Fixing circular reference, adding prettier.

__tests__/config.test.ts

@@ -1,8 +1,8 @@
-import { expect, test } from '@jest/globals'
+import {expect, test} from '@jest/globals'
-import { readConfigFile } from '../src/config'
+import {readConfigFile} from '../src/config'
 
 test('reads the config file', async () => {
-    let options = readConfigFile("./__tests__/fixtures/config-allow-sample.yml")
+  let options = readConfigFile('./__tests__/fixtures/config-allow-sample.yml')
   expect(options.fail_on_severity).toEqual('critical')
   expect(options.allow_licenses).toEqual(['BSD', 'GPL 2'])
 })
@@ -16,7 +16,7 @@ test('the default config path handles .yml and .yaml', async () => {
 })
 
 test('returns a default config when the config file was not found', async () => {
-    let options = readConfigFile("fixtures/i-dont-exist")
+  let options = readConfigFile('fixtures/i-dont-exist')
   expect(options.fail_on_severity).toEqual('low')
   expect(options.allow_licenses).toEqual([])
 })

__tests__/filter.test.ts

@@ -1,48 +1,48 @@
-import { expect, test } from '@jest/globals'
+import {expect, test} from '@jest/globals'
-import { Change, Changes } from '../src/schemas'
+import {Change, Changes} from '../src/schemas'
-import { filterChangesBySeverity } from '../src/filter'
+import {filterChangesBySeverity} from '../src/filter'
 
 let npmChange: Change = {
-    manifest: "package.json",
+  manifest: 'package.json',
-    change_type: "added",
+  change_type: 'added',
-    ecosystem: "npm",
+  ecosystem: 'npm',
-    name: "Reeuhq",
+  name: 'Reeuhq',
-    version: "1.0.2",
+  version: '1.0.2',
-    package_url: "somepurl",
+  package_url: 'somepurl',
-    license: "MIT",
+  license: 'MIT',
-    source_repository_url: "github.com/some-repo",
+  source_repository_url: 'github.com/some-repo',
   vulnerabilities: [
     {
-            severity: "critical",
+      severity: 'critical',
-            advisory_ghsa_id: "first-random_string",
+      advisory_ghsa_id: 'first-random_string',
-            advisory_summary: "very dangerouns",
+      advisory_summary: 'very dangerouns',
-            advisory_url: "github.com/future-funk"
+      advisory_url: 'github.com/future-funk'
     }
   ]
 }
 
 let rubyChange: Change = {
-    change_type: "added",
+  change_type: 'added',
-    manifest: "Gemfile.lock",
+  manifest: 'Gemfile.lock',
-    ecosystem: "rubygems",
+  ecosystem: 'rubygems',
-    name: "actionsomething",
+  name: 'actionsomething',
-    version: "3.2.0",
+  version: '3.2.0',
-    package_url: "somerubypurl",
+  package_url: 'somerubypurl',
-    license: "BSD",
+  license: 'BSD',
-    source_repository_url: "github.com/some-repo",
+  source_repository_url: 'github.com/some-repo',
   vulnerabilities: [
     {
-            severity: "moderate",
+      severity: 'moderate',
-            advisory_ghsa_id: "second-random_string",
+      advisory_ghsa_id: 'second-random_string',
-            advisory_summary: "not so dangerouns",
+      advisory_summary: 'not so dangerouns',
-            advisory_url: "github.com/future-funk"
+      advisory_url: 'github.com/future-funk'
     },
     {
-            severity: "low",
+      severity: 'low',
-            advisory_ghsa_id: "third-random_string",
+      advisory_ghsa_id: 'third-random_string',
-            advisory_summary: "dont page me",
+      advisory_summary: 'dont page me',
-            advisory_url: "github.com/future-funk"
+      advisory_url: 'github.com/future-funk'
-        },
+    }
   ]
 }
 

dist/index.js

@@ -1,74 +1,6 @@
 require('./sourcemap-register.js');/******/ (() => { // webpackBootstrap
 /******/ 	var __webpack_modules__ = ({
 
-/***/ 88:
-/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
-
-"use strict";
-
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.readConfigFile = exports.CONFIG_FILEPATH = exports.SEVERITIES = void 0;
-const fs = __importStar(__nccwpck_require__(7147));
-const yaml_1 = __importDefault(__nccwpck_require__(4083));
-const schemas_1 = __nccwpck_require__(8774);
-const path_1 = __importDefault(__nccwpck_require__(1017));
-exports.SEVERITIES = ["critical", "high", "moderate", "low"];
-exports.CONFIG_FILEPATH = "./.github/dep-review.yml";
-function readConfigFile(filePath = exports.CONFIG_FILEPATH) {
-    // By default we want to fail on all severities and allow all licenses.
-    const defaultOptions = {
-        fail_on_severity: 'low',
-        allow_licenses: []
-    };
-    let data;
-    try {
-        data = fs.readFileSync(path_1.default.resolve(filePath), "utf-8");
-    }
-    catch (error) {
-        if (error.code && error.code === 'ENOENT') {
-            return defaultOptions;
-        }
-        else {
-            throw error;
-        }
-    }
-    // This is a copy of line 34, not sure why this is failing!
-    schemas_1.ConfigurationOptionsSchema.parse({ fail_on_severity: 'critical', allow_licenses: ['BSD', 'GPL 2'] });
-    const values = yaml_1.default.parse(data);
-    const parsed = schemas_1.ConfigurationOptionsSchema.parse(values);
-    return parsed;
-}
-exports.readConfigFile = readConfigFile;
-
-
-/***/ }),
-
 /***/ 4966:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
@@ -277,9 +209,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = void 0;
+exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SEVERITIES = void 0;
 const z = __importStar(__nccwpck_require__(3301));
-const config_1 = __nccwpck_require__(88);
+exports.SEVERITIES = ['critical', 'high', 'moderate', 'low'];
 exports.ChangeSchema = z.object({
     change_type: z.enum(['added', 'removed']),
     manifest: z.string(),
@@ -304,11 +236,13 @@ exports.PullRequestSchema = z.object({
     base: z.object({ sha: z.string() }),
     head: z.object({ sha: z.string() })
 });
-exports.ConfigurationOptionsSchema = z.object({
+exports.ConfigurationOptionsSchema = z
-    fail_on_severity: z.enum(config_1.SEVERITIES).default("low"),
+    .object({
+    fail_on_severity: z.enum(exports.SEVERITIES).default('low'),
     allow_licenses: z.array(z.string()).default([]),
     deny_licenses: z.array(z.string()).default([])
-}).partial()
+})
+    .partial()
     .refine(obj => !(obj.allow_licenses && obj.deny_licenses), "Can't specify both allow_licenses and deny_licenses");
 exports.ChangesSchema = z.array(exports.ChangeSchema);
 
@@ -13694,13 +13628,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.readConfigFile = exports.CONFIG_FILEPATH = exports.SEVERITIES = void 0;
+exports.readConfigFile = exports.CONFIG_FILEPATH = void 0;
 const fs = __importStar(__nccwpck_require__(7147));
 const yaml_1 = __importDefault(__nccwpck_require__(4083));
 const schemas_1 = __nccwpck_require__(1129);
 const path_1 = __importDefault(__nccwpck_require__(1017));
-exports.SEVERITIES = ["critical", "high", "moderate", "low"];
+exports.CONFIG_FILEPATH = './.github/dep-review.yml';
-exports.CONFIG_FILEPATH = "./.github/dep-review.yml";
 function readConfigFile(filePath = exports.CONFIG_FILEPATH) {
     // By default we want to fail on all severities and allow all licenses.
     const defaultOptions = {
@@ -13709,7 +13642,7 @@ function readConfigFile(filePath = exports.CONFIG_FILEPATH) {
     };
     let data;
     try {
-        data = fs.readFileSync(path_1.default.resolve(filePath), "utf-8");
+        data = fs.readFileSync(path_1.default.resolve(filePath), 'utf-8');
     }
     catch (error) {
         if (error.code && error.code === 'ENOENT') {
@@ -13719,8 +13652,6 @@ function readConfigFile(filePath = exports.CONFIG_FILEPATH) {
             throw error;
         }
     }
-    // This is a copy of line 34, not sure why this is failing!
-    schemas_1.ConfigurationOptionsSchema.parse({ fail_on_severity: 'critical', allow_licenses: ['BSD', 'GPL 2'] });
     const values = yaml_1.default.parse(data);
     const parsed = schemas_1.ConfigurationOptionsSchema.parse(values);
     return parsed;
@@ -13737,24 +13668,24 @@ exports.readConfigFile = readConfigFile;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.filterChangesBySeverity = void 0;
-const config_1 = __nccwpck_require__(6373);
+const schemas_1 = __nccwpck_require__(1129);
 function filterChangesBySeverity(severity, changes) {
-    const severityIdx = config_1.SEVERITIES.indexOf(severity);
+    const severityIdx = schemas_1.SEVERITIES.indexOf(severity);
     for (let change of changes) {
         if (change === undefined ||
             change.vulnerabilities === undefined ||
             change.vulnerabilities.length === 0) {
             continue;
         }
-        change.vulnerabilities = change.vulnerabilities.filter((vuln) => {
+        change.vulnerabilities = change.vulnerabilities.filter(vuln => {
-            const vulnIdx = config_1.SEVERITIES.indexOf(vuln.severity);
+            const vulnIdx = schemas_1.SEVERITIES.indexOf(vuln.severity);
             if (vulnIdx <= severityIdx) {
                 return true;
             }
         });
     }
     // don't want to deal with changes with no vulnerabilities
-    let filteredChanges = changes.filter((change) => change.vulnerabilities.length > 0);
+    let filteredChanges = changes.filter(change => change.vulnerabilities.length > 0);
     return filteredChanges;
 }
 exports.filterChangesBySeverity = filterChangesBySeverity;
@@ -13791,9 +13722,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = void 0;
+exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SEVERITIES = void 0;
 const z = __importStar(__nccwpck_require__(3301));
-const config_1 = __nccwpck_require__(6373);
+exports.SEVERITIES = ['critical', 'high', 'moderate', 'low'];
 exports.ChangeSchema = z.object({
     change_type: z.enum(['added', 'removed']),
     manifest: z.string(),
@@ -13818,11 +13749,13 @@ exports.PullRequestSchema = z.object({
     base: z.object({ sha: z.string() }),
     head: z.object({ sha: z.string() })
 });
-exports.ConfigurationOptionsSchema = z.object({
+exports.ConfigurationOptionsSchema = z
-    fail_on_severity: z.enum(config_1.SEVERITIES).default("low"),
+    .object({
+    fail_on_severity: z.enum(exports.SEVERITIES).default('low'),
     allow_licenses: z.array(z.string()).default([]),
     deny_licenses: z.array(z.string()).default([])
-}).partial()
+})
+    .partial()
     .refine(obj => !(obj.allow_licenses && obj.deny_licenses), "Can't specify both allow_licenses and deny_licenses");
 exports.ChangesSchema = z.array(exports.ChangeSchema);
 

src/config.ts

@@ -1,14 +1,13 @@
 import * as fs from 'fs'
 import YAML from 'yaml'
-import { ConfigurationOptions, ConfigurationOptionsSchema } from './schemas'
+import {ConfigurationOptions, ConfigurationOptionsSchema} from './schemas'
 import path from 'path'
 
-export type Severity = "critical" | "high" | "moderate" | "low"
+export const CONFIG_FILEPATH = './.github/dep-review.yml'
 
-export const SEVERITIES = ["critical", "high", "moderate", "low"] as const
+export function readConfigFile(
-export const CONFIG_FILEPATH = "./.github/dep-review.yml"
+  filePath: string = CONFIG_FILEPATH
-
+): ConfigurationOptions {
-export function readConfigFile(filePath: string = CONFIG_FILEPATH): ConfigurationOptions {
   // By default we want to fail on all severities and allow all licenses.
   const defaultOptions: ConfigurationOptions = {
     fail_on_severity: 'low',
@@ -18,7 +17,7 @@ export function readConfigFile(filePath: string = CONFIG_FILEPATH): Configuratio
   let data
 
   try {
-        data = fs.readFileSync(path.resolve(filePath), "utf-8");
+    data = fs.readFileSync(path.resolve(filePath), 'utf-8')
   } catch (error: any) {
     if (error.code && error.code === 'ENOENT') {
       return defaultOptions
@@ -27,11 +26,8 @@ export function readConfigFile(filePath: string = CONFIG_FILEPATH): Configuratio
     }
   }
 
-    // This is a copy of line 34, not sure why this is failing!
-    ConfigurationOptionsSchema.parse({ fail_on_severity: 'critical', allow_licenses: ['BSD', 'GPL 2'] })
-
   const values = YAML.parse(data)
   const parsed = ConfigurationOptionsSchema.parse(values)
 
-    return parsed;
+  return parsed
 }

src/filter.ts

@@ -1,16 +1,21 @@
-import { Changes } from './schemas'
+import {Changes} from './schemas'
-import { Severity, SEVERITIES } from './config'
+import {Severity, SEVERITIES} from './schemas'
 
-export function filterChangesBySeverity(severity: Severity, changes: Changes): Changes {
+export function filterChangesBySeverity(
+  severity: Severity,
+  changes: Changes
+): Changes {
   const severityIdx = SEVERITIES.indexOf(severity)
 
   for (let change of changes) {
-        if (change === undefined ||
+    if (
+      change === undefined ||
       change.vulnerabilities === undefined ||
-            change.vulnerabilities.length === 0) {
+      change.vulnerabilities.length === 0
+    ) {
       continue
     }
-        change.vulnerabilities = change.vulnerabilities.filter((vuln: any) => {
+    change.vulnerabilities = change.vulnerabilities.filter(vuln => {
       const vulnIdx = SEVERITIES.indexOf(vuln.severity)
       if (vulnIdx <= severityIdx) {
         return true
@@ -19,6 +24,8 @@ export function filterChangesBySeverity(severity: Severity, changes: Changes): C
   }
 
   // don't want to deal with changes with no vulnerabilities
-    let filteredChanges = changes.filter((change: any) => change.vulnerabilities.length > 0)
+  let filteredChanges = changes.filter(
+    change => change.vulnerabilities.length > 0
+  )
   return filteredChanges
 }

src/main.ts

@@ -2,10 +2,10 @@ import * as core from '@actions/core'
 import * as dependencyGraph from './dependency-graph'
 import * as github from '@actions/github'
 import styles from 'ansi-styles'
-import { RequestError } from '@octokit/request-error'
+import {RequestError} from '@octokit/request-error'
-import { Change, PullRequestSchema } from './schemas'
+import {Change, PullRequestSchema, Severity} from './schemas'
-import { Severity, readConfigFile } from '../src/config'
+import {readConfigFile} from '../src/config'
-import { filterChangesBySeverity } from '../src/filter'
+import {filterChangesBySeverity} from '../src/filter'
 
 async function run(): Promise<void> {
   try {
@@ -30,7 +30,10 @@ async function run(): Promise<void> {
     let minSeverity = config.fail_on_severity
     let failed = false
 
-    let filteredChanges = filterChangesBySeverity(minSeverity as Severity, changes)
+    let filteredChanges = filterChangesBySeverity(
+      minSeverity as Severity,
+      changes
+    )
 
     for (const change of filteredChanges) {
       if (
@@ -70,7 +73,8 @@ async function run(): Promise<void> {
 function printChangeVulnerabilities(change: Change) {
   for (const vuln of change.vulnerabilities) {
     core.info(
-      `${styles.bold.open}${change.manifest} » ${change.name}@${change.version
+      `${styles.bold.open}${change.manifest} » ${change.name}@${
+        change.version
       }${styles.bold.close} – ${vuln.advisory_summary} ${renderSeverity(
         vuln.severity
       )}`

src/schemas.ts

@@ -1,5 +1,6 @@
 import * as z from 'zod'
-import { SEVERITIES } from './config'
+
+export const SEVERITIES = ['critical', 'high', 'moderate', 'low'] as const
 
 export const ChangeSchema = z.object({
   change_type: z.enum(['added', 'removed']),
@@ -25,19 +26,25 @@ export const ChangeSchema = z.object({
 
 export const PullRequestSchema = z.object({
   number: z.number(),
-  base: z.object({ sha: z.string() }),
+  base: z.object({sha: z.string()}),
-  head: z.object({ sha: z.string() })
+  head: z.object({sha: z.string()})
 })
 
-export const ConfigurationOptionsSchema = z.object({
+export const ConfigurationOptionsSchema = z
-  fail_on_severity: z.enum(SEVERITIES).default("low"),
+  .object({
+    fail_on_severity: z.enum(SEVERITIES).default('low'),
     allow_licenses: z.array(z.string()).default([]),
     deny_licenses: z.array(z.string()).default([])
-}).partial()
+  })
-  .refine(obj => !(obj.allow_licenses && obj.deny_licenses), "Can't specify both allow_licenses and deny_licenses")
+  .partial()
+  .refine(
+    obj => !(obj.allow_licenses && obj.deny_licenses),
+    "Can't specify both allow_licenses and deny_licenses"
+  )
 
 export const ChangesSchema = z.array(ChangeSchema)
 
 export type Change = z.infer<typeof ChangeSchema>
 export type Changes = z.infer<typeof ChangesSchema>
 export type ConfigurationOptions = z.infer<typeof ConfigurationOptionsSchema>
+export type Severity = typeof SEVERITIES[number]