adding spdx-satisfies

2022-10-04 15:46:53 +02:00
39 changed files with 3787 additions and 38106 deletions
@@ -1,9 +0,0 @@
-{
-  "name": "Dependency Review Action",
-  "image": "mcr.microsoft.com/devcontainers/typescript-node:18",
-  "postCreateCommand": "npm install",
-  "remoteUser": "node",
-  "features": {
-    "ghcr.io/devcontainers/features/ruby:1": {}
-  }
-}
@@ -3,12 +3,12 @@ updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
-      interval: weekly
+      interval: daily

  - package-ecosystem: npm
    directory: /
    schedule:
-      interval: weekly
+      interval: daily
    ignore:
      - dependency-name: '@types/node'
        update-types: ['version-update:semver-major']
@@ -0,0 +1 @@
+fail-on-severity: low
@@ -23,11 +23,10 @@ jobs:
    steps:
      - uses: actions/checkout@v3

-      - name: Set Node.js 18.x
+      - name: Set Node.js 16.x
        uses: actions/setup-node@v3
        with:
-          node-version: 18.x
-          cache: npm
+          node-version: 16.x

      - name: Install dependencies
        run: npm ci
@@ -17,7 +17,7 @@ jobs:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
-          node-version: 18
+          node-version: 16
          cache: npm
      - name: Install dependencies
        run: npm ci --ignore-scripts
@@ -30,7 +30,7 @@ jobs:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
-          node-version: 18
+          node-version: 16
          cache: npm
      - name: Install dependencies
        run: npm ci --ignore-scripts
@@ -100,5 +100,3 @@ Thumbs.db
 # Ignore built ts files
 __tests__/runner/*
 lib/**/*
-
-tmp
@@ -1,5 +1,4 @@
 # Contributing
-
 [fork]: https://github.com/actions/dependency-review-action/fork
 [pr]: https://github.com/actions/dependency-review-action/compare
 [code-of-conduct]: CODE_OF_CONDUCT.md
@@ -10,6 +9,7 @@ Contributions to this project are
 [released](https://help.github.com/articles/github-terms-of-service/#6-contributions-under-repository-license)
 to the public under the [project's open source license](LICENSE).

+
 Please note that this project is released with a [Contributor Code of
 Conduct][code-of-conduct]. By participating in this project you agree
 to abide by its terms.
@@ -20,6 +20,7 @@ This Action makes an authenticated query to the Dependency Graph Diff
 API endpoint (`GET /repos/{owner}/{repo}/dependency-graph/compare/{basehead}`)
 to find out the set of added and removed dependencies for each manifest.

+
 ### Bootstrapping the project

 ```
@@ -34,11 +35,10 @@ npm install
 npm run test
 ```

-_Note_: We don't have any useful tests yet, contributions are welcome!
+*Note*: We don't have any useful tests yet, contributions are welcome!

 ## Local Development

-It is recommended to have atleast [Node 18](https://nodejs.org/en/) installed.
 We have a script to scan a given PR for vulnerabilities, this will
 help you test your local changes. Make sure to [grab a Personal Access Token (PAT)](https://github.com/settings/tokens) before proceeding (you'll need `repo` permissions for private repos):

@@ -56,24 +56,16 @@ Like this:
 $ GITHUB_TOKEN=my-secret-token ./scripts/scan_pr https://github.com/actions/dependency-review-action/pull/3
 ```

-[Configuration options](README.md#configuration-options) can be set by
-passing an external YAML [configuration file](README.md#configuration-file) to the
-`scan_pr` script with the `-c`/`--config-file` option:
-
-```sh
-$ GITHUB_TOKEN=<token> ./scripts/scan_pr --config-file my_custom_config.yml <pr_url>
-```
-
 ## Submitting a pull request

 0. [Fork][fork] and clone the repository
-1. Configure and install the dependencies: `npm install`
-2. Make sure the tests pass on your machine: `npm run test`
-3. Create a new branch: `git checkout -b my-branch-name`
-4. Make your change, add tests, and make sure the tests still pass
-5. Make sure to build and package before pushing: `npm run build && npm run package`
-6. Push to your fork and [submit a pull request][pr]
-7. Pat your self on the back and wait for your pull request to be reviewed and merged.
+0. Configure and install the dependencies: `npm install`
+0. Make sure the tests pass on your machine: `npm run test`
+0. Create a new branch: `git checkout -b my-branch-name`
+0. Make your change, add tests, and make sure the tests still pass
+0. Make sure to build and package before pushing: `npm run build && npm run package`
+0. Push to your fork and [submit a pull request][pr]
+0. Pat your self on the back and wait for your pull request to be reviewed and merged.

 Here are a few things you can do that will increase the likelihood of your pull request being accepted:

@@ -85,21 +77,21 @@ Here are a few things you can do that will increase the likelihood of your pull

 1. Update the version number in [package.json](https://github.com/actions/dependency-review-action/blob/main/package.json).
 1. Go to [Draft a new
-   release](https://github.com/actions/dependency-review-action/releases/new)
-   in the Releases page.
-1. Make sure that the `Publish this Action to the GitHub Marketplace`
-   checkbox is enabled
+release](https://github.com/actions/dependency-review-action/releases/new)
+in the Releases page.
+2. Make sure that the `Publish this Action to the GitHub Marketplace`
+checkbox is enabled

 <img width="481" alt="Screenshot 2022-06-15 at 12 08 19" src="https://user-images.githubusercontent.com/2161/173822484-4b60d8b4-c674-4bff-b5ff-b0c4a3650ab7.png">

 3. Click "Choose a tag" and then "Create new tag", where the tag name
-   will be your version prefixed by a `v` (e.g. `v1.2.3`).
+will be your version prefixed by a `v` (e.g. `v1.2.3`).
 4. Use a version number for the release title (e.g. "1.2.3").

 <img width="700" alt="Screenshot 2022-06-15 at 12 08 36" src="https://user-images.githubusercontent.com/2161/173822548-33ab3432-d679-4dc1-adf8-b50fdaf47de3.png">

 5. Add your release notes. If this is a major version make sure to
-   include a small description of the biggest changes in the new version.
+include a small description of the biggest changes in the new version.
 6. Click "Publish Release".

 You now have a tag and release using the semver version you used
@@ -110,10 +102,9 @@ automatically getting all the
 minor/patch updates.

 To do this just checkout `main`, force-create a new annotated tag, and push it:
-
 ```
-git tag -fa v3 -m "Updating v3 to 3.0.1"
-git push origin v3 --force
+git tag -fa v2 -m "Updating v2 to 2.3.4"
+git push origin v2 --force
 ```

 ## Resources
@@ -1,15 +1,15 @@
 # dependency-review-action

 This action scans your pull requests for dependency changes, and will
-raise an error if any vulnerabilities or invalid licenses are being introduced. The action is supported by an [API endpoint](https://docs.github.com/en/rest/reference/dependency-graph#dependency-review) that diffs the dependencies between any two revisions on your default branch.
+raise an error if any vulnerabilities or invalid licenses are being introduced. The action is supported by an [API endpoint](https://docs.github.com/en/rest/reference/dependency-graph#dependency-review) that diffs the dependencies between any two revisions.

 The action is available for all public repositories, as well as private repositories that have GitHub Advanced Security licensed.

-You can see the results on the job logs:
+You can see the results on the job logs

 <img width="854" alt="Screen Shot 2022-03-31 at 1 10 51 PM" src="https://user-images.githubusercontent.com/2161/161042286-b22d7dd3-13cb-458d-8744-ce70ed9bf562.png">

-or on the job summary:
+or on the job summary

 <img src="https://user-images.githubusercontent.com/7847935/182871416-50332bbb-b279-4621-a136-ca72a4314301.png">

@@ -33,7 +33,7 @@ jobs:
      - name: 'Checkout Repository'
        uses: actions/checkout@v3
      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
+        uses: actions/dependency-review-action@v2
 ```

 ### GitHub Enterprise Server
@@ -59,34 +59,149 @@ jobs:
      - name: 'Checkout Repository'
        uses: actions/checkout@v3
      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
+        uses: actions/dependency-review-action@v2
 ```

-## Configuration options
+## Configuration

-Configure this action by either inlining these options in your workflow file, or by using an external configuration file. All configuration options are optional.
+Configure this action by either using an external configuration file,
+or by inlining these options in your workflow file.

-| Option                  | Usage                                                                                                                                                                             | Possible values                                                              | Default value |
-| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------- |
-| `fail-on-severity`      | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher.              | `low`, `moderate`, `high`, `critical`                                        | `low`         |
-| `allow-licenses`*       | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list.                                  | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/)               | none          |
-| `deny-licenses`*        | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list.                                      | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/)               | none          |
-| `fail-on-scopes`†       | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown`                                          | `runtime`     |
-| `allow-ghsas`           | Contains a list of GitHub Advisory Database IDs that can be skipped during detection.                                                                                             | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none          |
-| `license-check`         | Enable or disable the license check performed by the action.                                                                                                                      | `true`, `false`                                                              | `true`        |
-| `vulnerability-check`   | Enable or disable the vulnerability check performed by the action.                                                                                                                | `true`, `false`                                                              | `true`        |
-| `base-ref`/`head-ref`   | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`.  | Any valid git ref(s) in your project                                         | none          |
-| `comment-summary-in-pr` | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`.                 | `true`, `false`                                                              | `false`       |
+## Configuration Options

-*not supported for use with GitHub Enterprise Server
+### config-file

-†will be supported with GitHub Enterprise Server 3.8
+A string representing the path to an external configuraton file. By
+default external configuration files are not used.
+
+**Possible values**: A string representing the absolute path to the
+configuration file.
+
+**Example**: `config-file: ./.github/dependency-review-config.yml`.
+
+### fail-on-severity
+
+Configure the severity level for alerting. See "[Vulnerability Severity](https://github.com/actions/dependency-review-action#vulnerability-severity)".
+
+**Possible values**: `critical`, `high`, `moderate`, `low`.
+
+**Example**: `fail-on-severity: moderate`.
+
+### fail-on-scopes
+
+A list of strings representing the build environments you want to
+support. The default value is `development, runtime`.
+
+**Possible values**: `development`, `runtime`, `unknown`
+
+**Inline example**: `fail-on-scopes: development, runtime`
+
+**YAML example**:
+
+```yaml
+# this prevents scanning development dependencies
+fail-on-scopes:
+  - runtime
+```
+
+### allow-licenses
+
+Only allow the licenses in this list. See "[Licenses](https://github.com/actions/dependency-review-action#licenses)".
+
+**Possible values**: Any `spdx_id` value(s) from
+https://docs.github.com/en/rest/licenses.
+
+**Inline example**: `allow-licenses: BSD-3-Clause, MIT`
+
+**YAML example**:
+
+```yaml
+allow-licenses:
+  - BSD-3-Clause
+  - MIT
+```
+
+### deny-licenses
+
+Add a custom list of licenses you want to block. See
+"[Licenses](https://github.com/actions/dependency-review-action#licenses)".
+
+**Possible values**: Any `spdx_id` value(s) from
+https://docs.github.com/en/rest/licenses.
+
+**Inline example**: `deny-licenses: LGPL-2.0, BSD-2-Clause`
+
+**YAML example**:
+
+```yaml
+deny-licenses:
+  - LGPL-2.0
+  - BSD-2-Clause
+```
+
+### allow-ghsas
+
+Add a custom list of GitHub Advisory IDs that can be skipped during detection. 
+
+**Possible values**: Any valid advisory GHSA ids.
+
+**Inline example**: `allow-ghsas: GHSA-abcd-1234-5679, GHSA-efgh-1234-5679`
+
+**YAML example**:
+
+```yaml
+allow-ghsas:
+  - GHSA-abcd-1234-5679
+  - GHSA-efgh-1234-5679
+```
+
+### base-ref/head-ref
+
+Provide custom git references for the git base/head when performing
+the comparison. If you are using pull requests, or
+`pull_request_target` events you do not need to worry about setting
+this. The values need to be specified for all other event types.
+
+**Possible values**: Any valid git ref(s) in your project.
+
+**Example**:
+
+```yaml
+base-ref: 8bb8a58d6a4028b6c2e314d5caaf273f57644896
+head-ref: 69af5638bf660cf218aad5709a4c100e42a2f37b
+```
+
+### Configuration File
+
+You can use an external configuration file to specify the settings for
+this Action.
+
+Start by specifying that you will be using an external configuration
+file:
+
+```yaml
+- name: Dependency Review
+  uses: actions/dependency-review-action@v2
+  with:
+    config-file: './.github/dependency-review-config.yml'
+```
+
+And then create the file in the path you just specified. **All of these fields are
+optional**:
+
+```yaml
+fail-on-severity: 'critical'
+allow-licenses:
+  - 'GPL-3.0'
+  - 'BSD-3-Clause'
+  - 'MIT'
+```

 ### Inline Configuration

-You can pass options to the Dependency Review GitHub Action using your workflow file.
-
-#### Example
+You can pass options to the Dependency Review
+Action using your workflow file. Here's an example of what the full
+file would look like:

 ```yaml
 name: 'Dependency Review'
@@ -100,7 +215,7 @@ jobs:
      - name: 'Checkout Repository'
        uses: actions/checkout@v3
      - name: Dependency Review
-        uses: actions/dependency-review-action@v3
+        uses: actions/dependency-review-action@v2
        with:
          fail-on-severity: moderate

@@ -108,42 +223,71 @@ jobs:
          deny-licenses: LGPL-2.0, BSD-2-Clause
 ```

-### Configuration File
+### Vulnerability Severity

-You can use an external configuration file to specify the settings for this action. It can be a local file or a file in an external repository. Refer to the following options for the specification.
+By default the action will fail on any pull request that contains a
+vulnerable dependency, regardless of the severity level. You can override this behavior by
+using the `fail-on-severity` option, which will cause a failure on any pull requests that introduce vulnerabilities of the specified severity level or higher. The possible values are: `critical`, `high`, `moderate`, or `low`. The
+action defaults to `low`.

-| Option                | Usage                                                                                                                                                                                                                                                     | Possible values                                                                                                                      |
-| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
-| `config-file`         | A path to a file in the current repository or an external repository. Use this syntax for external files: `OWNER/REPOSITORY/FILENAME@BRANCH`                                                                                                              | **Local file**: `./.github/dependency-review-config.yml` <br> **External repo**: `github/octorepo/dependency-review-config.yml@main` |
-| `external-repo-token` | Specifies a token for fetching the configuration file. It is required if the file resides in a private external repository and for all GitHub Enterprise Server repositories. Create a token in [developer settings](https://github.com/settings/tokens). | Any token with `read` permissions to the repository hosting the config file.                                                         |
-
-#### Example
-
-Start by specifying that you will be using an external configuration file:
+This example will only fail on pull requests with `critical` and `high` vulnerabilities:

 ```yaml
 - name: Dependency Review
  uses: actions/dependency-review-action@v2
  with:
-    config-file: './.github/dependency-review-config.yml'
+    fail-on-severity: high
 ```

-And then create the file in the path you just specified. Please note
-that the **option names in external files use underscores instead of dashes**:
+### Dependency Scoping
+
+By default the action will only fail on `runtime` dependencies that have vulnerabilities or unacceptable licenses, ignoring `development` dependencies. You can override this behavior with the `fail-on-scopes` option, which will allow you to list the specific dependency scopes you care about. The possible values are: `unknown`, `runtime`, and `development`. Note: Filtering by scope will not be supported on Enterprise Server just yet, as the REST API's introduction of `scope` will be released in an upcoming Enterprise Server version. We will treat all dependencies on Enterprise Server as having a `runtime` scope and thus will not be filtered away.

 ```yaml
-fail_on_severity: 'critical'
-allow_licenses:
-  - 'GPL-3.0'
-  - 'BSD-3-Clause'
-  - 'MIT'
+- name: Dependency Review
+  uses: actions/dependency-review-action@v2
+  with:
+    fail-on-scopes: runtime, development
+```
+
+### Licenses
+
+You can set the action to fail on pull requests based on the licenses of the dependencies
+they introduce. With `allow-licenses` you can define the list of licenses
+your repository will accept. Alternatively, you can use `deny-licenses` to only
+forbid a subset of licenses. These options are not supported on Enterprise Server.
+
+You can use the [Licenses
+API](https://docs.github.com/en/rest/licenses) to see the full list of
+supported licenses. Use the `spdx_id` field for every license you want
+to filter. A couple of examples:
+
+```yaml
+# only allow MIT-licensed dependents
+- name: Dependency Review
+  uses: actions/dependency-review-action@v2
+  with:
+    allow-licenses: MIT
+```
+
+```yaml
+# Block Apache 1.1 and 2.0 licensed dependents
+- name: Dependency Review
+  uses: actions/dependency-review-action@v2
+  with:
+    deny-licenses: Apache-1.1, Apache-2.0
 ```

 ### Considerations

 - Checking for licenses is not supported on Enterprise Server.
- The action will only accept one of the two `license` parameters; an error will be raised if you provide both.
- We don't have license information for all of your dependents. If we can't detect the license for a dependency **we will inform you, but the action won't fail**.
+- The action will only accept one of the two parameters; an error will
+  be raised if you provide both.
+- By default both parameters are empty (no license checking is
+  performed).
+- We don't have license information for all of your dependents. If we
+  can't detect the license for a dependency **we will inform you, but the
+  action won't fail**.

 ## Blocking pull requests

@@ -151,11 +295,14 @@ The Dependency Review GitHub Action check will only block a pull request from be

 ## Getting help

-If you have bug reports, questions or suggestions please [create a new issue](https://github.com/actions/dependency-review-action/issues/new/choose).
+If you have bug reports, questions or suggestions please [create a new
+issue](https://github.com/actions/dependency-review-action/issues/new/choose).

 ## Contributing

-We are grateful for any contributions made to this project. Please read [CONTRIBUTING.MD](https://github.com/actions/dependency-review-action/blob/main/CONTRIBUTING.md) to get started.
+We are grateful for any contributions made to this project.
+
+Please read [CONTRIBUTING.MD](https://github.com/actions/dependency-review-action/blob/main/CONTRIBUTING.md) to get started.

 ## License

@@ -1,65 +1,74 @@
 import {expect, test, beforeEach} from '@jest/globals'
-import {readConfig} from '../src/config'
+import {readConfig, readConfigFile} from '../src/config'
 import {getRefs} from '../src/git-refs'
-import * as Utils from '../src/utils'
-import {setInput, clearInputs} from './test-helpers'

-beforeAll(() => {
-  jest.spyOn(Utils, 'isSPDXValid').mockReturnValue(true)
-})
+// GitHub Action inputs come in the form of environment variables
+// with an INPUT prefix (e.g. INPUT_FAIL-ON-SEVERITY)
+function setInput(input: string, value: string) {
+  process.env[`INPUT_${input.toUpperCase()}`] = value
+}
+
+// We want a clean ENV before each test. We use `delete`
+// since we want `undefined` values and not empty strings.
+function clearInputs() {
+  const allowedOptions = [
+    'FAIL-ON-SEVERITY',
+    'FAIL-ON-SCOPES',
+    'ALLOW-LICENSES',
+    'DENY-LICENSES',
+    'ALLOW-GHSAS',
+    'CONFIG-FILE',
+    'BASE-REF',
+    'HEAD-REF'
+  ]
+
+  allowedOptions.forEach(option => {
+    delete process.env[`INPUT_${option.toUpperCase()}`]
+  })
+}

 beforeEach(() => {
  clearInputs()
 })

 test('it defaults to low severity', async () => {
-  const config = await readConfig()
-  expect(config.fail_on_severity).toEqual('low')
+  const options = readConfig()
+  expect(options.fail_on_severity).toEqual('low')
 })

 test('it reads custom configs', async () => {
  setInput('fail-on-severity', 'critical')
  setInput('allow-licenses', ' BSD, GPL 2')

-  const config = await readConfig()
-  expect(config.fail_on_severity).toEqual('critical')
-  expect(config.allow_licenses).toEqual(['BSD', 'GPL 2'])
+  const options = readConfig()
+  expect(options.fail_on_severity).toEqual('critical')
+  expect(options.allow_licenses).toEqual(['BSD', 'GPL 2'])
 })

 test('it defaults to empty allow/deny lists ', async () => {
-  const config = await readConfig()
+  const options = readConfig()

-  expect(config.allow_licenses).toEqual(undefined)
-  expect(config.deny_licenses).toEqual(undefined)
+  expect(options.allow_licenses).toEqual(undefined)
+  expect(options.deny_licenses).toEqual(undefined)
 })

 test('it raises an error if both an allow and denylist are specified', async () => {
  setInput('allow-licenses', 'MIT')
  setInput('deny-licenses', 'BSD')

-  await expect(readConfig()).rejects.toThrow(
-    'You cannot specify both allow-licenses and deny-licenses'
-  )
-})
-test('it raises an error if an empty allow list is specified', async () => {
-  setInput('config-file', './__tests__/fixtures/config-empty-allow-sample.yml')
-
-  await expect(readConfig()).rejects.toThrow(
-    'You should provide at least one license in allow-licenses'
-  )
+  expect(() => readConfig()).toThrow()
 })

 test('it raises an error when given an unknown severity', async () => {
  setInput('fail-on-severity', 'zombies')
-
-  await expect(readConfig()).rejects.toThrow(/received 'zombies'/)
+  expect(() => readConfig()).toThrow()
 })

 test('it uses the given refs when the event is not a pull request', async () => {
  setInput('base-ref', 'a-custom-base-ref')
  setInput('head-ref', 'a-custom-head-ref')

-  const refs = getRefs(await readConfig(), {
+  const refs = getRefs(readConfig(), {
    payload: {},
    eventName: 'workflow_dispatch'
  })
@@ -68,106 +77,101 @@ test('it uses the given refs when the event is not a pull request', async () =>
 })

 test('it raises an error when no refs are provided and the event is not a pull request', async () => {
-  const config = await readConfig()
+  const options = readConfig()
  expect(() =>
-    getRefs(config, {
+    getRefs(options, {
      payload: {},
      eventName: 'workflow_dispatch'
    })
  ).toThrow()
 })

+test('it reads an external config file', async () => {
+  let options = readConfigFile('./__tests__/fixtures/config-allow-sample.yml')
+  expect(options.fail_on_severity).toEqual('critical')
+  expect(options.allow_licenses).toEqual(['BSD', 'GPL 2'])
+})
+
+test('raises an error when the the config file was not found', async () => {
+  expect(() => readConfigFile('fixtures/i-dont-exist')).toThrow()
+})
+
+test('it parses options from both sources', async () => {
+  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml')
+
+  let options = readConfig()
+  expect(options.fail_on_severity).toEqual('critical')
+
+  setInput('base-ref', 'a-custom-base-ref')
+  options = readConfig()
+  expect(options.base_ref).toEqual('a-custom-base-ref')
+})
+
+test('in case of conflicts, the external config is the source of truth', async () => {
+  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml') // this will set fail-on-severity to 'critical'
+
+  let options = readConfig()
+  expect(options.fail_on_severity).toEqual('critical')
+
+  // this should not overwite the previous value
+  setInput('fail-on-severity', 'low')
+  options = readConfig()
+  expect(options.fail_on_severity).toEqual('critical')
+})
+
+test('it uses the default values when loading external files', async () => {
+  setInput('config-file', './__tests__/fixtures/no-licenses-config.yml')
+  let options = readConfig()
+  expect(options.allow_licenses).toEqual(undefined)
+  expect(options.deny_licenses).toEqual(undefined)
+
+  setInput('config-file', './__tests__/fixtures/license-config-sample.yml')
+  options = readConfig()
+  expect(options.fail_on_severity).toEqual('low')
+})
+
+test('it accepts an external configuration filename', async () => {
+  setInput('config-file', './__tests__/fixtures/no-licenses-config.yml')
+  const options = readConfig()
+  expect(options.fail_on_severity).toEqual('critical')
+})
+
+test('it raises an error when given an unknown severity in an external config file', async () => {
+  setInput('config-file', './__tests__/fixtures/invalid-severity-config.yml')
+  expect(() => readConfig()).toThrow()
+})
+
 test('it defaults to runtime scope', async () => {
-  const config = await readConfig()
-  expect(config.fail_on_scopes).toEqual(['runtime'])
+  const options = readConfig()
+  expect(options.fail_on_scopes).toEqual(['runtime'])
 })

 test('it parses custom scopes preference', async () => {
  setInput('fail-on-scopes', 'runtime, development')
-  let config = await readConfig()
-  expect(config.fail_on_scopes).toEqual(['runtime', 'development'])
+  let options = readConfig()
+  expect(options.fail_on_scopes).toEqual(['runtime', 'development'])

  clearInputs()
  setInput('fail-on-scopes', 'development')
-  config = await readConfig()
-  expect(config.fail_on_scopes).toEqual(['development'])
+  options = readConfig()
+  expect(options.fail_on_scopes).toEqual(['development'])
 })

 test('it raises an error when given invalid scope', async () => {
  setInput('fail-on-scopes', 'runtime, zombies')
-  await expect(readConfig()).rejects.toThrow(/received 'zombies'/)
+  expect(() => readConfig()).toThrow()
 })

 test('it defaults to an empty GHSA allowlist', async () => {
-  const config = await readConfig()
-  expect(config.allow_ghsas).toEqual([])
+  const options = readConfig()
+  expect(options.allow_ghsas).toEqual(undefined)
 })

 test('it successfully parses GHSA allowlist', async () => {
  setInput('allow-ghsas', 'GHSA-abcd-1234-5679, GHSA-efgh-1234-5679')
-  const config = await readConfig()
-  expect(config.allow_ghsas).toEqual([
+  const options = readConfig()
+  expect(options.allow_ghsas).toEqual([
    'GHSA-abcd-1234-5679',
    'GHSA-efgh-1234-5679'
  ])
 })
-
-test('it defaults to checking licenses', async () => {
-  const config = await readConfig()
-  expect(config.license_check).toBe(true)
-})
-
-test('it parses the license-check input', async () => {
-  setInput('license-check', 'false')
-  let config = await readConfig()
-  expect(config.license_check).toEqual(false)
-
-  clearInputs()
-  setInput('license-check', 'true')
-  config = await readConfig()
-  expect(config.license_check).toEqual(true)
-})
-
-test('it defaults to checking vulnerabilities', async () => {
-  const config = await readConfig()
-  expect(config.vulnerability_check).toBe(true)
-})
-
-test('it parses the vulnerability-check input', async () => {
-  setInput('vulnerability-check', 'false')
-  let config = await readConfig()
-  expect(config.vulnerability_check).toEqual(false)
-
-  clearInputs()
-  setInput('vulnerability-check', 'true')
-  config = await readConfig()
-  expect(config.vulnerability_check).toEqual(true)
-})
-
-test('it is not possible to disable both checks', async () => {
-  setInput('license-check', 'false')
-  setInput('vulnerability-check', 'false')
-  await expect(readConfig()).rejects.toThrow(
-    /Can't disable both license-check and vulnerability-check/
-  )
-})
-
-describe('licenses that are not valid SPDX licenses', () => {
-  beforeAll(() => {
-    jest.spyOn(Utils, 'isSPDXValid').mockReturnValue(false)
-  })
-
-  test('it raises an error for invalid licenses in allow-licenses', async () => {
-    setInput('allow-licenses', ' BSD, GPL 2')
-    await expect(readConfig()).rejects.toThrow(
-      'Invalid license(s) in allow-licenses: BSD,GPL 2'
-    )
-  })
-
-  test('it raises an error for invalid licenses in deny-licenses', async () => {
-    setInput('deny-licenses', ' BSD, GPL 2')
-    await expect(readConfig()).rejects.toThrow(
-      'Invalid license(s) in deny-licenses: BSD,GPL 2'
-    )
-  })
-})
@@ -1,29 +0,0 @@
-import {RequestError} from '@octokit/request-error'
-import * as dependencyGraph from '../src/dependency-graph'
-import * as core from '@actions/core'
-
-// mock call to core.getInput('repo-token'.. to avoid environment setup - Input required and not supplied: repo-token
-jest.mock('@actions/core', () => ({
-  getInput: (input: string) => {
-    if (input === 'repo-token') {
-      return 'gh_testtoken'
-    }
-  }
-}))
-
-test('it properly catches RequestError type', async () => {
-  const token = core.getInput('repo-token', {required: true})
-  expect(token).toBe('gh_testtoken')
-
-  //Integration test to make an API request using current dependencies and ensure response can parse into RequestError
-  try {
-    await dependencyGraph.compare({
-      owner: 'actions',
-      repo: 'dependency-review-action',
-      baseRef: 'refs/heads/master',
-      headRef: 'refs/heads/master'
-    })
-  } catch (error) {
-    expect(error).toBeInstanceOf(RequestError)
-  }
-})
@@ -1,111 +0,0 @@
-import {expect, test, beforeEach} from '@jest/globals'
-import {readConfig} from '../src/config'
-import * as Utils from '../src/utils'
-import {setInput, clearInputs} from './test-helpers'
-
-const externalConfig = `fail_on_severity: 'high'
-allow_licenses: ['GPL-2.0-only']
-`
-const mockOctokit = {
-  rest: {
-    repos: {
-      getContent: jest.fn().mockReturnValue({data: externalConfig})
-    }
-  }
-}
-
-jest.mock('octokit', () => {
-  return {
-    // eslint-disable-next-line @typescript-eslint/no-extraneous-class
-    Octokit: class {
-      constructor() {
-        return mockOctokit
-      }
-    }
-  }
-})
-
-beforeAll(() => {
-  jest.spyOn(Utils, 'isSPDXValid').mockReturnValue(true)
-})
-
-beforeEach(() => {
-  clearInputs()
-})
-
-test('it reads an external config file', async () => {
-  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml')
-
-  const config = await readConfig()
-  expect(config.fail_on_severity).toEqual('critical')
-  expect(config.allow_licenses).toEqual(['BSD', 'GPL 2'])
-})
-
-test('raises an error when the config file was not found', async () => {
-  setInput('config-file', 'fixtures/i-dont-exist')
-  await expect(readConfig()).rejects.toThrow(/Unable to fetch/)
-})
-
-test('it parses options from both sources', async () => {
-  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml')
-
-  let config = await readConfig()
-  expect(config.fail_on_severity).toEqual('critical')
-
-  setInput('base-ref', 'a-custom-base-ref')
-  config = await readConfig()
-  expect(config.base_ref).toEqual('a-custom-base-ref')
-})
-
-test('in case of conflicts, the inline config is the source of truth', async () => {
-  setInput('fail-on-severity', 'low')
-  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml') // this will set fail-on-severity to 'critical'
-
-  const config = await readConfig()
-  expect(config.fail_on_severity).toEqual('low')
-})
-
-test('it uses the default values when loading external files', async () => {
-  setInput('config-file', './__tests__/fixtures/no-licenses-config.yml')
-  let config = await readConfig()
-  expect(config.allow_licenses).toEqual(undefined)
-  expect(config.deny_licenses).toEqual(undefined)
-
-  setInput('config-file', './__tests__/fixtures/license-config-sample.yml')
-  config = await readConfig()
-  expect(config.fail_on_severity).toEqual('low')
-})
-
-test('it accepts an external configuration filename', async () => {
-  setInput('config-file', './__tests__/fixtures/no-licenses-config.yml')
-  const config = await readConfig()
-  expect(config.fail_on_severity).toEqual('critical')
-})
-
-test('it raises an error when given an unknown severity in an external config file', async () => {
-  setInput('config-file', './__tests__/fixtures/invalid-severity-config.yml')
-  await expect(readConfig()).rejects.toThrow()
-})
-
-test('it supports comma-separated lists', async () => {
-  setInput(
-    'config-file',
-    './__tests__/fixtures/inline-license-config-sample.yml'
-  )
-  const config = await readConfig()
-
-  expect(config.allow_licenses).toEqual(['MIT', 'GPL-2.0-only'])
-})
-
-test('it reads a config file hosted in another repo', async () => {
-  setInput(
-    'config-file',
-    'future-funk/anyone-cualkiera/external-config.yml@main'
-  )
-  setInput('external-repo-token', 'gh_viptoken')
-
-  const config = await readConfig()
-
-  expect(config.fail_on_severity).toEqual('high')
-  expect(config.allow_licenses).toEqual(['GPL-2.0-only'])
-})
@@ -1,12 +1,12 @@
 import {expect, test} from '@jest/globals'
-import {Change} from '../src/schemas'
+import {Change, Changes} from '../src/schemas'
 import {
  filterChangesBySeverity,
  filterChangesByScopes,
-  filterAllowedAdvisories
+  filterOutAllowedAdvisories
 } from '../src/filter'

-const npmChange: Change = {
+let npmChange: Change = {
  manifest: 'package.json',
  change_type: 'added',
  ecosystem: 'npm',
@@ -26,7 +26,7 @@ const npmChange: Change = {
  ]
 }

-const rubyChange: Change = {
+let rubyChange: Change = {
  change_type: 'added',
  manifest: 'Gemfile.lock',
  ecosystem: 'rubygems',
@@ -52,7 +52,7 @@ const rubyChange: Change = {
  ]
 }

-const noVulnNpmChange: Change = {
+let noVulnNpmChange: Change = {
  manifest: 'package.json',
  change_type: 'added',
  ecosystem: 'npm',
@@ -90,34 +90,28 @@ test('it properly filters changes by scope', async () => {
  expect(result).toEqual([npmChange, rubyChange])
 })

-test('it properly handles undefined advisory IDs', async () => {
-  const changes = [npmChange, rubyChange, noVulnNpmChange]
-  const result = filterAllowedAdvisories(undefined, changes)
-  expect(result).toEqual([npmChange, rubyChange, noVulnNpmChange])
-})
-
 test('it properly filters changes with allowed vulnerabilities', async () => {
  const changes = [npmChange, rubyChange, noVulnNpmChange]

-  let result = filterAllowedAdvisories(['notrealGHSAID'], changes)
+  let result = filterOutAllowedAdvisories(['notrealGHSAID'], changes)
  expect(result).toEqual([npmChange, rubyChange, noVulnNpmChange])

-  result = filterAllowedAdvisories(['first-random_string'], changes)
+  result = filterOutAllowedAdvisories(['first-random_string'], changes)
  expect(result).toEqual([rubyChange, noVulnNpmChange])

-  result = filterAllowedAdvisories(
+  result = filterOutAllowedAdvisories(
    ['second-random_string', 'third-random_string'],
    changes
  )
  expect(result).toEqual([npmChange, noVulnNpmChange])

-  result = filterAllowedAdvisories(
+  result = filterOutAllowedAdvisories(
    ['first-random_string', 'second-random_string', 'third-random_string'],
    changes
  )
  expect(result).toEqual([noVulnNpmChange])

  // if we have a change with multiple vulnerabilities but only one is allowed, we still should not filter out that change
-  result = filterAllowedAdvisories(['second-random_string'], changes)
+  result = filterOutAllowedAdvisories(['second-random_string'], changes)
  expect(result).toEqual([npmChange, rubyChange, noVulnNpmChange])
 })
@@ -1,2 +0,0 @@
-fail_on_severity: critical
-allow_licenses: []
@@ -1,36 +0,0 @@
-import {Change} from '../../src/schemas'
-import {createTestVulnerability} from './create-test-vulnerability'
-
-const defaultChange: Change = {
-  change_type: 'added',
-  manifest: 'package.json',
-  ecosystem: 'npm',
-  name: 'lodash',
-  version: '4.17.20',
-  package_url: 'pkg:npm/lodash@4.17.20',
-  license: 'MIT',
-  source_repository_url: 'https://github.com/lodash/lodash',
-  scope: 'runtime',
-  vulnerabilities: [
-    createTestVulnerability({
-      severity: 'high',
-      advisory_ghsa_id: 'GHSA-35jh-r3h4-6jhm',
-      advisory_summary: 'Command Injection in lodash',
-      advisory_url: 'https://github.com/advisories/GHSA-35jh-r3h4-6jhm'
-    }),
-    createTestVulnerability({
-      severity: 'moderate',
-      advisory_ghsa_id: 'GHSA-29mw-wpgm-hmr9',
-      advisory_summary:
-        'Regular Expression Denial of Service (ReDoS) in lodash',
-      advisory_url: 'https://github.com/advisories/GHSA-29mw-wpgm-hmr9'
-    })
-  ]
-}
-
-const createTestChange = (overwrites: Partial<Change> = {}): Change => ({
-  ...defaultChange,
-  ...overwrites
-})
-
-export {createTestChange}
@@ -1,19 +0,0 @@
-import {Change} from '../../src/schemas'
-
-type Vulnerability = Change['vulnerabilities'][0]
-
-const defaultTestVulnerability: Vulnerability = {
-  severity: 'high',
-  advisory_ghsa_id: 'GHSA-35jh-r3h4-6jhm',
-  advisory_summary: 'Command Injection in lodash',
-  advisory_url: 'https://github.com/advisories/GHSA-35jh-r3h4-6jhm'
-}
-
-const createTestVulnerability = (
-  overwrites: Partial<Vulnerability> = {}
-): Vulnerability => ({
-  ...defaultTestVulnerability,
-  ...overwrites
-})
-
-export {createTestVulnerability}
@@ -1 +0,0 @@
-allow-licenses: "MIT, GPL-2.0-only"
@@ -1,3 +1,3 @@
-fail_on_severity: 'so many zombies'
-deny_licenses:
+fail-on-severity: 'so many zombies'
+deny-licenses:
  - MIT
@@ -1,9 +1,8 @@
-import {expect, jest, test} from '@jest/globals'
+import {expect, test} from '@jest/globals'
 import {Change, Changes} from '../src/schemas'
+import {getDeniedLicenseChanges} from '../src/licenses'

-let getInvalidLicenseChanges: Function
-
-const npmChange: Change = {
+let npmChange: Change = {
  manifest: 'package.json',
  change_type: 'added',
  ecosystem: 'npm',
@@ -23,7 +22,7 @@ const npmChange: Change = {
  ]
 }

-const rubyChange: Change = {
+let rubyChange: Change = {
  change_type: 'added',
  manifest: 'Gemfile.lock',
  ecosystem: 'rubygems',
@@ -49,145 +48,53 @@ const rubyChange: Change = {
  ]
 }

-jest.mock('@actions/core')
-
-const mockOctokit = {
-  rest: {
-    licenses: {
-      getForRepo: jest
-        .fn()
-        .mockReturnValue({data: {license: {spdx_id: 'AGPL'}}})
-    }
-  }
-}
-
-jest.mock('octokit', () => {
-  return {
-    // eslint-disable-next-line @typescript-eslint/no-extraneous-class
-    Octokit: class {
-      constructor() {
-        return mockOctokit
-      }
-    }
-  }
-})
-
-beforeEach(async () => {
-  jest.resetModules()
-  jest.doMock('spdx-satisfies', () => {
-    // mock spdx-satisfies return value
-    // true for BSD, false for all others
-    return jest.fn((license: string, _: string): boolean => license === 'BSD')
-  })
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
-  ;({getInvalidLicenseChanges} = require('../src/licenses'))
-})
-
-test('it adds license outside the allow list to forbidden changes', async () => {
+test('it fails if a license outside the allow list is found', async () => {
  const changes: Changes = [npmChange, rubyChange]
-  const {forbidden} = await getInvalidLicenseChanges(changes, {
-    allow: ['BSD']
-  })
-  expect(forbidden[0]).toBe(npmChange)
-  expect(forbidden.length).toEqual(1)
+  const [invalidChanges, _] = getDeniedLicenseChanges(changes, {allow: ['BSD']})
+  expect(invalidChanges[0]).toBe(npmChange)
 })

-test('it adds license inside the deny list to forbidden changes', async () => {
+test('it fails if a license inside the deny list is found', async () => {
  const changes: Changes = [npmChange, rubyChange]
-  const {forbidden} = await getInvalidLicenseChanges(changes, {
+  const [invalidChanges] = getDeniedLicenseChanges(changes, {deny: ['BSD']})
+  expect(invalidChanges[0]).toBe(rubyChange)
+})
+
+// This is more of a "here's a behavior that might be surprising" than an actual
+// thing we want in the system. Please remove this test after refactoring.
+test('it fails all license checks when allow is provided an empty array', async () => {
+  const changes: Changes = [npmChange, rubyChange]
+  let [invalidChanges, _] = getDeniedLicenseChanges(changes, {
+    allow: [],
    deny: ['BSD']
  })
-  expect(forbidden[0]).toBe(rubyChange)
-  expect(forbidden.length).toEqual(1)
+  expect(invalidChanges.length).toBe(2)
 })

-test('it does not add license outside the allow list to forbidden changes if it is in removed changes', async () => {
+test('it does not fail if a license outside the allow list is found in removed changes', async () => {
  const changes: Changes = [
    {...npmChange, change_type: 'removed'},
    {...rubyChange, change_type: 'removed'}
  ]
-  const {forbidden} = await getInvalidLicenseChanges(changes, {
-    allow: ['BSD']
-  })
-  expect(forbidden).toStrictEqual([])
+  const [invalidChanges, _] = getDeniedLicenseChanges(changes, {allow: ['BSD']})
+  expect(invalidChanges).toStrictEqual([])
 })

-test('it does not add license inside the deny list to forbidden changes if it is in removed changes', async () => {
+test('it does not fail if a license inside the deny list is found in removed changes', async () => {
  const changes: Changes = [
    {...npmChange, change_type: 'removed'},
    {...rubyChange, change_type: 'removed'}
  ]
-  const {forbidden} = await getInvalidLicenseChanges(changes, {
-    deny: ['BSD']
-  })
-  expect(forbidden).toStrictEqual([])
+  const [invalidChanges, _] = getDeniedLicenseChanges(changes, {deny: ['BSD']})
+  expect(invalidChanges).toStrictEqual([])
 })

-test('it adds license outside the allow list to forbidden changes if it is in both added and removed changes', async () => {
+test('it fails if a license outside the allow list is found in both of added and removed changes', async () => {
  const changes: Changes = [
    {...npmChange, change_type: 'removed'},
    npmChange,
    {...rubyChange, change_type: 'removed'}
  ]
-  const {forbidden} = await getInvalidLicenseChanges(changes, {
-    allow: ['BSD']
-  })
-  expect(forbidden).toStrictEqual([npmChange])
-})
-
-test('it adds all licenses to unresolved if it is unable to determine the validity', async () => {
-  jest.resetModules() // reset module set in before
-  jest.doMock('spdx-satisfies', () => {
-    return jest.fn((_first: string, _second: string) => {
-      throw new Error('Some Error')
-    })
-  })
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
-  ;({getInvalidLicenseChanges} = require('../src/licenses'))
-  const changes: Changes = [npmChange, rubyChange]
-  const invalidLicenses = await getInvalidLicenseChanges(changes, {
-    allow: ['BSD']
-  })
-  expect(invalidLicenses.forbidden.length).toEqual(0)
-  expect(invalidLicenses.unlicensed.length).toEqual(0)
-  expect(invalidLicenses.unresolved.length).toEqual(2)
-})
-
-describe('GH License API fallback', () => {
-  test('it calls licenses endpoint if atleast one of the changes has null license and valid source_repository_url', async () => {
-    const nullLicenseChange = {
-      ...npmChange,
-      license: null,
-      source_repository_url: 'http://github.com/some-owner/some-repo'
-    }
-    const {unlicensed} = await getInvalidLicenseChanges(
-      [nullLicenseChange, rubyChange],
-      {}
-    )
-
-    expect(mockOctokit.rest.licenses.getForRepo).toHaveBeenNthCalledWith(1, {
-      owner: 'some-owner',
-      repo: 'some-repo'
-    })
-    expect(unlicensed.length).toEqual(0)
-  })
-
-  test('it does not call licenses API endpoint for change with null license and invalid source_repository_url ', async () => {
-    const {unlicensed} = await getInvalidLicenseChanges(
-      [{...npmChange, license: null}],
-      {}
-    )
-    expect(mockOctokit.rest.licenses.getForRepo).not.toHaveBeenCalled()
-    expect(unlicensed.length).toEqual(1)
-  })
-
-  test('it does not call licenses API endpoint if licenses for all changes are present', async () => {
-    const {unlicensed} = await getInvalidLicenseChanges(
-      [npmChange, rubyChange],
-      {}
-    )
-
-    expect(mockOctokit.rest.licenses.getForRepo).not.toHaveBeenCalled()
-    expect(unlicensed.length).toEqual(0)
-  })
+  const [invalidChanges, _] = getDeniedLicenseChanges(changes, {allow: ['BSD']})
+  expect(invalidChanges).toStrictEqual([npmChange])
 })
@@ -1,305 +0,0 @@
-import {expect, jest, test} from '@jest/globals'
-import {Changes, ConfigurationOptions} from '../src/schemas'
-import * as summary from '../src/summary'
-import * as core from '@actions/core'
-import {createTestChange} from './fixtures/create-test-change'
-import {createTestVulnerability} from './fixtures/create-test-vulnerability'
-
-afterEach(() => {
-  jest.clearAllMocks()
-  core.summary.emptyBuffer()
-})
-
-const emptyChanges: Changes = []
-const emptyInvalidLicenseChanges = {
-  forbidden: [],
-  unresolved: [],
-  unlicensed: []
-}
-const defaultConfig: ConfigurationOptions = {
-  vulnerability_check: true,
-  license_check: true,
-  fail_on_severity: 'high',
-  fail_on_scopes: ['runtime'],
-  allow_ghsas: [],
-  allow_licenses: [],
-  deny_licenses: [],
-  comment_summary_in_pr: true
-}
-
-test('prints headline as h1', () => {
-  summary.addSummaryToSummary(
-    emptyChanges,
-    emptyInvalidLicenseChanges,
-    defaultConfig
-  )
-  const text = core.summary.stringify()
-
-  expect(text).toContain('<h1>Dependency Review</h1>')
-})
-
-test('only includes "No vulnerabilities or license issues found"-message if both are configured and nothing was found', () => {
-  summary.addSummaryToSummary(
-    emptyChanges,
-    emptyInvalidLicenseChanges,
-    defaultConfig
-  )
-  const text = core.summary.stringify()
-
-  expect(text).toContain('✅ No vulnerabilities or license issues found.')
-})
-
-test('only includes "No vulnerabilities found"-message if "license_check" is set to false and nothing was found', () => {
-  const config = {...defaultConfig, license_check: false}
-  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, config)
-  const text = core.summary.stringify()
-
-  expect(text).toContain('✅ No vulnerabilities found.')
-})
-
-test('only includes "No license issues found"-message if "vulnerability_check" is set to false and nothing was found', () => {
-  const config = {...defaultConfig, vulnerability_check: false}
-  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, config)
-  const text = core.summary.stringify()
-
-  expect(text).toContain('✅ No license issues found.')
-})
-
-test('does not include status section if nothing was found', () => {
-  summary.addSummaryToSummary(
-    emptyChanges,
-    emptyInvalidLicenseChanges,
-    defaultConfig
-  )
-  const text = core.summary.stringify()
-
-  expect(text).not.toContain('The following issues were found:')
-})
-
-test('includes count and status icons for all findings', () => {
-  const vulnerabilities = [
-    createTestChange({name: 'lodash'}),
-    createTestChange({name: 'underscore', package_url: 'test-url'})
-  ]
-  const licenseIssues = {
-    forbidden: [createTestChange()],
-    unresolved: [createTestChange(), createTestChange()],
-    unlicensed: [createTestChange(), createTestChange(), createTestChange()]
-  }
-
-  summary.addSummaryToSummary(vulnerabilities, licenseIssues, defaultConfig)
-
-  const text = core.summary.stringify()
-  expect(text).toContain('❌ 2 vulnerable package(s)')
-  expect(text).toContain(
-    '❌ 2 package(s) with invalid SPDX license definitions'
-  )
-  expect(text).toContain('❌ 1 package(s) with incompatible licenses')
-  expect(text).toContain('⚠️ 3 package(s) with unknown licenses')
-})
-
-test('uses checkmarks for license issues if only vulnerabilities were found', () => {
-  const vulnerabilities = [createTestChange()]
-
-  summary.addSummaryToSummary(
-    vulnerabilities,
-    emptyInvalidLicenseChanges,
-    defaultConfig
-  )
-
-  const text = core.summary.stringify()
-  expect(text).toContain('❌ 1 vulnerable package(s)')
-  expect(text).toContain(
-    '✅ 0 package(s) with invalid SPDX license definitions'
-  )
-  expect(text).toContain('✅ 0 package(s) with incompatible licenses')
-  expect(text).toContain('✅ 0 package(s) with unknown licenses')
-})
-
-test('uses checkmarks for vulnerabilities if only license issues were found', () => {
-  const licenseIssues = {
-    forbidden: [createTestChange()],
-    unresolved: [],
-    unlicensed: []
-  }
-
-  summary.addSummaryToSummary(emptyChanges, licenseIssues, defaultConfig)
-
-  const text = core.summary.stringify()
-  expect(text).toContain('✅ 0 vulnerable package(s)')
-  expect(text).toContain(
-    '✅ 0 package(s) with invalid SPDX license definitions'
-  )
-  expect(text).toContain('❌ 1 package(s) with incompatible licenses')
-  expect(text).toContain('✅ 0 package(s) with unknown licenses')
-})
-
-test('addChangeVulnerabilitiesToSummary() - only includes section if any vulnerabilites found', () => {
-  summary.addChangeVulnerabilitiesToSummary(emptyChanges, 'low')
-  const text = core.summary.stringify()
-  expect(text).toEqual('')
-})
-
-test('addChangeVulnerabilitiesToSummary() - includes all vulnerabilities', () => {
-  const changes = [
-    createTestChange({name: 'lodash'}),
-    createTestChange({name: 'underscore', package_url: 'test-url'})
-  ]
-
-  summary.addChangeVulnerabilitiesToSummary(changes, 'low')
-
-  const text = core.summary.stringify()
-  expect(text).toContain('<h2>Vulnerabilities</h2>')
-  expect(text).toContain('lodash')
-  expect(text).toContain('underscore')
-})
-
-test('addChangeVulnerabilitiesToSummary() - includes advisory url if available', () => {
-  const changes = [
-    createTestChange({
-      name: 'underscore',
-      vulnerabilities: [
-        createTestVulnerability({
-          advisory_summary: 'test-summary',
-          advisory_url: 'test-url'
-        })
-      ]
-    })
-  ]
-
-  summary.addChangeVulnerabilitiesToSummary(changes, 'low')
-
-  const text = core.summary.stringify()
-  expect(text).toContain('lodash')
-  expect(text).toContain('<a href="test-url">test-summary</a>')
-})
-
-test('addChangeVulnerabilitiesToSummary() - groups vulnerabilities of a single package', () => {
-  const changes = [
-    createTestChange({
-      name: 'package-with-multiple-vulnerabilities',
-      vulnerabilities: [
-        createTestVulnerability({advisory_summary: 'test-summary-1'}),
-        createTestVulnerability({advisory_summary: 'test-summary-2'})
-      ]
-    })
-  ]
-
-  summary.addChangeVulnerabilitiesToSummary(changes, 'low')
-
-  const text = core.summary.stringify()
-  expect(text.match('package-with-multiple-vulnerabilities')).toHaveLength(1)
-  expect(text).toContain('test-summary-1')
-  expect(text).toContain('test-summary-2')
-})
-
-test('addChangeVulnerabilitiesToSummary() - prints severity statement if above low', () => {
-  const changes = [createTestChange()]
-
-  summary.addChangeVulnerabilitiesToSummary(changes, 'medium')
-
-  const text = core.summary.stringify()
-  expect(text).toContain(
-    'Only included vulnerabilities with severity <strong>medium</strong> or higher.'
-  )
-})
-
-test('addChangeVulnerabilitiesToSummary() - does not print severity statment if it is set to "low"', () => {
-  const changes = [createTestChange()]
-
-  summary.addChangeVulnerabilitiesToSummary(changes, 'low')
-
-  const text = core.summary.stringify()
-  expect(text).not.toContain('Only included vulnerabilities')
-})
-
-test('addLicensesToSummary() - does not include entire section if no license issues found', () => {
-  summary.addLicensesToSummary(emptyInvalidLicenseChanges, defaultConfig)
-  const text = core.summary.stringify()
-  expect(text).toEqual('')
-})
-
-test('addLicensesToSummary() - includes all license issues in table', () => {
-  const licenseIssues = {
-    forbidden: [createTestChange()],
-    unresolved: [createTestChange(), createTestChange()],
-    unlicensed: [createTestChange(), createTestChange(), createTestChange()]
-  }
-
-  summary.addLicensesToSummary(licenseIssues, defaultConfig)
-
-  const text = core.summary.stringify()
-  expect(text).toContain('<h2>License Issues</h2>')
-  expect(text).toContain('<td>Incompatible License</td>')
-  expect(text).toContain('<td>Invalid SPDX License</td>')
-  expect(text).toContain('<td>Unknown License</td>')
-})
-
-test('addLicenseToSummary() - adds one table per manifest', () => {
-  const licenseIssues = {
-    forbidden: [
-      createTestChange({manifest: 'package.json'}),
-      createTestChange({manifest: '.github/workflows/test.yml'})
-    ],
-    unresolved: [],
-    unlicensed: []
-  }
-
-  summary.addLicensesToSummary(licenseIssues, defaultConfig)
-
-  const text = core.summary.stringify()
-
-  expect(text).toContain('<h4><em>package.json</em></h4>')
-  expect(text).toContain('<h4><em>.github/workflows/test.yml</em></h4>')
-})
-
-test('addLicensesToSummary() - does not include specific license type sub-section if nothing is found', () => {
-  const licenseIssues = {
-    forbidden: [],
-    unlicensed: [],
-    unresolved: [createTestChange()]
-  }
-
-  summary.addLicensesToSummary(licenseIssues, defaultConfig)
-
-  const text = core.summary.stringify()
-  expect(text).not.toContain('<td>Incompatible License</td>')
-  expect(text).not.toContain('<td>Unknown License</td>')
-  expect(text).toContain('<td>Invalid SPDX License</td>')
-})
-
-test('addLicensesToSummary() - includes list of configured allowed licenses', () => {
-  const licenseIssues = {
-    forbidden: [createTestChange()],
-    unresolved: [],
-    unlicensed: []
-  }
-
-  const config: ConfigurationOptions = {
-    ...defaultConfig,
-    allow_licenses: ['MIT', 'Apache-2.0']
-  }
-
-  summary.addLicensesToSummary(licenseIssues, config)
-
-  const text = core.summary.stringify()
-  expect(text).toContain('<strong>Allowed Licenses</strong>: MIT, Apache-2.0')
-})
-
-test('addLicensesToSummary() - includes configured denied license', () => {
-  const licenseIssues = {
-    forbidden: [createTestChange()],
-    unresolved: [],
-    unlicensed: []
-  }
-
-  const config: ConfigurationOptions = {
-    ...defaultConfig,
-    deny_licenses: ['MIT']
-  }
-
-  summary.addLicensesToSummary(licenseIssues, config)
-
-  const text = core.summary.stringify()
-  expect(text).toContain('<strong>Denied Licenses</strong>: MIT')
-})
@@ -1,28 +0,0 @@
-// GitHub Action inputs come in the form of environment variables
-// with an INPUT prefix (e.g. INPUT_FAIL-ON-SEVERITY)
-export function setInput(input: string, value: string): void {
-  process.env[`INPUT_${input.toUpperCase()}`] = value
-}
-
-// We want a clean ENV before each test. We use `delete`
-// since we want `undefined` values and not empty strings.
-export function clearInputs(): void {
-  const allowedOptions = [
-    'FAIL-ON-SEVERITY',
-    'FAIL-ON-SCOPES',
-    'ALLOW-LICENSES',
-    'DENY-LICENSES',
-    'ALLOW-GHSAS',
-    'LICENSE-CHECK',
-    'VULNERABILITY-CHECK',
-    'CONFIG-FILE',
-    'BASE-REF',
-    'HEAD-REF',
-    'COMMENT-SUMMARY-IN-PR'
-  ]
-
-  // eslint-disable-next-line github/array-foreach
-  allowedOptions.forEach(option => {
-    delete process.env[`INPUT_${option.toUpperCase()}`]
-  })
-}
@@ -1,5 +1,3 @@
-# Avoid using default values for options here since they will
-# end up overriding external configurations.
 name: 'Dependency Review'
 description: 'Prevent the introduction of dependencies with known vulnerabilities'
 author: 'GitHub'
@@ -11,9 +9,11 @@ inputs:
  fail-on-severity:
    description: Don't block PRs below this severity. Possible values are `low`, `moderate`, `high`, `critical`.
    required: false
+    default: 'low'
  fail-on-scopes:
    description: Dependency scopes to block PRs on. Comma-separated list. Possible values are 'unknown', 'runtime', and 'development' (e.g. "runtime, development")
    required: false
+    default: 'runtime'
  base-ref:
    description: The base git ref to be used for this check. Has a default value when the workflow event is `pull_request` or `pull_request_target`. Must be provided otherwise.
    required: false
@@ -21,7 +21,7 @@ inputs:
    description: The head git ref to be used for this check. Has a default value when the workflow event is `pull_request` or `pull_request_target`. Must be provided otherwise.
    required: false
  config-file:
-    description: A path to the configuration file for the action.
+    description: A filepath to the configuration file for the action.
    required: false
  allow-licenses:
    description: Comma-separated list of allowed licenses (e.g. "MIT, GPL 3.0, BSD 2 Clause")
@@ -30,19 +30,7 @@ inputs:
    description: Comma-separated list of forbidden licenses (e.g. "MIT, GPL 3.0, BSD 2 Clause")
    required: false
  allow-ghsas:
-    description: Comma-separated list of allowed GitHub Advisory IDs (e.g. "GHSA-abcd-1234-5679, GHSA-efgh-1234-5679")
-    required: false
-  external-repo-token:
-    description: A token for fetching external configuration file if it lives in another repository. It is required if the repository is private
-    required: false
-  license-check:
-    description: A boolean to determine if license checks should be performed
-    required: false
-  vulnerability-check:
-    description: A boolean to determine if vulnerability checks should be performed
-    required: false
-  comment-summary-in-pr:
-    description: A boolean to determine if the report should be posted as a comment in the PR itself. Setting this to true requires you to give the workflow the write permissions for pull-requests
+    description: Comma-separated list of allowed Github Advisory IDs (e.g. "GHSA-abcd-1234-5679, GHSA-efgh-1234-5679")
    required: false
 runs:
  using: 'node16'
@@ -1,9 +1,9 @@
 module.exports = {
  clearMocks: true,
-  moduleFileExtensions: ['js', 'json', 'ts'],
+  moduleFileExtensions: ['js', 'ts'],
  testMatch: ['**/*.test.ts'],
  transform: {
    '^.+\\.ts$': 'ts-jest'
  },
  verbose: true
-}
+}
@@ -1,11 +1,11 @@
 {
  "name": "dependency-review-action",
-  "version": "3.0.4",
+  "version": "2.4.0",
  "private": true,
  "description": "A GitHub Action for Dependency Review",
  "main": "lib/main.js",
  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc",
    "format": "prettier --write '**/*.ts'",
    "format-check": "prettier --check '**/*.ts'",
    "lint": "eslint src/**/*.ts",
@@ -27,36 +27,29 @@
  "dependencies": {
    "@actions/core": "^1.10.0",
    "@actions/github": "^5.1.1",
-    "@octokit/plugin-retry": "^4.1.1",
-    "@octokit/request-error": "^2.1.0",
-    "ansi-styles": "^6.2.1",
-    "got": "^12.6.0",
-    "nodemon": "^2.0.22",
-    "octokit": "^2.0.14",
-    "spdx-expression-parse": "^3.0.1",
+    "@octokit/plugin-retry": "^3.0.9",
+    "@octokit/request-error": "^3.0.1",
+    "ansi-styles": "^6.1.1",
+    "got": "^12.5.1",
+    "nodemon": "^2.0.20",
    "spdx-satisfies": "^5.0.1",
-    "yaml": "^2.2.1",
-    "zod": "^3.21.4"
+    "yaml": "^2.1.2",
+    "zod": "^3.19.1"
  },
  "devDependencies": {
-    "@types/jest": "^27.5.2",
-    "@types/node": "^16.18.23",
-    "@typescript-eslint/eslint-plugin": "^5.48.1",
-    "@typescript-eslint/parser": "^5.48.0",
-    "@types/spdx-expression-parse": "^3.0.2",
-    "@types/spdx-satisfies": "^0.1.0",
-    "@typescript-eslint/eslint-plugin": "^5.57.0",
-    "@typescript-eslint/parser": "^5.57.0",
-    "@vercel/ncc": "^0.36.1",
-    "esbuild-register": "^3.4.2",
-    "eslint": "^8.37.0",
-    "eslint-plugin-github": "^4.7.0",
-    "eslint-plugin-jest": "^27.2.1",
+    "@types/node": "^16.11.63",
+    "@typescript-eslint/eslint-plugin": "^5.38.1",
+    "@typescript-eslint/parser": "^5.38.1",
+    "@vercel/ncc": "^0.34.0",
+    "esbuild-register": "^3.3.3",
+    "eslint": "^8.24.0",
+    "eslint-plugin-github": "^4.3.7",
+    "eslint-plugin-jest": "^27.0.4",
    "jest": "^27.5.1",
    "js-yaml": "^4.1.0",
-    "nodemon": "^2.0.22",
-    "prettier": "2.8.7",
+    "nodemon": "^2.0.20",
+    "prettier": "2.7.1",
    "ts-jest": "^27.1.4",
-    "typescript": "^4.9.5"
+    "typescript": "^4.8.4"
  }
 }
@@ -1,114 +0,0 @@
-/**
- * This scripts creates example markdown files for the summary in the ./tmp folder.
- * You can use it to preview changes to the summary.
- *
- * You can execute it like this:
- * npx ts-node scripts/create_summary.ts
- */
-
-import {Changes, ConfigurationOptions} from '../src/schemas'
-import {createTestChange} from '../__tests__/fixtures/create-test-change'
-import {InvalidLicenseChanges} from '../src/licenses'
-import * as fs from 'fs'
-import * as core from '@actions/core'
-import * as summary from '../src/summary'
-import * as path from 'path'
-
-const defaultConfig: ConfigurationOptions = {
-  vulnerability_check: true,
-  license_check: true,
-  fail_on_severity: 'high',
-  fail_on_scopes: ['runtime'],
-  allow_ghsas: [],
-  allow_licenses: ['MIT'],
-  deny_licenses: [],
-  comment_summary_in_pr: true
-}
-
-const tmpDir = path.resolve(__dirname, '../tmp')
-
-const createExampleSummaries = async (): Promise<void> => {
-  await fs.promises.mkdir(tmpDir, {recursive: true})
-
-  await createNonIssueSummary()
-  await createFullSummary()
-}
-
-const createNonIssueSummary = async (): Promise<void> => {
-  await createSummary(
-    [],
-    {forbidden: [], unresolved: [], unlicensed: []},
-    defaultConfig,
-    'non-issue-summary.md'
-  )
-}
-
-const createFullSummary = async (): Promise<void> => {
-  const changes = [createTestChange()]
-  const licenses: InvalidLicenseChanges = {
-    forbidden: [
-      createTestChange({
-        name: 'underscore',
-        version: '1.12.0',
-        license: 'Apache 2.0'
-      })
-    ],
-    unresolved: [
-      createTestChange({
-        name: 'octoinvader',
-        license: 'Non SPDX License'
-      }),
-      createTestChange({
-        name: 'owner/action-1',
-        license: 'XYZ-License',
-        version: 'v1.2.2',
-        manifest: '.github/workflows/action.yml'
-      })
-    ],
-    unlicensed: [
-      createTestChange({
-        name: 'my-other-dependency',
-        license: null
-      }),
-      createTestChange({
-        name: 'owner/action-2',
-        version: 'main',
-        license: null,
-        manifest: '.github/workflows/action.yml'
-      })
-    ]
-  }
-
-  await createSummary(changes, licenses, defaultConfig, 'full-summary.md')
-}
-
-async function createSummary(
-  vulnerabilities: Changes,
-  licenseIssues: InvalidLicenseChanges,
-  config: ConfigurationOptions,
-  fileName: string
-): Promise<void> {
-  summary.addSummaryToSummary(vulnerabilities, licenseIssues, config)
-  summary.addChangeVulnerabilitiesToSummary(
-    vulnerabilities,
-    config.fail_on_severity
-  )
-  summary.addLicensesToSummary(licenseIssues, defaultConfig)
-
-  const allChanges = [
-    ...vulnerabilities,
-    ...licenseIssues.forbidden,
-    ...licenseIssues.unresolved,
-    ...licenseIssues.unlicensed
-  ]
-
-  summary.addScannedDependencies(allChanges)
-
-  const text = core.summary.stringify()
-  await fs.promises.writeFile(path.resolve(tmpDir, fileName), text, {
-    flag: 'w'
-  })
-  core.summary.emptyBuffer()
-}
-
-createExampleSummaries()
@@ -3,52 +3,22 @@ require 'json'
 require 'tempfile'
 require 'open3'
 require 'bundler/inline'
-require 'optparse'

 gemfile do
  source 'https://rubygems.org'
  gem 'octokit'
 end

-config_file = nil
 github_token = ENV["GITHUB_TOKEN"]
-
 if !github_token || github_token.empty?
  puts "Please set the GITHUB_TOKEN environment variable"
  exit -1
 end

-op = OptionParser.new do |opts|
-  usage = <<EOF
-Run Dependency Review on a repository.
-
-\e[1mUsage:\e[22m
-  scripts/scan_pr [options] <pr_url>
-
-\e[1mExample:\e[22m
-  scripts/scan_pr https://github.com/actions/dependency-review-action/pull/294
-
-EOF
-
-  opts.banner = usage
-
-  opts.on('-c', '--config-file <FILE>', 'Use an external configuration file') do |cf|
-    config_file = cf
-  end
-
-  opts.on("-h", "--help", "Prints this help") do
-    puts opts
-    exit
-  end
-end
-
-op.parse!
-
-# make sure we have a NWO somewhere in the parameters
-arg = /(?<repo_nwo>[\w\-]+\/[\w\-]+)\/pull\/(?<pr_number>\d+)/.match(ARGV.join(" "))
+arg = /(?<repo_nwo>[\w\-]+\/[\w\-]+)\/pull\/(?<pr_number>\d+)/.match(ARGV[0])

 if arg.nil?
-  puts op
+  puts "Usage: script/scan_pr <pr_url>"
  exit -1
 end

@@ -63,8 +33,7 @@ event_file.write("{ \"pull_request\": #{pr.to_h.to_json}}")
 event_file.close

 action_inputs = {
-  "repo-token": github_token,
-  "config-file": config_file
+  "repo-token" => github_token
 }

 dev_cmd_env = {
@@ -1,84 +0,0 @@
-import * as github from '@actions/github'
-import * as core from '@actions/core'
-import * as githubUtils from '@actions/github/lib/utils'
-import * as retry from '@octokit/plugin-retry'
-import {RequestError} from '@octokit/request-error'
-
-const retryingOctokit = githubUtils.GitHub.plugin(retry.retry)
-const octo = new retryingOctokit(
-  githubUtils.getOctokitOptions(core.getInput('repo-token', {required: true}))
-)
-
-// Comment Marker to identify an existing comment to update, so we don't spam the PR with comments
-const COMMENT_MARKER = '<!-- dependency-review-pr-comment-marker -->'
-
-export async function commentPr(summary: typeof core.summary): Promise<void> {
-  if (!github.context.payload.pull_request) {
-    core.warning(
-      'Not in the context of a pull request. Skipping comment creation.'
-    )
-    return
-  }
-
-  const commentBody = `${summary.stringify()}\n\n${COMMENT_MARKER}`
-
-  try {
-    const existingCommentId = await findCommentByMarker(COMMENT_MARKER)
-
-    if (existingCommentId) {
-      await octo.rest.issues.updateComment({
-        owner: github.context.repo.owner,
-        repo: github.context.repo.repo,
-        comment_id: existingCommentId,
-        body: commentBody
-      })
-    } else {
-      await octo.rest.issues.createComment({
-        owner: github.context.repo.owner,
-        repo: github.context.repo.repo,
-        issue_number: github.context.payload.pull_request.number,
-        body: commentBody
-      })
-    }
-  } catch (error) {
-    if (error instanceof RequestError && error.status === 403) {
-      core.warning(
-        `Unable to write summary to pull-request. Make sure you are giving this workflow the permission 'pull-requests: write'.`
-      )
-    } else {
-      if (error instanceof Error) {
-        core.warning(
-          `Unable to comment summary to pull-request, received error: ${error.message}`
-        )
-      } else {
-        core.warning(
-          'Unable to comment summary to pull-request: Unexpected fatal error'
-        )
-      }
-    }
-  }
-}
-
-async function findCommentByMarker(
-  commentBodyIncludes: string
-): Promise<number | undefined> {
-  const commentsIterator = octo.paginate.iterator(
-    octo.rest.issues.listComments,
-    {
-      owner: github.context.repo.owner,
-      repo: github.context.repo.repo,
-      // We are already checking if we are in the context of a pull request in the caller
-      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-      issue_number: github.context.payload.pull_request!.number
-    }
-  )
-
-  for await (const {data: comments} of commentsIterator) {
-    const existingComment = comments.find(comment =>
-      comment.body?.includes(commentBodyIncludes)
-    )
-    if (existingComment) return existingComment.id
-  }
-
-  return undefined
-}
@@ -3,64 +3,12 @@ import path from 'path'
 import YAML from 'yaml'
 import * as core from '@actions/core'
 import * as z from 'zod'
-import {ConfigurationOptions, ConfigurationOptionsSchema} from './schemas'
-import {isSPDXValid, octokitClient} from './utils'
-
-type ConfigurationOptionsPartial = Partial<ConfigurationOptions>
-
-export async function readConfig(): Promise<ConfigurationOptions> {
-  const inlineConfig = readInlineConfig()
-
-  const configFile = getOptionalInput('config-file')
-  if (configFile !== undefined) {
-    const externalConfig = await readConfigFile(configFile)
-
-    return ConfigurationOptionsSchema.parse({
-      ...externalConfig,
-      ...inlineConfig
-    })
-  }
-
-  return ConfigurationOptionsSchema.parse(inlineConfig)
-}
-
-function readInlineConfig(): ConfigurationOptionsPartial {
-  const fail_on_severity = getOptionalInput('fail-on-severity')
-  const fail_on_scopes = parseList(getOptionalInput('fail-on-scopes'))
-  const allow_licenses = parseList(getOptionalInput('allow-licenses'))
-  const deny_licenses = parseList(getOptionalInput('deny-licenses'))
-  const allow_ghsas = parseList(getOptionalInput('allow-ghsas'))
-  const license_check = getOptionalBoolean('license-check')
-  const vulnerability_check = getOptionalBoolean('vulnerability-check')
-  const base_ref = getOptionalInput('base-ref')
-  const head_ref = getOptionalInput('head-ref')
-  const comment_summary_in_pr = getOptionalBoolean('comment-summary-in-pr')
-
-  validateLicenses('allow-licenses', allow_licenses)
-  validateLicenses('deny-licenses', deny_licenses)
-
-  const keys = {
-    fail_on_severity,
-    fail_on_scopes,
-    allow_licenses,
-    deny_licenses,
-    allow_ghsas,
-    license_check,
-    vulnerability_check,
-    base_ref,
-    head_ref,
-    comment_summary_in_pr
-  }
-
-  return Object.fromEntries(
-    Object.entries(keys).filter(([_, value]) => value !== undefined)
-  )
-}
-
-function getOptionalBoolean(name: string): boolean | undefined {
-  const value = core.getInput(name)
-  return value.length > 0 ? core.getBooleanInput(name) : undefined
-}
+import {
+  ConfigurationOptions,
+  ConfigurationOptionsSchema,
+  SeveritySchema,
+  SCOPES
+} from './schemas'

 function getOptionalInput(name: string): string | undefined {
  const value = core.getInput(name)
@@ -75,115 +23,70 @@ function parseList(list: string | undefined): string[] | undefined {
  }
 }

-function validateLicenses(
-  key: 'allow-licenses' | 'deny-licenses',
-  licenses: string[] | undefined
-): void {
-  if (licenses === undefined) {
-    return
-  }
-
-  const invalid_licenses = licenses.filter(license => !isSPDXValid(license))
-
-  if (invalid_licenses.length > 0) {
-    throw new Error(`Invalid license(s) in ${key}: ${invalid_licenses}`)
+export function readConfig(): ConfigurationOptions {
+  const externalConfig = getOptionalInput('config-file')
+  if (externalConfig !== undefined) {
+    const config = readConfigFile(externalConfig)
+    // the reasoning behind reading the inline config when an external
+    // config file is provided is that we still want to allow users to
+    // pass inline options in the presence of an external config file.
+    const inlineConfig = readInlineConfig()
+    // the external config takes precedence
+    return Object.assign({}, inlineConfig, config)
+  } else {
+    return readInlineConfig()
  }
 }

-async function readConfigFile(
-  filePath: string
-): Promise<ConfigurationOptionsPartial> {
-  // match a remote config (e.g. 'owner/repo/filepath@someref')
-  const format = new RegExp(
-    '(?<owner>[^/]+)/(?<repo>[^/]+)/(?<path>[^@]+)@(?<ref>.*)'
+export function readInlineConfig(): ConfigurationOptions {
+  const fail_on_severity = SeveritySchema.parse(
+    getOptionalInput('fail-on-severity')
  )
+  const fail_on_scopes = z
+    .array(z.enum(SCOPES))
+    .default(['runtime'])
+    .parse(parseList(getOptionalInput('fail-on-scopes')))

-  let data: string
-  const pieces = format.exec(filePath)
+  const allow_licenses = parseList(getOptionalInput('allow-licenses'))
+  const deny_licenses = parseList(getOptionalInput('deny-licenses'))

-  try {
-    if (pieces?.groups && pieces.length === 5) {
-      data = await getRemoteConfig({
-        owner: pieces.groups.owner,
-        repo: pieces.groups.repo,
-        path: pieces.groups.path,
-        ref: pieces.groups.ref
-      })
-    } else {
-      data = fs.readFileSync(path.resolve(filePath), 'utf-8')
-    }
-    return parseConfigFile(data)
-  } catch (error) {
-    throw new Error(
-      `Unable to fetch or parse config file: ${(error as Error).message}`
-    )
+  if (allow_licenses !== undefined && deny_licenses !== undefined) {
+    throw new Error("Can't specify both allow_licenses and deny_licenses")
+  }
+
+  const allow_ghsas = parseList(getOptionalInput('allow-ghsas'))
+
+  const base_ref = getOptionalInput('base-ref')
+  const head_ref = getOptionalInput('head-ref')
+
+  return {
+    fail_on_severity,
+    fail_on_scopes,
+    allow_licenses,
+    deny_licenses,
+    allow_ghsas,
+    base_ref,
+    head_ref
  }
 }

-function parseConfigFile(configData: string): ConfigurationOptionsPartial {
+export function readConfigFile(filePath: string): ConfigurationOptions {
+  let data
+
  try {
-    const data = YAML.parse(configData)
-
-    // These are the options that we support where the user can provide
-    // either a YAML list or a comma-separated string.
-    const listKeys = [
-      'allow-licenses',
-      'deny-licenses',
-      'fail-on-scopes',
-      'allow-ghsas'
-    ]
-
-    for (const key of Object.keys(data)) {
-      // strings can contain list values (e.g. 'MIT, Apache-2.0'). In this
-      // case we need to parse that into a list (e.g. ['MIT', 'Apache-2.0']).
-      if (listKeys.includes(key)) {
-        const val = data[key]
-
-        if (typeof val === 'string') {
-          data[key] = val.split(',').map(x => x.trim())
-        }
-      }
-
-      // perform SPDX validation
-      if (key === 'allow-licenses' || key === 'deny-licenses') {
-        validateLicenses(key, data[key])
-      }
-
-      // get rid of the ugly dashes from the actions conventions
-      if (key.includes('-')) {
-        data[key.replace(/-/g, '_')] = data[key]
-        delete data[key]
-      }
-    }
-    return data
-  } catch (error) {
+    data = fs.readFileSync(path.resolve(filePath), 'utf-8')
+  } catch (error: unknown) {
    throw error
  }
-}
+  data = YAML.parse(data)

-async function getRemoteConfig(configOpts: {
-  [key: string]: string
-}): Promise<string> {
-  try {
-    const {data} = await octokitClient(
-      'external-repo-token',
-      false
-    ).rest.repos.getContent({
-      mediaType: {
-        format: 'raw'
-      },
-      owner: configOpts.owner,
-      repo: configOpts.repo,
-      path: configOpts.path,
-      ref: configOpts.ref
-    })
-
-    // When using mediaType.format = 'raw', the response.data is a string
-    // but this is not reflected in the return type of getContent, so we're
-    // casting the return value to a string.
-    return z.string().parse(data as unknown)
-  } catch (error) {
-    core.debug(error as string)
-    throw new Error('Error fetching remote config file')
+  // get rid of the ugly dashes from the actions conventions
+  for (const key of Object.keys(data)) {
+    if (key.includes('-')) {
+      data[key.replace(/-/g, '_')] = data[key]
+      delete data[key]
+    }
  }
+  const values = ConfigurationOptionsSchema.parse(data)
+  return values
 }
@@ -51,20 +51,12 @@ export function filterChangesByScopes(
  return filteredChanges
 }

-/**
- * Filter out changes that are allowed by the allow_ghsas config
- * option. We want to remove these changes before we do any
- * processing.
- * @param ghsas - list of GHSA IDs to allow
- * @param changes - list of changes to filter
- * @returns a list of changes with the allowed GHSAs removed
- */
-export function filterAllowedAdvisories(
+export function filterOutAllowedAdvisories(
  ghsas: string[] | undefined,
  changes: Changes
 ): Changes {
  if (ghsas === undefined) {
-    return changes
+    return []
  }

  const filteredChanges = changes.filter(change => {
@@ -1,6 +1,4 @@
-import spdxSatisfies from 'spdx-satisfies'
-import {Change, Changes} from './schemas'
-import {isSPDXValid, octokitClient} from './utils'
+import {Change} from './schemas'

 /**
 * Loops through a list of changes, filtering and returning the
@@ -12,168 +10,40 @@ import {isSPDXValid, octokitClient} from './utils'
 * we will ignore the deny list.
 * @param {Change[]} changes The list of changes to filter.
 * @param { { allow?: string[], deny?: string[]}} licenses An object with `allow`/`deny` keys, each containing a list of licenses.
- * @returns {Promise<{Object.<string, Array.<Change>>}} A promise to a Record Object. The keys are strings, unlicensed, unresolved and forbidden. The values are a list of changes
+ * @returns {[Array<Change>, Array<Change]} A tuple where the first element is the list of denied changes and the second one is the list of changes with unknown licenses
 */
-export type InvalidLicenseChangeTypes =
-  | 'unlicensed'
-  | 'unresolved'
-  | 'forbidden'
-export type InvalidLicenseChanges = Record<InvalidLicenseChangeTypes, Changes>
-export async function getInvalidLicenseChanges(
+export function getDeniedLicenseChanges(
  changes: Change[],
  licenses: {
    allow?: string[]
    deny?: string[]
  }
-): Promise<InvalidLicenseChanges> {
+): [Change[], Change[]] {
  const {allow, deny} = licenses

-  const groupedChanges = await groupChanges(changes)
-  const licensedChanges: Changes = groupedChanges.licensed
-
-  const invalidLicenseChanges: InvalidLicenseChanges = {
-    unlicensed: groupedChanges.unlicensed,
-    unresolved: [],
-    forbidden: []
-  }
-
-  const validityCache = new Map<string, boolean>()
-
-  for (const change of licensedChanges) {
-    const license = change.license
-
-    // should never happen since licensedChanges always have licenses but license is nullable in changes schema
-    if (license === null) {
-      continue
-    }
-
-    if (license === 'NOASSERTION') {
-      invalidLicenseChanges.unlicensed.push(change)
-    } else if (validityCache.get(license) === undefined) {
-      try {
-        if (allow !== undefined) {
-          const found = allow.find(spdxExpression =>
-            spdxSatisfies(license, spdxExpression)
-          )
-          validityCache.set(license, found !== undefined)
-        } else if (deny !== undefined) {
-          const found = deny.find(spdxExpression =>
-            spdxSatisfies(license, spdxExpression)
-          )
-          validityCache.set(license, found === undefined)
-        }
-      } catch (err) {
-        invalidLicenseChanges.unresolved.push(change)
-      }
-    }
-
-    if (validityCache.get(license) === false) {
-      invalidLicenseChanges.forbidden.push(change)
-    }
-  }
-
-  return invalidLicenseChanges
-}
-
-const fetchGHLicense = async (
-  owner: string,
-  repo: string
-): Promise<string | null> => {
-  try {
-    const response = await octokitClient().rest.licenses.getForRepo({
-      owner,
-      repo
-    })
-    return response.data.license?.spdx_id ?? null
-  } catch (_) {
-    return null
-  }
-}
-
-const parseGitHubURL = (url: string): {owner: string; repo: string} | null => {
-  try {
-    const parsed = new URL(url)
-    if (parsed.host !== 'github.com') {
-      return null
-    }
-    const components = parsed.pathname.split('/')
-    if (components.length < 3) {
-      return null
-    }
-    return {owner: components[1], repo: components[2]}
-  } catch (_) {
-    return null
-  }
-}
-
-const setGHLicenses = async (changes: Change[]): Promise<Change[]> => {
-  const updatedChanges = changes.map(async change => {
-    if (change.license !== null || change.source_repository_url === null) {
-      return change
-    }
-
-    const githubUrl = parseGitHubURL(change.source_repository_url)
-
-    if (githubUrl === null) {
-      return change
-    }
-
-    return {
-      ...change,
-      license: await fetchGHLicense(githubUrl.owner, githubUrl.repo)
-    }
-  })
-
-  return Promise.all(updatedChanges)
-}
-// Currently Dependency Graph licenses are truncated to 255 characters
-// This possibly makes them invalid spdx ids
-const truncatedDGLicense = (license: string): boolean =>
-  license.length === 255 && !isSPDXValid(license)
-
-async function groupChanges(
-  changes: Changes
-): Promise<Record<string, Changes>> {
-  const result: Record<string, Changes> = {
-    licensed: [],
-    unlicensed: []
-  }
-
-  const ghChanges = []
+  const disallowed: Change[] = []
+  const unknown: Change[] = []

  for (const change of changes) {
    if (change.change_type === 'removed') {
      continue
    }

-    if (change.license === null) {
-      if (change.source_repository_url !== null) {
-        ghChanges.push(change)
-      } else {
-        result.unlicensed.push(change)
+    const license = change.license
+    if (license === null) {
+      unknown.push(change)
+      continue
+    }
+    if (allow !== undefined) {
+      if (!allow.includes(license)) {
+        disallowed.push(change)
      }
-    } else {
-      if (
-        truncatedDGLicense(change.license) &&
-        change.source_repository_url !== null
-      ) {
-        ghChanges.push(change)
-      } else {
-        result.licensed.push(change)
+    } else if (deny !== undefined) {
+      if (deny.includes(license)) {
+        disallowed.push(change)
      }
    }
  }

-  if (ghChanges.length > 0) {
-    const ghLicenses = await setGHLicenses(ghChanges)
-    for (const change of ghLicenses) {
-      if (change.license === null) {
-        result.unlicensed.push(change)
-      } else {
-        result.licensed.push(change)
-      }
-    }
-  }
-
-  return result
+  return [disallowed, unknown]
 }
@@ -8,18 +8,17 @@ import {readConfig} from '../src/config'
 import {
  filterChangesBySeverity,
  filterChangesByScopes,
-  filterAllowedAdvisories
+  filterOutAllowedAdvisories
 } from '../src/filter'
-import {getInvalidLicenseChanges} from './licenses'
+import {getDeniedLicenseChanges} from './licenses'
 import * as summary from './summary'
 import {getRefs} from './git-refs'

 import {groupDependenciesByManifest} from './utils'
-import {commentPr} from './comment-pr'

 async function run(): Promise<void> {
  try {
-    const config = await readConfig()
+    const config = readConfig()
    const refs = getRefs(config, github.context)

    const changes = await dependencyGraph.compare({
@@ -29,19 +28,14 @@ async function run(): Promise<void> {
      headRef: refs.head
    })

-    if (!changes) {
-      core.info('No Dependency Changes found. Skipping Dependency Review.')
-      return
-    }
-
-    const minSeverity = config.fail_on_severity
+    const minSeverity = config.fail_on_severity as Severity
    const scopedChanges = filterChangesByScopes(config.fail_on_scopes, changes)
-    const filteredChanges = filterAllowedAdvisories(
+    const filteredChanges = filterOutAllowedAdvisories(
      config.allow_ghsas,
      scopedChanges
    )

-    const vulnerableChanges = filterChangesBySeverity(
+    const addedChanges = filterChangesBySeverity(
      minSeverity,
      filteredChanges
    ).filter(
@@ -51,7 +45,7 @@ async function run(): Promise<void> {
        change.vulnerabilities.length > 0
    )

-    const invalidLicenseChanges = await getInvalidLicenseChanges(
+    const [licenseErrors, unknownLicenses] = getDeniedLicenseChanges(
      filteredChanges,
      {
        allow: config.allow_licenses,
@@ -59,26 +53,14 @@ async function run(): Promise<void> {
      }
    )

-    summary.addSummaryToSummary(
-      vulnerableChanges,
-      invalidLicenseChanges,
-      config
-    )
-
-    if (config.vulnerability_check) {
-      summary.addChangeVulnerabilitiesToSummary(vulnerableChanges, minSeverity)
-      printVulnerabilitiesBlock(vulnerableChanges, minSeverity)
-    }
-    if (config.license_check) {
-      summary.addLicensesToSummary(invalidLicenseChanges, config)
-      printLicensesBlock(invalidLicenseChanges)
-    }
-
+    summary.addSummaryToSummary(addedChanges, licenseErrors, unknownLicenses)
+    summary.addChangeVulnerabilitiesToSummary(addedChanges, minSeverity)
+    summary.addLicensesToSummary(licenseErrors, unknownLicenses, config)
    summary.addScannedDependencies(changes)
+
+    printVulnerabilitiesBlock(addedChanges, minSeverity)
+    printLicensesBlock(licenseErrors, unknownLicenses)
    printScannedDependencies(changes)
-    if (config.comment_summary_in_pr) {
-      await commentPr(core.summary)
-    }
  } catch (error) {
    if (error instanceof RequestError && error.status === 404) {
      core.setFailed(
@@ -86,7 +68,7 @@ async function run(): Promise<void> {
      )
    } else if (error instanceof RequestError && error.status === 403) {
      core.setFailed(
-        `Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled along with GitHub Advanced Security on private repositories, see https://github.com/${github.context.repo.owner}/${github.context.repo.repo}/settings/security_analysis`
+        `Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled, see https://github.com/${github.context.repo.owner}/${github.context.repo.repo}/settings/security_analysis`
      )
    } else {
      if (error instanceof Error) {
@@ -101,7 +83,7 @@ async function run(): Promise<void> {
 }

 function printVulnerabilitiesBlock(
-  addedChanges: Changes,
+  addedChanges: Change[],
  minSeverity: Severity
 ): void {
  let failed = false
@@ -137,28 +119,24 @@ function printChangeVulnerabilities(change: Change): void {
 }

 function printLicensesBlock(
-  invalidLicenseChanges: Record<string, Changes>
+  licenseErrors: Change[],
+  unknownLicenses: Change[]
 ): void {
  core.group('Licenses', async () => {
-    if (invalidLicenseChanges.forbidden.length > 0) {
-      core.info('\nThe following dependencies have incompatible licenses:')
-      printLicensesError(invalidLicenseChanges.forbidden)
+    if (licenseErrors.length > 0) {
+      printLicensesError(licenseErrors)
      core.setFailed('Dependency review detected incompatible licenses.')
    }
-    if (invalidLicenseChanges.unresolved.length > 0) {
-      core.warning(
-        '\nThe validity of the licenses of the dependencies below could not be determined. Ensure that they are valid SPDX licenses:'
-      )
-      printLicensesError(invalidLicenseChanges.unresolved)
-      core.setFailed(
-        'Dependency review could not detect the validity of all licenses.'
-      )
-    }
-    printNullLicenses(invalidLicenseChanges.unlicensed)
+    printNullLicenses(unknownLicenses)
  })
 }

-function printLicensesError(changes: Changes): void {
+function printLicensesError(changes: Change[]): void {
+  if (changes.length === 0) {
+    return
+  }
+
+  core.info('\nThe following dependencies have incompatible licenses:\n')
  for (const change of changes) {
    core.info(
      `${styles.bold.open}${change.manifest} » ${change.name}@${change.version}${styles.bold.close} – License: ${styles.color.red.open}${change.license}${styles.color.red.close}`
@@ -166,12 +144,12 @@ function printLicensesError(changes: Changes): void {
  }
 }

-function printNullLicenses(changes: Changes): void {
+function printNullLicenses(changes: Change[]): void {
  if (changes.length === 0) {
    return
  }

-  core.info('\nWe could not detect a license for the following dependencies:')
+  core.info('\nWe could not detect a license for the following dependencies:\n')
  for (const change of changes) {
    core.info(
      `${styles.bold.open}${change.manifest} » ${change.name}@${change.version}${styles.bold.close}`
@@ -214,7 +192,7 @@ function renderScannedDependency(change: Change): string {
    } as const
  )[changeType]

-  return `${styles.color[color].open}${icon} ${change.name}@${change.version}${styles.color[color].close}`
+  return `${styles.color[color].open}${icon} ${change.manifest}@${change.version}${styles.color[color].close}`
 }

 function printScannedDependencies(changes: Changes): void {
@@ -38,39 +38,18 @@ export const ConfigurationOptionsSchema = z
  .object({
    fail_on_severity: SeveritySchema,
    fail_on_scopes: z.array(z.enum(SCOPES)).default(['runtime']),
-    allow_licenses: z.array(z.string()).optional(),
-    deny_licenses: z.array(z.string()).optional(),
+    allow_licenses: z.array(z.string()).default([]),
+    deny_licenses: z.array(z.string()).default([]),
    allow_ghsas: z.array(z.string()).default([]),
-    license_check: z.boolean().default(true),
-    vulnerability_check: z.boolean().default(true),
-    config_file: z.string().optional(),
-    base_ref: z.string().optional(),
-    head_ref: z.string().optional(),
-    comment_summary_in_pr: z.boolean().default(false)
-  })
-  .superRefine((config, context) => {
-    if (config.allow_licenses && config.deny_licenses) {
-      context.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'You cannot specify both allow-licenses and deny-licenses'
-      })
-    }
-    if (config.allow_licenses && config.allow_licenses.length < 1) {
-      context.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'You should provide at least one license in allow-licenses'
-      })
-    }
-    if (
-      config.license_check === false &&
-      config.vulnerability_check === false
-    ) {
-      context.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: "Can't disable both license-check and vulnerability-check"
-      })
-    }
+    config_file: z.string().optional().default('false'),
+    base_ref: z.string(),
+    head_ref: z.string()
  })
+  .partial()
+  .refine(
+    obj => !(obj.allow_licenses && obj.deny_licenses),
+    'Your workflow file has both an allow_licenses list and deny_licenses list, but you can only set one or the other.'
+  )

 export const ChangesSchema = z.array(ChangeSchema)

@@ -78,4 +57,4 @@ export type Change = z.infer<typeof ChangeSchema>
 export type Changes = z.infer<typeof ChangesSchema>
 export type ConfigurationOptions = z.infer<typeof ConfigurationOptionsSchema>
 export type Severity = z.infer<typeof SeveritySchema>
-export type Scope = (typeof SCOPES)[number]
+export type Scope = typeof SCOPES[number]
@@ -1,82 +1,41 @@
 import * as core from '@actions/core'
-import {ConfigurationOptions, Changes} from './schemas'
+import {ConfigurationOptions, Change, Changes} from './schemas'
 import {SummaryTableRow} from '@actions/core/lib/summary'
-import {InvalidLicenseChanges, InvalidLicenseChangeTypes} from './licenses'
 import {groupDependenciesByManifest, getManifestsSet, renderUrl} from './utils'

-const icons = {
-  check: '✅',
-  cross: '❌',
-  warning: '⚠️'
-}
-
 export function addSummaryToSummary(
-  vulnerableChanges: Changes,
-  invalidLicenseChanges: InvalidLicenseChanges,
-  config: ConfigurationOptions
+  addedPackages: Changes,
+  licenseErrors: Change[],
+  unknownLicenses: Change[]
 ): void {
-  core.summary.addHeading('Dependency Review', 1)
-
-  if (
-    vulnerableChanges.length === 0 &&
-    countLicenseIssues(invalidLicenseChanges) === 0
-  ) {
-    if (!config.license_check) {
-      core.summary.addRaw(`${icons.check} No vulnerabilities found.`)
-    } else if (!config.vulnerability_check) {
-      core.summary.addRaw(`${icons.check} No license issues found.`)
-    } else {
-      core.summary.addRaw(
-        `${icons.check} No vulnerabilities or license issues found.`
-      )
-    }
-
-    return
-  }
-
  core.summary
-    .addRaw('The following issues were found:')
-    .addList([
-      ...(config.vulnerability_check
-        ? [
-            `${checkOrFailIcon(vulnerableChanges.length)} ${
-              vulnerableChanges.length
-            } vulnerable package(s)`
-          ]
-        : []),
-      ...(config.license_check
-        ? [
-            `${checkOrFailIcon(invalidLicenseChanges.forbidden.length)} ${
-              invalidLicenseChanges.forbidden.length
-            } package(s) with incompatible licenses`,
-            `${checkOrFailIcon(invalidLicenseChanges.unresolved.length)} ${
-              invalidLicenseChanges.unresolved.length
-            } package(s) with invalid SPDX license definitions`,
-            `${checkOrWarnIcon(invalidLicenseChanges.unlicensed.length)} ${
-              invalidLicenseChanges.unlicensed.length
-            } package(s) with unknown licenses.`
-          ]
-        : [])
-    ])
-    .addRaw('See the Details below.')
+    .addHeading('Dependency Review')
+    .addRaw(
+      `We found ${addedPackages.length} vulnerable package(s), ${licenseErrors.length} package(s) with incompatible licenses, and ${unknownLicenses.length} package(s) with unknown licenses.`
+    )
 }

 export function addChangeVulnerabilitiesToSummary(
-  vulnerableChanges: Changes,
+  addedPackages: Changes,
  severity: string
 ): void {
-  if (vulnerableChanges.length === 0) {
+  const rows: SummaryTableRow[] = []
+
+  const manifests = getManifestsSet(addedPackages)
+
+  core.summary
+    .addHeading('Vulnerabilities')
+    .addQuote(
+      `Vulnerabilites were filtered by mininum severity <strong>${severity}</strong>.`
+    )
+
+  if (addedPackages.length === 0) {
+    core.summary.addQuote('No vulnerabilities found in added packages.')
    return
  }

-  const rows: SummaryTableRow[] = []
-
-  const manifests = getManifestsSet(vulnerableChanges)
-
-  core.summary.addHeading('Vulnerabilities', 2)
-
  for (const manifest of manifests) {
-    for (const change of vulnerableChanges.filter(
+    for (const change of addedPackages.filter(
      pkg => pkg.manifest === manifest
    )) {
      let previous_package = ''
@@ -104,7 +63,7 @@ export function addChangeVulnerabilitiesToSummary(
        previous_version = change.version
      }
    }
-    core.summary.addHeading(`<em>${manifest}</em>`, 4).addTable([
+    core.summary.addHeading(`<em>${manifest}</em>`, 3).addTable([
      [
        {data: 'Name', header: true},
        {data: 'Version', header: true},
@@ -114,24 +73,14 @@ export function addChangeVulnerabilitiesToSummary(
      ...rows
    ])
  }
-
-  if (severity !== 'low') {
-    core.summary.addQuote(
-      `Only included vulnerabilities with severity <strong>${severity}</strong> or higher.`
-    )
-  }
 }

 export function addLicensesToSummary(
-  invalidLicenseChanges: InvalidLicenseChanges,
+  licenseErrors: Change[],
+  unknownLicenses: Change[],
  config: ConfigurationOptions
 ): void {
-  if (countLicenseIssues(invalidLicenseChanges) === 0) {
-    return
-  }
-
-  core.summary.addHeading('License Issues', 2)
-  printLicenseViolations(invalidLicenseChanges)
+  core.summary.addHeading('Licenses')

  if (config.allow_licenses && config.allow_licenses.length > 0) {
    core.summary.addQuote(
@@ -144,65 +93,71 @@ export function addLicensesToSummary(
    )
  }

-  core.debug(
-    `found ${invalidLicenseChanges.unlicensed.length} unknown licenses`
-  )
+  if (licenseErrors.length === 0 && unknownLicenses.length === 0) {
+    core.summary.addQuote('No license violations detected.')
+    return
+  }

-  core.debug(
-    `${invalidLicenseChanges.unresolved.length} licenses could not be validated`
-  )
-}
+  if (licenseErrors.length > 0) {
+    const rows: SummaryTableRow[] = []
+    const manifests = getManifestsSet(licenseErrors)

-const licenseIssueTypes: InvalidLicenseChangeTypes[] = [
-  'forbidden',
-  'unresolved',
-  'unlicensed'
-]
+    core.summary.addHeading('Incompatible Licenses', 3).addSeparator()

-const issueTypeNames: Record<InvalidLicenseChangeTypes, string> = {
-  forbidden: 'Incompatible License',
-  unresolved: 'Invalid SPDX License',
-  unlicensed: 'Unknown License'
-}
+    for (const manifest of manifests) {
+      core.summary.addHeading(`<em>${manifest}</em>`, 4)

-function printLicenseViolations(changes: InvalidLicenseChanges): void {
-  const rowsGroupedByManifest: Record<string, SummaryTableRow[]> = {}
-
-  for (const issueType of licenseIssueTypes) {
-    for (const change of changes[issueType]) {
-      if (!rowsGroupedByManifest[change.manifest]) {
-        rowsGroupedByManifest[change.manifest] = []
+      for (const change of licenseErrors.filter(
+        pkg => pkg.manifest === manifest
+      )) {
+        rows.push([
+          renderUrl(change.source_repository_url, change.name),
+          change.version,
+          change.license || ''
+        ])
      }
-      rowsGroupedByManifest[change.manifest].push([
-        renderUrl(change.source_repository_url, change.name),
-        change.version,
-        formatLicense(change.license),
-        issueTypeNames[issueType]
-      ])
+      core.summary.addTable([['Package', 'Version', 'License'], ...rows])
+    }
+  } else {
+    core.summary.addQuote('No license violations detected.')
+  }
+
+  core.debug(`found ${unknownLicenses.length} unknown licenses`)
+
+  if (unknownLicenses.length > 0) {
+    const rows: SummaryTableRow[] = []
+    const manifests = getManifestsSet(unknownLicenses)
+
+    core.debug(
+      `found ${manifests.entries.length} manifests for unknown licenses`
+    )
+
+    core.summary.addHeading('Unknown Licenses', 3).addSeparator()
+
+    for (const manifest of manifests) {
+      core.summary.addHeading(`<em>${manifest}</em>`, 4)
+
+      for (const change of unknownLicenses.filter(
+        pkg => pkg.manifest === manifest
+      )) {
+        rows.push([
+          renderUrl(change.source_repository_url, change.name),
+          change.version
+        ])
+      }
+
+      core.summary.addTable([['Package', 'Version'], ...rows])
    }
  }
-
-  for (const [manifest, rows] of Object.entries(rowsGroupedByManifest)) {
-    core.summary.addHeading(`<em>${manifest}</em>`, 4)
-    core.summary.addTable([
-      ['Package', 'Version', 'License', 'Issue Type'],
-      ...rows
-    ])
-  }
-}
-
-function formatLicense(license: string | null): string {
-  if (license === null || license === 'NOASSERTION') {
-    return 'Null'
-  }
-  return license
 }

 export function addScannedDependencies(changes: Changes): void {
  const dependencies = groupDependenciesByManifest(changes)
  const manifests = dependencies.keys()

-  const summary = core.summary.addHeading('Scanned Manifest Files', 2)
+  const summary = core.summary
+    .addHeading('Scanned Dependencies')
+    .addRaw(`We scanned ${dependencies.size} manifest files:`)

  for (const manifest of manifests) {
    const deps = dependencies.get(manifest)
@@ -210,24 +165,7 @@ export function addScannedDependencies(changes: Changes): void {
      const dependencyNames = deps.map(
        dependency => `<li>${dependency.name}@${dependency.version}</li>`
      )
-      summary.addDetails(manifest, `<ul>${dependencyNames.join('')}</ul>`)
+      summary.addRaw(`<h3>${manifest}</h3><ul>${dependencyNames.join('')}</ul>`)
    }
  }
 }
-
-function countLicenseIssues(
-  invalidLicenseChanges: InvalidLicenseChanges
-): number {
-  return Object.values(invalidLicenseChanges).reduce(
-    (acc, val) => acc + val.length,
-    0
-  )
-}
-
-function checkOrFailIcon(count: number): string {
-  return count === 0 ? icons.check : icons.cross
-}
-
-function checkOrWarnIcon(count: number): string {
-  return count === 0 ? icons.check : icons.warning
-}
@@ -1,6 +1,3 @@
-import * as core from '@actions/core'
-import {Octokit} from 'octokit'
-import spdxParse from 'spdx-expression-parse'
 import {Changes} from './schemas'

 export function groupDependenciesByManifest(
@@ -31,38 +28,3 @@ export function renderUrl(url: string | null, text: string): string {
    return text
  }
 }
-
-export function isSPDXValid(license: string): boolean {
-  try {
-    spdxParse(license)
-    return true
-  } catch (_) {
-    return false
-  }
-}
-
-function isEnterprise(): boolean {
-  const serverUrl = new URL(
-    process.env['GITHUB_SERVER_URL'] ?? 'https://github.com'
-  )
-  return serverUrl.hostname.toLowerCase() !== 'github.com'
-}
-
-export function octokitClient(token = 'repo-token', required = true): Octokit {
-  const opts: Record<string, unknown> = {}
-
-  // auth is only added if token is present. For remote config files in public
-  // repos the token is optional, so it could be undefined.
-  const auth = core.getInput(token, {required})
-  if (auth !== undefined) {
-    opts['auth'] = auth
-  }
-
-  //baseUrl is required for GitHub Enterprise Server
-  //https://github.com/octokit/octokit.js/blob/9c8fa89d5b0bc4ddbd6dec638db00a2f6c94c298/README.md?plain=1#L196
-  if (isEnterprise()) {
-    opts['baseUrl'] = new URL('api/v3', process.env['GITHUB_SERVER_URL'])
-  }
-
-  return new Octokit(opts)
-}
@@ -1,8 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "include": ["src"],
-  "compilerOptions": {
-    "outDir": "./lib" /* Redirect output structure to the directory. */,
-    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
-  }
-}
@@ -3,9 +3,10 @@
    "target": "es6" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
    "module": "commonjs" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
    "outDir": "./lib" /* Redirect output structure to the directory. */,
+    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
    "strict": true /* Enable all strict type-checking options. */,
    "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
  },
-  "exclude": ["node_modules"]
+  "exclude": ["node_modules", "**/*.test.ts"]
 }