary-in-pr', 'never')
+  config = await readConfig()
+  expect(config.comment_summary_in_pr).toBe('never')
+
+  clearInputs()
+  setInput('comment-summary-in-pr', 'on-failure')
+  config = await readConfig()
+  expect(config.comment_summary_in_pr).toBe('on-failure')
+})

action.yml

@@ -45,7 +45,7 @@ inputs:
     description: A boolean to determine if vulnerability checks should be performed
     required: false
   comment-summary-in-pr:
-    description: A boolean to determine if the report should be posted as a comment in the PR itself. Setting this to true requires you to give the workflow the write permissions for pull-requests
+    description: Determines if the summary is posted as a comment in the PR itself. Setting this to `always` or `on-failure` requires you to give the workflow the write permissions for pull-requests
     required: false
   deny-packages:
     description: A comma-separated list of package URLs to deny (e.g. "pkg:npm/express, pkg:pip/pycrypto")

dist/index.js

@@ -613,7 +613,9 @@ function run() {
             }
             summary.addScannedDependencies(changes);
             printScannedDependencies(changes);
-            if (config.comment_summary_in_pr) {
+            if (config.comment_summary_in_pr === 'always' ||
+                (config.comment_summary_in_pr === 'on-failure' &&
+                    process.exitCode === core.ExitCode.Failure)) {
                 yield (0, comment_pr_1.commentPr)(core.summary);
             }
         }
@@ -816,7 +818,21 @@ exports.ConfigurationOptionsSchema = z
     config_file: z.string().optional(),
     base_ref: z.string().optional(),
     head_ref: z.string().optional(),
-    comment_summary_in_pr: z.boolean().default(false)
+    comment_summary_in_pr: z
+        .union([
+        z.preprocess(val => (val === 'true' ? true : val === 'false' ? false : val), z.boolean()),
+        z.enum(['always', 'never', 'on-failure'])
+    ])
+        .default('never')
+})
+    .transform(config => {
+    if (config.comment_summary_in_pr === true) {
+        config.comment_summary_in_pr = 'always';
+    }
+    else if (config.comment_summary_in_pr === false) {
+        config.comment_summary_in_pr = 'never';
+    }
+    return config;
 })
     .superRefine((config, context) => {
     if (config.allow_licenses && config.deny_licenses) {
@@ -47951,7 +47967,7 @@ function readInlineConfig() {
     const vulnerability_check = getOptionalBoolean('vulnerability-check');
     const base_ref = getOptionalInput('base-ref');
     const head_ref = getOptionalInput('head-ref');
-    const comment_summary_in_pr = getOptionalBoolean('comment-summary-in-pr');
+    const comment_summary_in_pr = getOptionalInput('comment-summary-in-pr');
     validatePURL(allow_dependencies_licenses);
     validateLicenses('allow-licenses', allow_licenses);
     validateLicenses('deny-licenses', deny_licenses);
@@ -48255,7 +48271,21 @@ exports.ConfigurationOptionsSchema = z
     config_file: z.string().optional(),
     base_ref: z.string().optional(),
     head_ref: z.string().optional(),
-    comment_summary_in_pr: z.boolean().default(false)
+    comment_summary_in_pr: z
+        .union([
+        z.preprocess(val => (val === 'true' ? true : val === 'false' ? false : val), z.boolean()),
+        z.enum(['always', 'never', 'on-failure'])
+    ])
+        .default('never')
+})
+    .transform(config => {
+    if (config.comment_summary_in_pr === true) {
+        config.comment_summary_in_pr = 'always';
+    }
+    else if (config.comment_summary_in_pr === false) {
+        config.comment_summary_in_pr = 'never';
+    }
+    return config;
 })
     .superRefine((config, context) => {
     if (config.allow_licenses && config.deny_licenses) {

docs/examples.md

@@ -161,7 +161,7 @@ jobs:
         with:
           fail-on-severity: critical
           deny-licenses: LGPL-2.0, BSD-2-Clause
-          comment-summary-in-pr: true
+          comment-summary-in-pr: always
 ```
 
 ## Exclude dependencies from the license check
@@ -189,7 +189,7 @@ jobs:
         with:
           fail-on-severity: critical
           deny-licenses: LGPL-2.0, BSD-2-Clause
-          comment-summary-in-pr: true
+          comment-summary-in-pr: always
           allow-dependencies-licenses: 'pkg:npm/loadash, pkg:pip/requests'
 ```
 
@@ -227,7 +227,7 @@ jobs:
         uses: actions/dependency-review-action@v3
         with:
           fail-on-severity: critical
-          comment-summary-in-pr: true
+          comment-summary-in-pr: always
           license-check: false
 ```
 

scripts/create_summary.ts

@@ -30,7 +30,7 @@ const defaultConfig: ConfigurationOptions = {
     'pkg:pip/certifi',
     'pkg:pip/[email protected]'
   ],
-  comment_summary_in_pr: true
+  comment_summary_in_pr: 'never'
 }
 
 const tmpDir = path.resolve(__dirname, '../tmp')

src/config.ts

@@ -40,7 +40,7 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   const vulnerability_check = getOptionalBoolean('vulnerability-check')
   const base_ref = getOptionalInput('base-ref')
   const head_ref = getOptionalInput('head-ref')
-  const comment_summary_in_pr = getOptionalBoolean('comment-summary-in-pr')
+  const comment_summary_in_pr = getOptionalInput('comment-summary-in-pr')
 
   validatePURL(allow_dependencies_licenses)
   validateLicenses('allow-licenses', allow_licenses)

src/main.ts

@@ -99,7 +99,11 @@ async function run(): Promise<void> {
 
     summary.addScannedDependencies(changes)
     printScannedDependencies(changes)
-    if (config.comment_summary_in_pr) {
+    if (
+      config.comment_summary_in_pr === 'always' ||
+      (config.comment_summary_in_pr === 'on-failure' &&
+        process.exitCode === core.ExitCode.Failure)
+    ) {
       await commentPr(core.summary)
     }
   } catch (error) {

src/schemas.ts

@@ -49,7 +49,23 @@ export const ConfigurationOptionsSchema = z
     config_file: z.string().optional(),
     base_ref: z.string().optional(),
     head_ref: z.string().optional(),
-    comment_summary_in_pr: z.boolean().default(false)
+    comment_summary_in_pr: z
+      .union([
+        z.preprocess(
+          val => (val === 'true' ? true : val === 'false' ? false : val),
+          z.boolean()
+        ),
+        z.enum(['always', 'never', 'on-failure'])
+      ])
+      .default('never')
+  })
+  .transform(config => {
+    if (config.comment_summary_in_pr === true) {
+      config.comment_summary_in_pr = 'always'
+    } else if (config.comment_summary_in_pr === false) {
+      config.comment_summary_in_pr = 'never'
+    }
+    return config
   })
   .superRefine((config, context) => {
     if (config.allow_licenses && config.deny_licenses) {