Build source

Remove extra https://
Fix another incidence of the OpenSSF config name.
2024-04-23 17:31:55 +00:00 · 2024-04-23 17:26:55 +00:00 · 2024-03-28 06:54:16 +01:00 · 2024-03-28 06:52:47 +01:00 · 2024-03-27 17:18:17 -07:00 · 2024-03-26 08:04:16 +01:00
9 changed files with 78 additions and 39 deletions
@@ -77,14 +77,14 @@ Configure this action by either inlining these options in your workflow file, or
 | `vulnerability-check`                  | Enable or disable the vulnerability check performed by the action.                                                                                                                                      | `true`, `false`                                                                                              | `true`        |
 | `allow-dependencies-licenses`\*        | Contains a list of packages that will be excluded from license checks.                                                                                                                                  | Any package(s) in [purl](https://github.com/package-url/purl-spec) format                                    | none          |
 | `base-ref`/`head-ref`                  | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`.                        | Any valid git ref(s) in your project                                                                         | none          |
-| `comment-summary-in-pr`                | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job the `pull-requests: write` permission.                                       | `always`, `on-failure`, `never`                                                                              | `never`       |
+| `comment-summary-in-pr`                | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job the `pull-requests: write` permission.                                   | `always`, `on-failure`, `never`                                                                              | `never`       |
 | `deny-packages`                        | Any number of packages to block in a PR.                                                                                                                                                                | Package(s) in [purl](https://github.com/package-url/purl-spec) format                                        | empty         |
 | `deny-groups`                          | Any number of groups (namespaces) to block in a PR.                                                                                                                                                     | Namespace(s) in [purl](https://github.com/package-url/purl-spec) format (no package name, no version number) | empty         |
 | `retry-on-snapshot-warnings`\*         | Enable or disable retrying the action every 10 seconds while waiting for dependency submission actions to complete.                                                                                     | `true`, `false`                                                                                              | `false`       |
 | `retry-on-snapshot-warnings-timeout`\* | Maximum amount of time (in seconds) to retry the action while waiting for dependency submission actions to complete.                                                                                    | Any positive integer                                                                                         | 120           |
 | `warn-only`+                           | When set to `true`, the action will log all vulnerabilities as warnings regardless of the severity, and the action will complete with a `success` status. This overrides the `fail-on-severity` option. | `true`, `false`                                                                                              | `false`       |
-| `show-openssf-scorecard-levels`        | When set to `true`, the action will output information about all the known OpenSSF Scorecard scores for the dependencies changed in this pull request.                                                  | `true`, `false`                                                                                              | `true`        |
-| `warn-on-openssf-scorecard-level`      | When `show-openssf-scorecard-levels` is set to `true`, this option lets you configure the threshold for when a score is considered too low and gets a :warning: warning in the CI.                      | Any positive integer                                                                                         | 3             |
+| `show-openssf-scorecard`               | When set to `true`, the action will output information about all the known OpenSSF Scorecard scores for the dependencies changed in this pull request.                                                  | `true`, `false`                                                                                              | `true`        |
+| `warn-on-openssf-scorecard-level`      | When `show-openssf-scorecard` is set to `true`, this option lets you configure the threshold for when a score is considered too low and gets a :warning: warning in the CI.                      | Any positive integer                                                                                         | 3             |

 \*not supported for use with GitHub Enterprise Server

@@ -171,7 +171,7 @@ The Dependency Review GitHub Action check will only block a pull request from be
 > Action outputs are unicode strings [with a 1MB size limit](https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputs-for-docker-container-and-javascript-actions).

 > [!IMPORTANT]
-> If you use these outputs in a run-step, you must store the ouput data in an envrioment variable instead of using the output directly. Using an output directly might break shell scripts. For example:
+> If you use these outputs in a run-step, you must store the output data in an environment variable instead of using the output directly. Using an output directly might break shell scripts. For example:
 >
 > ```yaml
 > env:
@@ -22,6 +22,19 @@ const npmChange: Change = {
  ]
 }

+const actionsChange: Change = {
+  manifest: 'workflow.yml',
+  change_type: 'added',
+  ecosystem: 'actions',
+  name: 'actions/checkout/',
+  version: 'v3',
+  package_url: 'pkg:githubactions/actions@v3',
+  license: 'MIT',
+  source_repository_url: 'null',
+  scope: 'runtime',
+  vulnerabilities: []
+}
+
 test('Get scorecard from API', async () => {
  const changes: Changes = [npmChange]
  const scorecard = await getScorecardLevels(changes)
@@ -38,3 +51,11 @@ test('Get project URL from deps.dev API', async () => {
  )
  expect(result).not.toBeNull()
 })
+
+test('Handles Actions special case', async () => {
+  const changes: Changes = [actionsChange]
+  const result = await getScorecardLevels(changes)
+  expect(result).not.toBeNull()
+  expect(result.dependencies).toHaveLength(1)
+  expect(result.dependencies[0].scorecard?.score).toBeGreaterThan(0)
+})
@@ -1,5 +1,13 @@
-# Avoid using default values for options here since they will
-# end up overriding external configurations.
+# IMPORTANT
+#
+# Avoid setting default values for configuration options in
+# this file, they will overwrite external configurations.
+#
+# If you are trying to find out the default value for a config
+# option please take a look at the README or src/schemas.ts.
+#
+# If you are adding an option, make sure the Zod definition
+# contains a default value.
 name: 'Dependency Review'
 description: 'Prevent the introduction of dependencies with known vulnerabilities'
 author: 'GitHub'
@@ -56,23 +64,18 @@ inputs:
  retry-on-snapshot-warnings:
    description: Whether to retry on snapshot warnings
    required: false
-    default: false
  retry-on-snapshot-warnings-timeout:
    description: Number of seconds to wait before stopping snapshot retries.
    required: false
-    default: 120
  warn-only:
    description: When set to `true` this action will always complete with success, overriding the `fail-on-severity` parameter.
    required: false
-    default: false
  show-openssf-scorecard:
    description: Show a summary of the OpenSSF Scorecard scores.
    required: false
-    default: true
  warn-on-openssf-scorecard-level:
    description: Numeric threshold for the OpenSSF Scorecard score. If the score is below this threshold, the action will warn you.
    required: false
-    default: 3
 outputs:
  comment-content:
    description: Prepared dependency report comment
@@ -1043,8 +1043,15 @@ function getScorecardLevels(changes) {
            if (repositoryUrl === null || repositoryUrl === void 0 ? void 0 : repositoryUrl.startsWith('https://')) {
                repositoryUrl = repositoryUrl.replace('https://', '');
            }
+            // Handle the special case for GitHub Actions, where the repository URL is null
+            if (ecosystem === 'actions') {
+                // The package name for GitHub Actions in the API is in the format `owner/repo/`, so we can use that to get the repository URL
+                // If the package name has more than 2 slashes, it's referencing a sub-action, and we need to strip the last part out
+                const parts = packageName.split('/');
+                repositoryUrl = `github.com/${parts[0]}/${parts[1]}`; // e.g. github.com/actions/checkout
+            }
            // If GitHub API doesn't have the repository URL, query deps.dev for it.
-            if (repositoryUrl) {
+            if (!repositoryUrl) {
                // Call the deps.dev API to get the repository URL from there
                repositoryUrl = yield getProjectUrl(ecosystem, packageName, version);
            }
@@ -1069,7 +1076,7 @@ function getScorecardLevels(changes) {
 exports.getScorecardLevels = getScorecardLevels;
 function getScorecard(repositoryUrl) {
    return __awaiter(this, void 0, void 0, function* () {
-        const apiRoot = 'https://api.securityscorecards.dev/';
+        const apiRoot = 'https://api.securityscorecards.dev';
        let scorecardResponse = {};
        const url = `${apiRoot}/projects/${repositoryUrl}`;
        const response = yield fetch(url);
@@ -1351,7 +1358,7 @@ function addScorecardToSummary(scorecard, config) {
                    : ':green_circle:';
        }
        //Add a row for the dependency
-        core.summary.addRaw(`<tr><td>${dependency.change.source_repository_url ? `<a href="https://${dependency.change.source_repository_url}">` : ''} ${dependency.change.ecosystem}/${dependency.change.name} ${dependency.change.source_repository_url ? `</a>` : ''}</td><td>${dependency.change.version}</td>
+        core.summary.addRaw(`<tr><td>${dependency.change.source_repository_url ? `<a href="${dependency.change.source_repository_url}">` : ''} ${dependency.change.ecosystem}/${dependency.change.name} ${dependency.change.source_repository_url ? `</a>` : ''}</td><td>${dependency.change.version}</td>
      <td>${overallIcon} ${((_d = dependency.scorecard) === null || _d === void 0 ? void 0 : _d.score) === undefined || ((_e = dependency.scorecard) === null || _e === void 0 ? void 0 : _e.score) === null ? 'Unknown' : (_f = dependency.scorecard) === null || _f === void 0 ? void 0 : _f.score}</td>`, false);
        //Add details table in the last column
        if (((_g = dependency.scorecard) === null || _g === void 0 ? void 0 : _g.checks) !== undefined) {
@@ -1,12 +1,12 @@
 {
  "name": "dependency-review-action",
-  "version": "4.2.3",
+  "version": "4.2.5",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "dependency-review-action",
-      "version": "4.2.3",
+      "version": "4.2.5",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^1.10.1",
@@ -33,7 +33,7 @@
        "@typescript-eslint/parser": "^6.21.0",
        "@vercel/ncc": "^0.38.0",
        "esbuild-register": "^3.5.0",
-        "eslint": "^8.56.0",
+        "eslint": "^8.57.0",
        "eslint-plugin-github": "^4.10.1",
        "eslint-plugin-jest": "^27.9.0",
        "eslint-plugin-prettier": "^5.1.3",
@@ -1096,9 +1096,9 @@
      }
    },
    "node_modules/@eslint/js": {
-      "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.56.0.tgz",
-      "integrity": "sha512-gMsVel9D7f2HLkBma9VbtzZRehRogVRfbr++f06nL2vnCGCNlzOD+/MUov/F4p8myyAHspEhVobgjpX64q5m6A==",
+      "version": "8.57.0",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.57.0.tgz",
+      "integrity": "sha512-Ys+3g2TaW7gADOJzPt83SJtCDhMjndcDMFVQ/Tj9iA1BfJzFKD9mAUXT3OenpuPHbI6P/myECxRJrofUsDx/5g==",
      "dev": true,
      "engines": {
        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
@@ -1119,13 +1119,13 @@
      "dev": true
    },
    "node_modules/@humanwhocodes/config-array": {
-      "version": "0.11.13",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.13.tgz",
-      "integrity": "sha512-JSBDMiDKSzQVngfRjOdFXgFfklaXI4K9nLF49Auh21lmBWRLIK3+xTErTWD4KU54pb6coM6ESE7Awz/FNU3zgQ==",
+      "version": "0.11.14",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.14.tgz",
+      "integrity": "sha512-3T8LkOmg45BV5FICb15QQMsyUSWrQ8AygVfC7ZG32zOalnqrilm018ZVCw0eapXux8FtA33q8PSRSstjee3jSg==",
      "dev": true,
      "dependencies": {
-        "@humanwhocodes/object-schema": "^2.0.1",
-        "debug": "^4.1.1",
+        "@humanwhocodes/object-schema": "^2.0.2",
+        "debug": "^4.3.1",
        "minimatch": "^3.0.5"
      },
      "engines": {
@@ -1146,9 +1146,9 @@
      }
    },
    "node_modules/@humanwhocodes/object-schema": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.1.tgz",
-      "integrity": "sha512-dvuCeX5fC9dXgJn9t+X5atfmgQAzUOWqS1254Gh0m6i8wKd10ebXkfNKiRK+1GWi/yTvvLDHpoxLr0xxxeslWw==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.2.tgz",
+      "integrity": "sha512-6EwiSjwWYP7pTckG6I5eyFANjPhmPjUX9JRLUSfNPC7FX7zK9gyZAfUEaECL6ALTpGX5AjnBq3C9XmVWPitNpw==",
      "dev": true
    },
    "node_modules/@istanbuljs/load-nyc-config": {
@@ -3542,16 +3542,16 @@
      }
    },
    "node_modules/eslint": {
-      "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.56.0.tgz",
-      "integrity": "sha512-Go19xM6T9puCOWntie1/P997aXxFsOi37JIHRWI514Hc6ZnaHGKY9xFhrU65RT6CcBEzZoGG1e6Nq+DT04ZtZQ==",
+      "version": "8.57.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.57.0.tgz",
+      "integrity": "sha512-dZ6+mexnaTIbSBZWgou51U6OmzIhYM2VcNdtiTtI7qPNZm35Akpr0f6vtw3w1Kmn5PYo+tZVfh13WrhpS6oLqQ==",
      "dev": true,
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.2.0",
        "@eslint-community/regexpp": "^4.6.1",
        "@eslint/eslintrc": "^2.1.4",
-        "@eslint/js": "8.56.0",
-        "@humanwhocodes/config-array": "^0.11.13",
+        "@eslint/js": "8.57.0",
+        "@humanwhocodes/config-array": "^0.11.14",
        "@humanwhocodes/module-importer": "^1.0.1",
        "@nodelib/fs.walk": "^1.2.8",
        "@ungap/structured-clone": "^1.2.0",
@@ -1,6 +1,6 @@
 {
  "name": "dependency-review-action",
-  "version": "4.2.3",
+  "version": "4.2.5",
  "private": true,
  "description": "A GitHub Action for Dependency Review",
  "main": "lib/main.js",
@@ -49,7 +49,7 @@
    "@typescript-eslint/parser": "^6.21.0",
    "@vercel/ncc": "^0.38.0",
    "esbuild-register": "^3.5.0",
-    "eslint": "^8.56.0",
+    "eslint": "^8.57.0",
    "eslint-plugin-github": "^4.10.1",
    "eslint-plugin-jest": "^27.9.0",
    "eslint-plugin-prettier": "^5.1.3",
@@ -17,8 +17,16 @@ export async function getScorecardLevels(
      repositoryUrl = repositoryUrl.replace('https://', '')
    }

+    // Handle the special case for GitHub Actions, where the repository URL is null
+    if (ecosystem === 'actions') {
+      // The package name for GitHub Actions in the API is in the format `owner/repo/`, so we can use that to get the repository URL
+      // If the package name has more than 2 slashes, it's referencing a sub-action, and we need to strip the last part out
+      const parts = packageName.split('/')
+      repositoryUrl = `github.com/${parts[0]}/${parts[1]}` // e.g. github.com/actions/checkout
+    }
+
    // If GitHub API doesn't have the repository URL, query deps.dev for it.
-    if (repositoryUrl) {
+    if (!repositoryUrl) {
      // Call the deps.dev API to get the repository URL from there
      repositoryUrl = await getProjectUrl(ecosystem, packageName, version)
    }
@@ -41,7 +49,7 @@ export async function getScorecardLevels(
 }

 async function getScorecard(repositoryUrl: string): Promise<ScorecardApi> {
-  const apiRoot = 'https://api.securityscorecards.dev/'
+  const apiRoot = 'https://api.securityscorecards.dev'
  let scorecardResponse: ScorecardApi = {} as ScorecardApi

  const url = `${apiRoot}/projects/${repositoryUrl}`
@@ -304,7 +304,7 @@ export function addScorecardToSummary(

    //Add a row for the dependency
    core.summary.addRaw(
-      `<tr><td>${dependency.change.source_repository_url ? `<a href="https://${dependency.change.source_repository_url}">` : ''} ${dependency.change.ecosystem}/${dependency.change.name} ${dependency.change.source_repository_url ? `</a>` : ''}</td><td>${dependency.change.version}</td>
+      `<tr><td>${dependency.change.source_repository_url ? `<a href="${dependency.change.source_repository_url}">` : ''} ${dependency.change.ecosystem}/${dependency.change.name} ${dependency.change.source_repository_url ? `</a>` : ''}</td><td>${dependency.change.version}</td>
      <td>${overallIcon} ${dependency.scorecard?.score === undefined || dependency.scorecard?.score === null ? 'Unknown' : dependency.scorecard?.score}</td>`,
      false
    )
Author	SHA1	Message	Date
Justin Hutchings	16a0212a77	Build source	2024-04-23 17:31:55 +00:00
Justin Hutchings	6d3fba9bf2	Remove extra https://	2024-04-23 17:26:55 +00:00
Federico Builes	2ce029c676	Fix another incidence of the OpenSSF config name.	2024-03-28 06:54:16 +01:00
Federico Builes	1c949fbe77	Merge pull request #735 from StacklokLabs/rename-openssf-scorecard Readme action variable name for scorecard is wrong	2024-03-28 06:52:47 +01:00
Luke Hinds	bddd13d857	Readme action variable name for scorecard is wrong The actual name from action.yaml is `show-openssf-scorecard` and not `show-openssf-scorecard-levels` Signed-off-by: Luke Hinds <luke@stacklok.com>	2024-03-27 17:18:17 -07:00
Federico Builes	5bbc3ba658	bumping version	2024-03-26 08:04:16 +01:00
Federico Builes	c59184aa7f	Merge pull request #722 from actions/remove-warn-default Revert default values in action.yml to fix external configs	2024-03-26 07:55:00 +01:00
Federico Builes	54c06574f4	Merge pull request #728 from actions/dependabot/npm_and_yarn/eslint-8.57.0 Bump eslint from 8.56.0 to 8.57.0	2024-03-25 06:27:19 +01:00
dependabot[bot]	21941b530b	Bump eslint from 8.56.0 to 8.57.0 Bumps [eslint](https://github.com/eslint/eslint) from 8.56.0 to 8.57.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.56.0...v8.57.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2024-03-25 01:27:32 +00:00
Federico Builes	733dd5d4a5	bumping to 4.2.4	2024-03-24 14:59:17 +01:00
Federico Builes	9093495859	Merge pull request #725 from actions/issue-718 Bug fixes to #718	2024-03-24 14:56:57 +01:00
Justin Hutchings	35b83b4207	Fix prettier issues	2024-03-22 21:59:08 +00:00
Justin Hutchings	e057056594	Add packaged code update	2024-03-22 21:31:00 +00:00
Justin Hutchings	d684d038b2	Add trailing slash to tests	2024-03-22 21:21:52 +00:00
Justin Hutchings	2b0aaf1638	Fix extra slash issue	2024-03-22 21:20:15 +00:00
Justin Hutchings	d9209374af	Fix repositoryUrl issues around GitHub Actions	2024-03-22 21:00:38 +00:00
Federico Builes	651d22c5d5	Revert default values in action.yml to fix external configs.	2024-03-22 08:29:26 +01:00
Eli Reisman	02b13f6b52	Merge pull request #721 from sporkmonger/patch-1 Typo fixes in README	2024-03-21 17:18:11 -07:00
Bob Aman	6e0fa26ac3	Typo fixes Fixed a couple spelling errors.	2024-03-21 16:37:36 -07:00