Update CONTRIBUTING.md

minor wording

CONTRIBUTING.md

@@ -16,7 +16,7 @@ If you've encountered a problem, please let us know by [submitting an issue](htt
 
 ## Enhancements and feature requests
 
-If you've got an idea for a new feature, please submit as [an issue](https://github.com/actions/dependency-review-action/issues/new) so that the community can see it, and we can discuss it there. We may not be able to respond to every single issue, but will make a best effort!
+If you've got an idea for a new feature or a significant change to the code or its dependencies, please submit as [an issue](https://github.com/actions/dependency-review-action/issues/new) so that the community can see it, and we can discuss it there. We may not be able to respond to every single issue, but will make a best effort!
 
 If you'd like to make a contribution yourself, we ask that before significant effort is put into code changes, that we have agreement that the change aligns with our strategy for the action. Since this is a verified Action owned by GitHub we want to make sure that contributions are high quality, and that they maintain consistency with the rest of the action's behavior.
 

__tests__/config.test.ts

@@ -124,6 +124,51 @@ test('it raises an error when no refs are provided and the event is not a pull r
   ).toThrow()
 })
 
+const pullRequestLikeEvents = [
+  'pull_request',
+  'pull_request_target',
+  'merge_group'
+]
+
+test.each(pullRequestLikeEvents)(
+  'it uses the given refs even when the event is %s',
+  async eventName => {
+    setInput('base-ref', 'a-custom-base-ref')
+    setInput('head-ref', 'a-custom-head-ref')
+
+    const refs = getRefs(await readConfig(), {
+      payload: {
+        pull_request: {
+          number: 42,
+          base: {sha: 'pr-base-ref'},
+          head: {sha: 'pr-head-ref'}
+        }
+      },
+      eventName
+    })
+    expect(refs.base).toEqual('a-custom-base-ref')
+    expect(refs.head).toEqual('a-custom-head-ref')
+  }
+)
+
+test.each(pullRequestLikeEvents)(
+  'it uses the event refs when the event is %s and the no refs are input',
+  async eventName => {
+    const refs = getRefs(await readConfig(), {
+      payload: {
+        pull_request: {
+          number: 42,
+          base: {sha: 'pr-base-ref'},
+          head: {sha: 'pr-head-ref'}
+        }
+      },
+      eventName
+    })
+    expect(refs.base).toEqual('pr-base-ref')
+    expect(refs.head).toEqual('pr-head-ref')
+  }
+)
+
 test('it defaults to runtime scope', async () => {
   const config = await readConfig()
   expect(config.fail_on_scopes).toEqual(['runtime'])

__tests__/spdx.test.ts

@@ -1,7 +1,7 @@
-import {expect, test} from '@jest/globals'
+import {expect, test, describe} from '@jest/globals'
 import * as spdx from '../src/spdx'
 
-test('satisfiesAny', () => {
+describe('satisfiesAny', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -59,17 +59,14 @@ test('satisfiesAny', () => {
   ]
 
   for (const unit of units) {
-    let got: boolean = spdx.satisfiesAny(unit.candidate, unit.licenses)
-    if (got != unit.expected) {
-      console.log(
-        `failing unit test inputs: candidate(${unit.candidate}) licenses(${unit.licenses})`
-      )
-    }
-    expect(got).toBe(unit.expected)
+    const got: boolean = spdx.satisfiesAny(unit.candidate, unit.licenses)
+    test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.licenses}")`, () => {
+      expect(got).toBe(unit.expected)
+    })
   }
 })
 
-test('satisfiesAll', () => {
+describe('satisfiesAll', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -137,17 +134,14 @@ test('satisfiesAll', () => {
   ]
 
   for (const unit of units) {
-    let got: boolean = spdx.satisfiesAll(unit.candidate, unit.licenses)
-    if (got != unit.expected) {
-      console.log(
-        `failing unit test inputs: candidate(${unit.candidate}) licenses(${unit.licenses})`
-      )
-    }
-    expect(got).toBe(unit.expected)
+    const got: boolean = spdx.satisfiesAll(unit.candidate, unit.licenses)
+    test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.licenses}")`, () => {
+      expect(got).toBe(unit.expected)
+    })
   }
 })
 
-test('satisfies', () => {
+describe('satisfies', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -220,17 +214,14 @@ test('satisfies', () => {
   ]
 
   for (const unit of units) {
-    let got: boolean = spdx.satisfies(unit.candidate, unit.constraint)
-    if (got != unit.expected) {
-      console.log(
-        `failing unit test inputs: candidateExpr(${unit.candidate}) constraintExpr(${unit.constraint})`
-      )
-    }
-    expect(got).toBe(unit.expected)
+    const got: boolean = spdx.satisfies(unit.candidate, unit.constraint)
+    test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.constraint}")`, () => {
+      expect(got).toBe(unit.expected)
+    })
   }
 })
 
-test('isValid', () => {
+describe('isValid', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -258,10 +249,9 @@ test('isValid', () => {
     }
   ]
   for (const unit of units) {
-    let got: boolean = spdx.isValid(unit.candidate)
-    if (got != unit.expected) {
-      console.log(`failing unit test inputs: candidateExpr(${unit.candidate})`)
-    }
-    expect(got).toBe(unit.expected)
+    const got: boolean = spdx.isValid(unit.candidate)
+    test(`should return ${unit.expected} for ("${unit.candidate}")`, () => {
+      expect(got).toBe(unit.expected)
+    })
   }
 })

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "dependency-review-action",
-  "version": "4.3.3",
+  "version": "4.3.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dependency-review-action",
-      "version": "4.3.3",
+      "version": "4.3.4",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.1",
@@ -15,14 +15,14 @@
         "@octokit/request-error": "^5.0.1",
         "@onebeyond/spdx-license-satisfies": "^1.0.1",
         "ansi-styles": "^6.2.1",
-        "got": "^14.2.0",
+        "got": "^14.4.1",
         "jest": "^29.7.0",
         "octokit": "^3.1.2",
         "spdx-expression-parse": "^3.0.1",
         "spdx-satisfies": "^5.0.1",
         "ts-jest": "^29.1.2",
         "yaml": "^2.3.4",
-        "zod": "^3.22.3"
+        "zod": "^3.23.8"
       },
       "devDependencies": {
         "@types/jest": "^29.5.12",
@@ -1945,15 +1945,20 @@
         "url": "https://opencollective.com/unts"
       }
     },
+    "node_modules/@sec-ant/readable-stream": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/@sec-ant/readable-stream/-/readable-stream-0.4.1.tgz",
+      "integrity": "sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg=="
+    },
     "node_modules/@sinclair/typebox": {
       "version": "0.27.8",
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.8.tgz",
       "integrity": "sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA=="
     },
     "node_modules/@sindresorhus/is": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-6.1.0.tgz",
-      "integrity": "sha512-BuvU07zq3tQ/2SIgBsEuxKYDyDjC0n7Zir52bpHy2xnBbW81+po43aLFPLbeV3HRAheFbGud1qgcqSYfhtHMAg==",
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-6.3.1.tgz",
+      "integrity": "sha512-FX4MfcifwJyFOI2lPoX7PQxCqx8BG1HCho7WdiXwpEQx1Ycij0JxkfYtGK7yqNScrZGSlt6RE6sw8QYoH7eKnQ==",
       "engines": {
         "node": ">=16"
       },
@@ -2811,11 +2816,11 @@
       }
     },
     "node_modules/braces": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
-      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
       "dependencies": {
-        "fill-range": "^7.0.1"
+        "fill-range": "^7.1.1"
       },
       "engines": {
         "node": ">=8"
@@ -2895,20 +2900,46 @@
       }
     },
     "node_modules/cacheable-request": {
-      "version": "10.2.14",
-      "resolved": "https://registry.npmjs.org/cacheable-request/-/cacheable-request-10.2.14.tgz",
-      "integrity": "sha512-zkDT5WAF4hSSoUgyfg5tFIxz8XQK+25W/TLVojJTMKBaxevLBBtLxgqguAuVQB8PVW79FVjHcU+GJ9tVbDZ9mQ==",
+      "version": "12.0.1",
+      "resolved": "https://registry.npmjs.org/cacheable-request/-/cacheable-request-12.0.1.tgz",
+      "integrity": "sha512-Yo9wGIQUaAfIbk+qY0X4cDQgCosecfBe3V9NSyeY4qPC2SAkbCS4Xj79VP8WOzitpJUZKc/wsRCYF5ariDIwkg==",
       "dependencies": {
-        "@types/http-cache-semantics": "^4.0.2",
-        "get-stream": "^6.0.1",
+        "@types/http-cache-semantics": "^4.0.4",
+        "get-stream": "^9.0.1",
         "http-cache-semantics": "^4.1.1",
-        "keyv": "^4.5.3",
+        "keyv": "^4.5.4",
         "mimic-response": "^4.0.0",
-        "normalize-url": "^8.0.0",
+        "normalize-url": "^8.0.1",
         "responselike": "^3.0.0"
       },
       "engines": {
-        "node": ">=14.16"
+        "node": ">=18"
+      }
+    },
+    "node_modules/cacheable-request/node_modules/get-stream": {
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-9.0.1.tgz",
+      "integrity": "sha512-kVCxPF3vQM/N0B1PmoqVUqgHP+EeVjmZSQn+1oCRPxd2P21P2F19lIgbR3HBosbB1PUhOAoctJnfEn2GbN2eZA==",
+      "dependencies": {
+        "@sec-ant/readable-stream": "^0.4.1",
+        "is-stream": "^4.0.1"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/cacheable-request/node_modules/is-stream": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-4.0.1.tgz",
+      "integrity": "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A==",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/call-bind": {
@@ -4485,9 +4516,9 @@
       }
     },
     "node_modules/fill-range": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
-      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
       "dependencies": {
         "to-regex-range": "^5.0.1"
       },
@@ -4761,21 +4792,22 @@
       }
     },
     "node_modules/got": {
-      "version": "14.2.0",
-      "resolved": "https://registry.npmjs.org/got/-/got-14.2.0.tgz",
-      "integrity": "sha512-dBq2KkHcQl3AwPoIWsLsQScCPpUgRulz1qZVthjPYKYOPmYfBnekR3vxecjZbm91Vc3JUGnV9mqFX7B+Fe2quw==",
+      "version": "14.4.1",
+      "resolved": "https://registry.npmjs.org/got/-/got-14.4.1.tgz",
+      "integrity": "sha512-IvDJbJBUeexX74xNQuMIVgCRRuNOm5wuK+OC3Dc2pnSoh1AOmgc7JVj7WC+cJ4u0aPcO9KZ2frTXcqK4W/5qTQ==",
       "dependencies": {
-        "@sindresorhus/is": "^6.1.0",
+        "@sindresorhus/is": "^6.3.1",
         "@szmarczak/http-timer": "^5.0.1",
         "cacheable-lookup": "^7.0.0",
-        "cacheable-request": "^10.2.14",
+        "cacheable-request": "^12.0.1",
         "decompress-response": "^6.0.0",
         "form-data-encoder": "^4.0.2",
         "get-stream": "^8.0.1",
         "http2-wrapper": "^2.2.1",
         "lowercase-keys": "^3.0.0",
         "p-cancelable": "^4.0.1",
-        "responselike": "^3.0.0"
+        "responselike": "^3.0.0",
+        "type-fest": "^4.19.0"
       },
       "engines": {
         "node": ">=20"
@@ -4795,6 +4827,17 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/got/node_modules/type-fest": {
+      "version": "4.20.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.20.0.tgz",
+      "integrity": "sha512-MBh+PHUHHisjXf4tlx0CFWoMdjx8zCMLJHOjnV1prABYZFHqtFOyauCIK2/7w4oIfwkF8iNhLtnJEfVY2vn3iw==",
+      "engines": {
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/graceful-fs": {
       "version": "4.2.11",
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
@@ -6441,9 +6484,9 @@
       }
     },
     "node_modules/normalize-url": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.0.0.tgz",
-      "integrity": "sha512-uVFpKhj5MheNBJRTiMZ9pE/7hD1QTeEvugSJW/OmLzAp78PB5O6adfMNTvmfKhXBkvCzC+rqifWcVYpGFwTjnw==",
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.0.1.tgz",
+      "integrity": "sha512-IO9QvjUMWxPQQhs60oOu10CRkWCiZzSUkzbXGGV9pviYl1fXYcvkzQ5jV9z8Y6un8ARoVRl4EtC6v6jNqbaJ/w==",
       "engines": {
         "node": ">=14.16"
       },
@@ -7859,9 +7902,9 @@
       "dev": true
     },
     "node_modules/undici": {
-      "version": "5.28.3",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.3.tgz",
-      "integrity": "sha512-3ItfzbrhDlINjaP0duwnNsKpDQk3acHI3gVJ1z4fmwMK31k5G9OVIAMLSIaP6w4FaGkaAkN6zaQO9LUvZ1t7VA==",
+      "version": "5.28.4",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.4.tgz",
+      "integrity": "sha512-72RFADWFqKmUb2hmmvNODKL3p9hcB6Gt2DOQMis1SEBaV6a4MH8soBvzg+95CYhCKPFedut2JY9bMfrDl9D23g==",
       "dependencies": {
         "@fastify/busboy": "^2.0.0"
       },
@@ -8166,9 +8209,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "3.22.4",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.22.4.tgz",
-      "integrity": "sha512-iC+8Io04lddc+mVqQ9AZ7OQ2MrUKGN+oIQyq1vemgt46jwCwLfhq7/pwnBnNXXXZb8VTVLKwp9EDkx+ryxIWmg==",
+      "version": "3.23.8",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.23.8.tgz",
+      "integrity": "sha512-XBx9AXhXktjUqnepgTiE5flcKIYWi/rme0Eaj+5Y0lftuGBq+jyRu/md4WnuxqgP1ubdpNCsYEYPxrzVHD8d6g==",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "4.3.3",
+  "version": "4.3.4",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",
@@ -31,14 +31,14 @@
     "@octokit/request-error": "^5.0.1",
     "@onebeyond/spdx-license-satisfies": "^1.0.1",
     "ansi-styles": "^6.2.1",
-    "got": "^14.2.0",
+    "got": "^14.4.1",
     "jest": "^29.7.0",
     "octokit": "^3.1.2",
     "spdx-expression-parse": "^3.0.1",
     "spdx-satisfies": "^5.0.1",
     "ts-jest": "^29.1.2",
     "yaml": "^2.3.4",
-    "zod": "^3.22.3"
+    "zod": "^3.23.8"
   },
   "devDependencies": {
     "@types/jest": "^29.5.12",

src/git-refs.ts

@@ -11,7 +11,8 @@ export function getRefs(
   // The base/head ref from the config take priority, if provided.
   if (
     context.eventName === 'pull_request' ||
-    context.eventName === 'pull_request_target'
+    context.eventName === 'pull_request_target' ||
+    context.eventName === 'merge_group'
   ) {
     const pull_request = PullRequestSchema.parse(context.payload.pull_request)
     base_ref = base_ref || pull_request.base.sha
@@ -22,19 +23,19 @@ export function getRefs(
     throw new Error(
       'Both a base ref and head ref must be provided, either via the `base_ref`/`head_ref` ' +
         'config options, `base-ref`/`head-ref` workflow action options, or by running a ' +
-        '`pull_request`/`pull_request_target` workflow.'
+        '`pull_request`/`pull_request_target`/`merge_group` workflow.'
     )
   } else if (!base_ref) {
     throw new Error(
       'A base ref must be provided, either via the `base_ref` config option, ' +
         '`base-ref` workflow action option, or by running a ' +
-        '`pull_request`/`pull_request_target` workflow.'
+        '`pull_request`/`pull_request_target`/`merge_group` workflow.'
     )
   } else if (!head_ref) {
     throw new Error(
       'A head ref must be provided, either via the `head_ref` config option, ' +
         '`head-ref` workflow action option, or by running a ' +
-        'or by running a `pull_request`/`pull_request_target` workflow.'
+        'or by running a `pull_request`/`pull_request_target`/`merge_group` workflow.'
     )
   }
 

src/main.ts

@@ -125,7 +125,9 @@ async function run(): Promise<void> {
       config.deny_groups
     )
 
-    const scorecard = await getScorecardLevels(filteredChanges)
+    // generate informational scorecard entries for all added changes in the PR
+    const scorecardChanges = getScorecardChanges(changes)
+    const scorecard = await getScorecardLevels(scorecardChanges)
 
     const minSummary = summary.addSummaryToSummary(
       vulnerableChanges,
@@ -369,7 +371,7 @@ function printScannedDependencies(changes: Changes): void {
 }
 
 function printDeniedDependencies(
-  changes: Change[],
+  changes: Changes,
   config: ConfigurationOptions
 ): void {
   core.group('Denied', async () => {
@@ -384,6 +386,17 @@ function printDeniedDependencies(
   })
 }
 
+function getScorecardChanges(changes: Changes): Changes {
+  const out: Changes = []
+  for (const change of changes) {
+    if (change.change_type === 'added') {
+      out.push(change)
+    }
+  }
+
+  return out
+}
+
 async function createScorecardWarnings(
   scorecards: Scorecard,
   config: ConfigurationOptions

types/spdx-license-satisfies.d.ts

@@ -13,6 +13,4 @@ declare module '@onebeyond/spdx-license-satisfies' {
     candidateExpr: string,
     licenses: string[]
   ): boolean
-
-  export function isValid(candidateExpr: string): boolean
 }