Merge branch 'main' into fix-request-error-handling

2023-01-09 08:07:02 +01:00
31 changed files with 8790 additions and 7769 deletions
@@ -100,5 +100,3 @@ Thumbs.db
 # Ignore built ts files
 __tests__/runner/*
 lib/**/*
-
-tmp
@@ -1,7 +1,7 @@
 # dependency-review-action

 This action scans your pull requests for dependency changes, and will
-raise an error if any vulnerabilities or invalid licenses are being introduced. The action is supported by an [API endpoint](https://docs.github.com/en/rest/reference/dependency-graph#dependency-review) that diffs the dependencies between any two revisions on your default branch.
+raise an error if any vulnerabilities or invalid licenses are being introduced. The action is supported by an [API endpoint](https://docs.github.com/en/rest/reference/dependency-graph#dependency-review) that diffs the dependencies between any two revisions.

 The action is available for all public repositories, as well as private repositories that have GitHub Advanced Security licensed.

@@ -66,26 +66,25 @@ jobs:

 Configure this action by either inlining these options in your workflow file, or by using an external configuration file. All configuration options are optional.

-| Option                          | Usage                                                                                                                                                                             | Possible values                                                              | Default value |
-| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------- |
-| `fail-on-severity`              | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher.              | `low`, `moderate`, `high`, `critical`                                        | `low`         |
-| `allow-licenses`\*              | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list.                                  | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/)               | none          |
-| `deny-licenses`\*               | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list.                                      | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/)               | none          |
-| `fail-on-scopes`†               | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown`                                          | `runtime`     |
-| `allow-ghsas`                   | Contains a list of GitHub Advisory Database IDs that can be skipped during detection.                                                                                             | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none          |
-| `license-check`                 | Enable or disable the license check performed by the action.                                                                                                                      | `true`, `false`                                                              | `true`        |
-| `vulnerability-check`           | Enable or disable the vulnerability check performed by the action.                                                                                                                | `true`, `false`                                                              | `true`        |
-| `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks.                                                                                                            | Any package(s) in [purl](https://github.com/package-url/purl-spec) format    | none          |
-| `base-ref`/`head-ref`           | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`.  | Any valid git ref(s) in your project                                         | none          |
-| `comment-summary-in-pr`         | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`.                 | `true`, `false`                                                              | `false`       |
+| Option                | Usage                                                                                                                                                                             | Possible values                                                                          | Default value |
+|-----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|---------------|
+| `fail-on-severity`    | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher.              | `low`, `moderate`, `high`, `critical`                                                    | `low`         |
+| `allow-licenses`*     | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list.                                  | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none          |
+| `deny-licenses`*      | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list.                                      | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none          |
+| `fail-on-scopes`†      | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. |`runtime`, `development`, `unknown`                                                      | `runtime`     |
+| `allow-ghsas`         | Contains a list of GitHub Advisory Database IDs that can be skipped during detection.                                                                                             | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories)             | none          |
+| `license-check`       | Enable or disable the license check performed by the action.                                                                                                                                | `true`, `false`                                                                          | `true`       |
+| `vulnerability-check` | Enable or disable the vulnerability check performed by the action.                                                                                                                          | `true`, `false`                                                                          | `true`       |
+| `base-ref`/`head-ref` | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`.  | Any valid git ref(s) in your project                                                     | none          |

-\*not supported for use with GitHub Enterprise Server
+*not supported for use with GitHub Enterprise Server
+
+†will be supported with GitHub Enterprise Server 3.8 

-†will be supported with GitHub Enterprise Server 3.8

 ### Inline Configuration

-You can pass options to the Dependency Review GitHub Action using your workflow file.
+You can pass options to the Dependency Review GitHub Action using your workflow file. 

 #### Example

@@ -113,10 +112,10 @@ jobs:

 You can use an external configuration file to specify the settings for this action. It can be a local file or a file in an external repository. Refer to the following options for the specification.

-| Option                | Usage                                                                                                                                                                                                                                                     | Possible values                                                                                                                      |
-| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
-| `config-file`         | A path to a file in the current repository or an external repository. Use this syntax for external files: `OWNER/REPOSITORY/FILENAME@BRANCH`                                                                                                              | **Local file**: `./.github/dependency-review-config.yml` <br> **External repo**: `github/octorepo/dependency-review-config.yml@main` |
-| `external-repo-token` | Specifies a token for fetching the configuration file. It is required if the file resides in a private external repository and for all GitHub Enterprise Server repositories. Create a token in [developer settings](https://github.com/settings/tokens). | Any token with `read` permissions to the repository hosting the config file.                                                         |
+| Option                | Usage                                                                                                                                                                                    | Possible values                                                                                                                |
+|-----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
+| `config-file`         | A path to a file in the current repository or an external repository. Use this syntax for external files: `OWNER/REPOSITORY/FILENAME@BRANCH`                                             | **Local file**: `./.github/dependency-review-config.yml` <br> **External repo**: `github/octorepo/dependency-review-config.yml@main` |
+| `external-repo-token` | Specifies a token for fetching the configuration file. It is required if the file resides in a private external repository and for all GitHub Enterprise Server repositories. Create a token in [developer settings](https://github.com/settings/tokens). | Any token with `read` permissions to the repository hosting the config file.                                                   |

 #### Example

@@ -129,19 +128,16 @@ Start by specifying that you will be using an external configuration file:
    config-file: './.github/dependency-review-config.yml'
 ```

-And then create the file in the path you just specified. Please note
-that the **option names in external files use underscores instead of dashes**:
+And then create the file in the path you just specified: 

 ```yaml
-fail_on_severity: 'critical'
-allow_licenses:
+fail-on-severity: 'critical'
+allow-licenses:
  - 'GPL-3.0'
  - 'BSD-3-Clause'
  - 'MIT'
 ```

-For more examples of how to use this action and its configuration options, see the [examples](docs/examples.md) page.
-
 ### Considerations

 - Checking for licenses is not supported on Enterprise Server.
@@ -2,7 +2,33 @@ import {expect, test, beforeEach} from '@jest/globals'
 import {readConfig} from '../src/config'
 import {getRefs} from '../src/git-refs'
 import * as Utils from '../src/utils'
-import {setInput, clearInputs} from './test-helpers'
+
+// GitHub Action inputs come in the form of environment variables
+// with an INPUT prefix (e.g. INPUT_FAIL-ON-SEVERITY)
+function setInput(input: string, value: string) {
+  process.env[`INPUT_${input.toUpperCase()}`] = value
+}
+
+// We want a clean ENV before each test. We use `delete`
+// since we want `undefined` values and not empty strings.
+function clearInputs() {
+  const allowedOptions = [
+    'FAIL-ON-SEVERITY',
+    'FAIL-ON-SCOPES',
+    'ALLOW-LICENSES',
+    'DENY-LICENSES',
+    'ALLOW-GHSAS',
+    'LICENSE-CHECK',
+    'VULNERABILITY-CHECK',
+    'CONFIG-FILE',
+    'BASE-REF',
+    'HEAD-REF'
+  ]
+
+  allowedOptions.forEach(option => {
+    delete process.env[`INPUT_${option.toUpperCase()}`]
+  })
+}

 beforeAll(() => {
  jest.spyOn(Utils, 'isSPDXValid').mockReturnValue(true)
@@ -77,6 +103,60 @@ test('it raises an error when no refs are provided and the event is not a pull r
  ).toThrow()
 })

+test('it reads an external config file', async () => {
+  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml')
+
+  const config = await readConfig()
+  expect(config.fail_on_severity).toEqual('critical')
+  expect(config.allow_licenses).toEqual(['BSD', 'GPL 2'])
+})
+
+test('raises an error when the config file was not found', async () => {
+  setInput('config-file', 'fixtures/i-dont-exist')
+  await expect(readConfig()).rejects.toThrow(/Unable to fetch/)
+})
+
+test('it parses options from both sources', async () => {
+  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml')
+
+  let config = await readConfig()
+  expect(config.fail_on_severity).toEqual('critical')
+
+  setInput('base-ref', 'a-custom-base-ref')
+  config = await readConfig()
+  expect(config.base_ref).toEqual('a-custom-base-ref')
+})
+
+test('in case of conflicts, the inline config is the source of truth', async () => {
+  setInput('fail-on-severity', 'low')
+  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml') // this will set fail-on-severity to 'critical'
+
+  const config = await readConfig()
+  expect(config.fail_on_severity).toEqual('low')
+})
+
+test('it uses the default values when loading external files', async () => {
+  setInput('config-file', './__tests__/fixtures/no-licenses-config.yml')
+  let config = await readConfig()
+  expect(config.allow_licenses).toEqual(undefined)
+  expect(config.deny_licenses).toEqual(undefined)
+
+  setInput('config-file', './__tests__/fixtures/license-config-sample.yml')
+  config = await readConfig()
+  expect(config.fail_on_severity).toEqual('low')
+})
+
+test('it accepts an external configuration filename', async () => {
+  setInput('config-file', './__tests__/fixtures/no-licenses-config.yml')
+  const config = await readConfig()
+  expect(config.fail_on_severity).toEqual('critical')
+})
+
+test('it raises an error when given an unknown severity in an external config file', async () => {
+  setInput('config-file', './__tests__/fixtures/invalid-severity-config.yml')
+  await expect(readConfig()).rejects.toThrow()
+})
+
 test('it defaults to runtime scope', async () => {
  const config = await readConfig()
  expect(config.fail_on_scopes).toEqual(['runtime'])
@@ -152,6 +232,16 @@ test('it is not possible to disable both checks', async () => {
  )
 })

+test('it supports comma-separated lists', async () => {
+  setInput(
+    'config-file',
+    './__tests__/fixtures/inline-license-config-sample.yml'
+  )
+  let config = await readConfig()
+
+  expect(config.allow_licenses).toEqual(['MIT', 'GPL-2.0-only'])
+})
+
 describe('licenses that are not valid SPDX licenses', () => {
  beforeAll(() => {
    jest.spyOn(Utils, 'isSPDXValid').mockReturnValue(false)
@@ -1,111 +0,0 @@
-import {expect, test, beforeEach} from '@jest/globals'
-import {readConfig} from '../src/config'
-import * as Utils from '../src/utils'
-import {setInput, clearInputs} from './test-helpers'
-
-const externalConfig = `fail_on_severity: 'high'
-allow_licenses: ['GPL-2.0-only']
-`
-const mockOctokit = {
-  rest: {
-    repos: {
-      getContent: jest.fn().mockReturnValue({data: externalConfig})
-    }
-  }
-}
-
-jest.mock('octokit', () => {
-  return {
-    // eslint-disable-next-line @typescript-eslint/no-extraneous-class
-    Octokit: class {
-      constructor() {
-        return mockOctokit
-      }
-    }
-  }
-})
-
-beforeAll(() => {
-  jest.spyOn(Utils, 'isSPDXValid').mockReturnValue(true)
-})
-
-beforeEach(() => {
-  clearInputs()
-})
-
-test('it reads an external config file', async () => {
-  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml')
-
-  const config = await readConfig()
-  expect(config.fail_on_severity).toEqual('critical')
-  expect(config.allow_licenses).toEqual(['BSD', 'GPL 2'])
-})
-
-test('raises an error when the config file was not found', async () => {
-  setInput('config-file', 'fixtures/i-dont-exist')
-  await expect(readConfig()).rejects.toThrow(/Unable to fetch/)
-})
-
-test('it parses options from both sources', async () => {
-  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml')
-
-  let config = await readConfig()
-  expect(config.fail_on_severity).toEqual('critical')
-
-  setInput('base-ref', 'a-custom-base-ref')
-  config = await readConfig()
-  expect(config.base_ref).toEqual('a-custom-base-ref')
-})
-
-test('in case of conflicts, the inline config is the source of truth', async () => {
-  setInput('fail-on-severity', 'low')
-  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml') // this will set fail-on-severity to 'critical'
-
-  const config = await readConfig()
-  expect(config.fail_on_severity).toEqual('low')
-})
-
-test('it uses the default values when loading external files', async () => {
-  setInput('config-file', './__tests__/fixtures/no-licenses-config.yml')
-  let config = await readConfig()
-  expect(config.allow_licenses).toEqual(undefined)
-  expect(config.deny_licenses).toEqual(undefined)
-
-  setInput('config-file', './__tests__/fixtures/license-config-sample.yml')
-  config = await readConfig()
-  expect(config.fail_on_severity).toEqual('low')
-})
-
-test('it accepts an external configuration filename', async () => {
-  setInput('config-file', './__tests__/fixtures/no-licenses-config.yml')
-  const config = await readConfig()
-  expect(config.fail_on_severity).toEqual('critical')
-})
-
-test('it raises an error when given an unknown severity in an external config file', async () => {
-  setInput('config-file', './__tests__/fixtures/invalid-severity-config.yml')
-  await expect(readConfig()).rejects.toThrow()
-})
-
-test('it supports comma-separated lists', async () => {
-  setInput(
-    'config-file',
-    './__tests__/fixtures/inline-license-config-sample.yml'
-  )
-  const config = await readConfig()
-
-  expect(config.allow_licenses).toEqual(['MIT', 'GPL-2.0-only'])
-})
-
-test('it reads a config file hosted in another repo', async () => {
-  setInput(
-    'config-file',
-    'future-funk/anyone-cualkiera/external-config.yml@main'
-  )
-  setInput('external-repo-token', 'gh_viptoken')
-
-  const config = await readConfig()
-
-  expect(config.fail_on_severity).toEqual('high')
-  expect(config.allow_licenses).toEqual(['GPL-2.0-only'])
-})
@@ -1,12 +1,12 @@
 import {expect, test} from '@jest/globals'
-import {Change} from '../src/schemas'
+import {Change, Changes} from '../src/schemas'
 import {
  filterChangesBySeverity,
  filterChangesByScopes,
  filterAllowedAdvisories
 } from '../src/filter'

-const npmChange: Change = {
+let npmChange: Change = {
  manifest: 'package.json',
  change_type: 'added',
  ecosystem: 'npm',
@@ -26,7 +26,7 @@ const npmChange: Change = {
  ]
 }

-const rubyChange: Change = {
+let rubyChange: Change = {
  change_type: 'added',
  manifest: 'Gemfile.lock',
  ecosystem: 'rubygems',
@@ -52,7 +52,7 @@ const rubyChange: Change = {
  ]
 }

-const noVulnNpmChange: Change = {
+let noVulnNpmChange: Change = {
  manifest: 'package.json',
  change_type: 'added',
  ecosystem: 'npm',
@@ -92,7 +92,7 @@ test('it properly filters changes by scope', async () => {

 test('it properly handles undefined advisory IDs', async () => {
  const changes = [npmChange, rubyChange, noVulnNpmChange]
-  const result = filterAllowedAdvisories(undefined, changes)
+  let result = filterAllowedAdvisories(undefined, changes)
  expect(result).toEqual([npmChange, rubyChange, noVulnNpmChange])
 })

@@ -1,36 +0,0 @@
-import {Change} from '../../src/schemas'
-import {createTestVulnerability} from './create-test-vulnerability'
-
-const defaultChange: Change = {
-  change_type: 'added',
-  manifest: 'package.json',
-  ecosystem: 'npm',
-  name: 'lodash',
-  version: '4.17.20',
-  package_url: 'pkg:npm/lodash@4.17.20',
-  license: 'MIT',
-  source_repository_url: 'https://github.com/lodash/lodash',
-  scope: 'runtime',
-  vulnerabilities: [
-    createTestVulnerability({
-      severity: 'high',
-      advisory_ghsa_id: 'GHSA-35jh-r3h4-6jhm',
-      advisory_summary: 'Command Injection in lodash',
-      advisory_url: 'https://github.com/advisories/GHSA-35jh-r3h4-6jhm'
-    }),
-    createTestVulnerability({
-      severity: 'moderate',
-      advisory_ghsa_id: 'GHSA-29mw-wpgm-hmr9',
-      advisory_summary:
-        'Regular Expression Denial of Service (ReDoS) in lodash',
-      advisory_url: 'https://github.com/advisories/GHSA-29mw-wpgm-hmr9'
-    })
-  ]
-}
-
-const createTestChange = (overwrites: Partial<Change> = {}): Change => ({
-  ...defaultChange,
-  ...overwrites
-})
-
-export {createTestChange}
@@ -1,19 +0,0 @@
-import {Change} from '../../src/schemas'
-
-type Vulnerability = Change['vulnerabilities'][0]
-
-const defaultTestVulnerability: Vulnerability = {
-  severity: 'high',
-  advisory_ghsa_id: 'GHSA-35jh-r3h4-6jhm',
-  advisory_summary: 'Command Injection in lodash',
-  advisory_url: 'https://github.com/advisories/GHSA-35jh-r3h4-6jhm'
-}
-
-const createTestVulnerability = (
-  overwrites: Partial<Vulnerability> = {}
-): Vulnerability => ({
-  ...defaultTestVulnerability,
-  ...overwrites
-})
-
-export {createTestVulnerability}
@@ -1 +1 @@
-allow-licenses: "MIT, GPL-2.0-only"
+allow-licenses: MIT, GPL-2.0-only
@@ -1,3 +1,3 @@
-fail_on_severity: 'so many zombies'
-deny_licenses:
+fail-on-severity: 'so many zombies'
+deny-licenses:
  - MIT
@@ -3,7 +3,7 @@ import {Change, Changes} from '../src/schemas'

 let getInvalidLicenseChanges: Function

-const npmChange: Change = {
+let npmChange: Change = {
  manifest: 'package.json',
  change_type: 'added',
  ecosystem: 'npm',
@@ -23,7 +23,7 @@ const npmChange: Change = {
  ]
 }

-const rubyChange: Change = {
+let rubyChange: Change = {
  change_type: 'added',
  manifest: 'Gemfile.lock',
  ecosystem: 'rubygems',
@@ -49,32 +49,6 @@ const rubyChange: Change = {
  ]
 }

-const pipChange: Change = {
-  change_type: 'added',
-  manifest: 'requirements.txt',
-  ecosystem: 'pip',
-  name: 'package-1',
-  version: '1.1.1',
-  package_url: 'pkg:pip/package-1@1.1.1',
-  license: 'MIT',
-  source_repository_url: 'github.com/some-repo',
-  scope: 'runtime',
-  vulnerabilities: [
-    {
-      severity: 'moderate',
-      advisory_ghsa_id: 'second-random_string',
-      advisory_summary: 'not so dangerous',
-      advisory_url: 'github.com/future-funk'
-    },
-    {
-      severity: 'low',
-      advisory_ghsa_id: 'third-random_string',
-      advisory_summary: 'dont page me',
-      advisory_url: 'github.com/future-funk'
-    }
-  ]
-}
-
 jest.mock('@actions/core')

 const mockOctokit = {
@@ -89,7 +63,6 @@ const mockOctokit = {

 jest.mock('octokit', () => {
  return {
-    // eslint-disable-next-line @typescript-eslint/no-extraneous-class
    Octokit: class {
      constructor() {
        return mockOctokit
@@ -105,7 +78,6 @@ beforeEach(async () => {
    // true for BSD, false for all others
    return jest.fn((license: string, _: string): boolean => license === 'BSD')
  })
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
  ;({getInvalidLicenseChanges} = require('../src/licenses'))
 })

@@ -168,7 +140,6 @@ test('it adds all licenses to unresolved if it is unable to determine the validi
      throw new Error('Some Error')
    })
  })
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
  ;({getInvalidLicenseChanges} = require('../src/licenses'))
  const changes: Changes = [npmChange, rubyChange]
  const invalidLicenses = await getInvalidLicenseChanges(changes, {
@@ -179,51 +150,6 @@ test('it adds all licenses to unresolved if it is unable to determine the validi
  expect(invalidLicenses.unresolved.length).toEqual(2)
 })

-test('it does not filter out changes that are on the exclusions list', async () => {
-  const changes: Changes = [pipChange, npmChange, rubyChange]
-  const licensesConfig = {
-    allow: ['BSD'],
-    licenseExclusions: ['pkg:pip/package-1@1.1.1', 'pkg:npm/reeuhq@1.0.2']
-  }
-  const invalidLicenses = await getInvalidLicenseChanges(
-    changes,
-    licensesConfig
-  )
-  expect(invalidLicenses.forbidden.length).toEqual(0)
-})
-
-test('it does not fail when the packages dont have a valid PURL', async () => {
-  const emptyPurlChange = pipChange
-  emptyPurlChange.package_url = ''
-
-  const changes: Changes = [emptyPurlChange, npmChange, rubyChange]
-  const licensesConfig = {
-    allow: ['BSD'],
-    licenseExclusions: ['pkg:pip/package-1@1.1.1', 'pkg:npm/reeuhq@1.0.2']
-  }
-
-  const invalidLicenses = await getInvalidLicenseChanges(
-    changes,
-    licensesConfig
-  )
-  expect(invalidLicenses.forbidden.length).toEqual(1)
-})
-
-test('it does filters out changes if they are not on the exclusions list', async () => {
-  const changes: Changes = [pipChange, npmChange, rubyChange]
-  const licensesConfig = {
-    allow: ['BSD'],
-    licenseExclusions: ['pkg:pip/notmypackage-1@1.1.1', 'pkg:npm/alsonot@1.0.2']
-  }
-  const invalidLicenses = await getInvalidLicenseChanges(
-    changes,
-    licensesConfig
-  )
-  expect(invalidLicenses.forbidden.length).toEqual(2)
-  expect(invalidLicenses.forbidden[0]).toBe(pipChange)
-  expect(invalidLicenses.forbidden[1]).toBe(npmChange)
-})
-
 describe('GH License API fallback', () => {
  test('it calls licenses endpoint if atleast one of the changes has null license and valid source_repository_url', async () => {
    const nullLicenseChange = {
@@ -1,360 +0,0 @@
-import {expect, jest, test} from '@jest/globals'
-import {Changes, ConfigurationOptions} from '../src/schemas'
-import * as summary from '../src/summary'
-import * as core from '@actions/core'
-import {createTestChange} from './fixtures/create-test-change'
-import {createTestVulnerability} from './fixtures/create-test-vulnerability'
-
-afterEach(() => {
-  jest.clearAllMocks()
-  core.summary.emptyBuffer()
-})
-
-const emptyChanges: Changes = []
-const emptyInvalidLicenseChanges = {
-  forbidden: [],
-  unresolved: [],
-  unlicensed: []
-}
-const defaultConfig: ConfigurationOptions = {
-  vulnerability_check: true,
-  license_check: true,
-  fail_on_severity: 'high',
-  fail_on_scopes: ['runtime'],
-  allow_ghsas: [],
-  allow_licenses: [],
-  deny_licenses: [],
-  comment_summary_in_pr: true
-}
-
-const changesWithEmptyManifests: Changes = [
-  {
-    change_type: 'added',
-    manifest: '',
-    ecosystem: 'unknown',
-    name: 'castore',
-    version: '0.1.17',
-    package_url: 'pkg:hex/castore@0.1.17',
-    license: null,
-    source_repository_url: null,
-    scope: 'runtime',
-    vulnerabilities: []
-  },
-  {
-    change_type: 'added',
-    manifest: '',
-    ecosystem: 'unknown',
-    name: 'connection',
-    version: '1.1.0',
-    package_url: 'pkg:hex/connection@1.1.0',
-    license: null,
-    source_repository_url: null,
-    scope: 'runtime',
-    vulnerabilities: []
-  },
-  {
-    change_type: 'added',
-    manifest: 'python/dist-info/METADATA',
-    ecosystem: 'pip',
-    name: 'pygments',
-    version: '2.6.1',
-    package_url: 'pkg:pypi/pygments@2.6.1',
-    license: 'BSD-2-Clause',
-    source_repository_url: 'https://github.com/pygments/pygments',
-    scope: 'runtime',
-    vulnerabilities: []
-  }
-]
-
-test('prints headline as h1', () => {
-  summary.addSummaryToSummary(
-    emptyChanges,
-    emptyInvalidLicenseChanges,
-    defaultConfig
-  )
-  const text = core.summary.stringify()
-
-  expect(text).toContain('<h1>Dependency Review</h1>')
-})
-
-test('only includes "No vulnerabilities or license issues found"-message if both are configured and nothing was found', () => {
-  summary.addSummaryToSummary(
-    emptyChanges,
-    emptyInvalidLicenseChanges,
-    defaultConfig
-  )
-  const text = core.summary.stringify()
-
-  expect(text).toContain('✅ No vulnerabilities or license issues found.')
-})
-
-test('only includes "No vulnerabilities found"-message if "license_check" is set to false and nothing was found', () => {
-  const config = {...defaultConfig, license_check: false}
-  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, config)
-  const text = core.summary.stringify()
-
-  expect(text).toContain('✅ No vulnerabilities found.')
-})
-
-test('only includes "No license issues found"-message if "vulnerability_check" is set to false and nothing was found', () => {
-  const config = {...defaultConfig, vulnerability_check: false}
-  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, config)
-  const text = core.summary.stringify()
-
-  expect(text).toContain('✅ No license issues found.')
-})
-
-test('groups dependencies with empty manifest paths together', () => {
-  summary.addSummaryToSummary(
-    changesWithEmptyManifests,
-    emptyInvalidLicenseChanges,
-    defaultConfig
-  )
-  summary.addScannedDependencies(changesWithEmptyManifests)
-  const text = core.summary.stringify()
-
-  expect(text).toContain('<summary>Unnamed Manifest</summary>')
-  expect(text).toContain('castore')
-  expect(text).toContain('connection')
-  expect(text).toContain('<summary>python/dist-info/METADATA</summary>')
-  expect(text).toContain('pygments')
-})
-
-test('does not include status section if nothing was found', () => {
-  summary.addSummaryToSummary(
-    emptyChanges,
-    emptyInvalidLicenseChanges,
-    defaultConfig
-  )
-  const text = core.summary.stringify()
-
-  expect(text).not.toContain('The following issues were found:')
-})
-
-test('includes count and status icons for all findings', () => {
-  const vulnerabilities = [
-    createTestChange({name: 'lodash'}),
-    createTestChange({name: 'underscore', package_url: 'test-url'})
-  ]
-  const licenseIssues = {
-    forbidden: [createTestChange()],
-    unresolved: [createTestChange(), createTestChange()],
-    unlicensed: [createTestChange(), createTestChange(), createTestChange()]
-  }
-
-  summary.addSummaryToSummary(vulnerabilities, licenseIssues, defaultConfig)
-
-  const text = core.summary.stringify()
-  expect(text).toContain('❌ 2 vulnerable package(s)')
-  expect(text).toContain(
-    '❌ 2 package(s) with invalid SPDX license definitions'
-  )
-  expect(text).toContain('❌ 1 package(s) with incompatible licenses')
-  expect(text).toContain('⚠️ 3 package(s) with unknown licenses')
-})
-
-test('uses checkmarks for license issues if only vulnerabilities were found', () => {
-  const vulnerabilities = [createTestChange()]
-
-  summary.addSummaryToSummary(
-    vulnerabilities,
-    emptyInvalidLicenseChanges,
-    defaultConfig
-  )
-
-  const text = core.summary.stringify()
-  expect(text).toContain('❌ 1 vulnerable package(s)')
-  expect(text).toContain(
-    '✅ 0 package(s) with invalid SPDX license definitions'
-  )
-  expect(text).toContain('✅ 0 package(s) with incompatible licenses')
-  expect(text).toContain('✅ 0 package(s) with unknown licenses')
-})
-
-test('uses checkmarks for vulnerabilities if only license issues were found', () => {
-  const licenseIssues = {
-    forbidden: [createTestChange()],
-    unresolved: [],
-    unlicensed: []
-  }
-
-  summary.addSummaryToSummary(emptyChanges, licenseIssues, defaultConfig)
-
-  const text = core.summary.stringify()
-  expect(text).toContain('✅ 0 vulnerable package(s)')
-  expect(text).toContain(
-    '✅ 0 package(s) with invalid SPDX license definitions'
-  )
-  expect(text).toContain('❌ 1 package(s) with incompatible licenses')
-  expect(text).toContain('✅ 0 package(s) with unknown licenses')
-})
-
-test('addChangeVulnerabilitiesToSummary() - only includes section if any vulnerabilites found', () => {
-  summary.addChangeVulnerabilitiesToSummary(emptyChanges, 'low')
-  const text = core.summary.stringify()
-  expect(text).toEqual('')
-})
-
-test('addChangeVulnerabilitiesToSummary() - includes all vulnerabilities', () => {
-  const changes = [
-    createTestChange({name: 'lodash'}),
-    createTestChange({name: 'underscore', package_url: 'test-url'})
-  ]
-
-  summary.addChangeVulnerabilitiesToSummary(changes, 'low')
-
-  const text = core.summary.stringify()
-  expect(text).toContain('<h2>Vulnerabilities</h2>')
-  expect(text).toContain('lodash')
-  expect(text).toContain('underscore')
-})
-
-test('addChangeVulnerabilitiesToSummary() - includes advisory url if available', () => {
-  const changes = [
-    createTestChange({
-      name: 'underscore',
-      vulnerabilities: [
-        createTestVulnerability({
-          advisory_summary: 'test-summary',
-          advisory_url: 'test-url'
-        })
-      ]
-    })
-  ]
-
-  summary.addChangeVulnerabilitiesToSummary(changes, 'low')
-
-  const text = core.summary.stringify()
-  expect(text).toContain('lodash')
-  expect(text).toContain('<a href="test-url">test-summary</a>')
-})
-
-test('addChangeVulnerabilitiesToSummary() - groups vulnerabilities of a single package', () => {
-  const changes = [
-    createTestChange({
-      name: 'package-with-multiple-vulnerabilities',
-      vulnerabilities: [
-        createTestVulnerability({advisory_summary: 'test-summary-1'}),
-        createTestVulnerability({advisory_summary: 'test-summary-2'})
-      ]
-    })
-  ]
-
-  summary.addChangeVulnerabilitiesToSummary(changes, 'low')
-
-  const text = core.summary.stringify()
-  expect(text.match('package-with-multiple-vulnerabilities')).toHaveLength(1)
-  expect(text).toContain('test-summary-1')
-  expect(text).toContain('test-summary-2')
-})
-
-test('addChangeVulnerabilitiesToSummary() - prints severity statement if above low', () => {
-  const changes = [createTestChange()]
-
-  summary.addChangeVulnerabilitiesToSummary(changes, 'medium')
-
-  const text = core.summary.stringify()
-  expect(text).toContain(
-    'Only included vulnerabilities with severity <strong>medium</strong> or higher.'
-  )
-})
-
-test('addChangeVulnerabilitiesToSummary() - does not print severity statment if it is set to "low"', () => {
-  const changes = [createTestChange()]
-
-  summary.addChangeVulnerabilitiesToSummary(changes, 'low')
-
-  const text = core.summary.stringify()
-  expect(text).not.toContain('Only included vulnerabilities')
-})
-
-test('addLicensesToSummary() - does not include entire section if no license issues found', () => {
-  summary.addLicensesToSummary(emptyInvalidLicenseChanges, defaultConfig)
-  const text = core.summary.stringify()
-  expect(text).toEqual('')
-})
-
-test('addLicensesToSummary() - includes all license issues in table', () => {
-  const licenseIssues = {
-    forbidden: [createTestChange()],
-    unresolved: [createTestChange(), createTestChange()],
-    unlicensed: [createTestChange(), createTestChange(), createTestChange()]
-  }
-
-  summary.addLicensesToSummary(licenseIssues, defaultConfig)
-
-  const text = core.summary.stringify()
-  expect(text).toContain('<h2>License Issues</h2>')
-  expect(text).toContain('<td>Incompatible License</td>')
-  expect(text).toContain('<td>Invalid SPDX License</td>')
-  expect(text).toContain('<td>Unknown License</td>')
-})
-
-test('addLicenseToSummary() - adds one table per manifest', () => {
-  const licenseIssues = {
-    forbidden: [
-      createTestChange({manifest: 'package.json'}),
-      createTestChange({manifest: '.github/workflows/test.yml'})
-    ],
-    unresolved: [],
-    unlicensed: []
-  }
-
-  summary.addLicensesToSummary(licenseIssues, defaultConfig)
-
-  const text = core.summary.stringify()
-
-  expect(text).toContain('<h4><em>package.json</em></h4>')
-  expect(text).toContain('<h4><em>.github/workflows/test.yml</em></h4>')
-})
-
-test('addLicensesToSummary() - does not include specific license type sub-section if nothing is found', () => {
-  const licenseIssues = {
-    forbidden: [],
-    unlicensed: [],
-    unresolved: [createTestChange()]
-  }
-
-  summary.addLicensesToSummary(licenseIssues, defaultConfig)
-
-  const text = core.summary.stringify()
-  expect(text).not.toContain('<td>Incompatible License</td>')
-  expect(text).not.toContain('<td>Unknown License</td>')
-  expect(text).toContain('<td>Invalid SPDX License</td>')
-})
-
-test('addLicensesToSummary() - includes list of configured allowed licenses', () => {
-  const licenseIssues = {
-    forbidden: [createTestChange()],
-    unresolved: [],
-    unlicensed: []
-  }
-
-  const config: ConfigurationOptions = {
-    ...defaultConfig,
-    allow_licenses: ['MIT', 'Apache-2.0']
-  }
-
-  summary.addLicensesToSummary(licenseIssues, config)
-
-  const text = core.summary.stringify()
-  expect(text).toContain('<strong>Allowed Licenses</strong>: MIT, Apache-2.0')
-})
-
-test('addLicensesToSummary() - includes configured denied license', () => {
-  const licenseIssues = {
-    forbidden: [createTestChange()],
-    unresolved: [],
-    unlicensed: []
-  }
-
-  const config: ConfigurationOptions = {
-    ...defaultConfig,
-    deny_licenses: ['MIT']
-  }
-
-  summary.addLicensesToSummary(licenseIssues, config)
-
-  const text = core.summary.stringify()
-  expect(text).toContain('<strong>Denied Licenses</strong>: MIT')
-})
@@ -1,28 +0,0 @@
-// GitHub Action inputs come in the form of environment variables
-// with an INPUT prefix (e.g. INPUT_FAIL-ON-SEVERITY)
-export function setInput(input: string, value: string): void {
-  process.env[`INPUT_${input.toUpperCase()}`] = value
-}
-
-// We want a clean ENV before each test. We use `delete`
-// since we want `undefined` values and not empty strings.
-export function clearInputs(): void {
-  const allowedOptions = [
-    'FAIL-ON-SEVERITY',
-    'FAIL-ON-SCOPES',
-    'ALLOW-LICENSES',
-    'DENY-LICENSES',
-    'ALLOW-GHSAS',
-    'LICENSE-CHECK',
-    'VULNERABILITY-CHECK',
-    'CONFIG-FILE',
-    'BASE-REF',
-    'HEAD-REF',
-    'COMMENT-SUMMARY-IN-PR'
-  ]
-
-  // eslint-disable-next-line github/array-foreach
-  allowedOptions.forEach(option => {
-    delete process.env[`INPUT_${option.toUpperCase()}`]
-  })
-}
@@ -1,5 +1,3 @@
-# Avoid using default values for options here since they will
-# end up overriding external configurations.
 name: 'Dependency Review'
 description: 'Prevent the introduction of dependencies with known vulnerabilities'
 author: 'GitHub'
@@ -11,9 +9,11 @@ inputs:
  fail-on-severity:
    description: Don't block PRs below this severity. Possible values are `low`, `moderate`, `high`, `critical`.
    required: false
+    default: 'low'
  fail-on-scopes:
    description: Dependency scopes to block PRs on. Comma-separated list. Possible values are 'unknown', 'runtime', and 'development' (e.g. "runtime, development")
    required: false
+    default: 'runtime'
  base-ref:
    description: The base git ref to be used for this check. Has a default value when the workflow event is `pull_request` or `pull_request_target`. Must be provided otherwise.
    required: false
@@ -29,9 +29,6 @@ inputs:
  deny-licenses:
    description: Comma-separated list of forbidden licenses (e.g. "MIT, GPL 3.0, BSD 2 Clause")
    required: false
-  allow-dependencies-licenses:
-    description: Comma-separated list of dependencies in purl format (e.g. "pkg:npm/express, pkg:pip/pycrypto"). These dependencies will be permitted to use any license, no matter what license policy is enforced otherwise.
-    required: false
  allow-ghsas:
    description: Comma-separated list of allowed GitHub Advisory IDs (e.g. "GHSA-abcd-1234-5679, GHSA-efgh-1234-5679")
    required: false
@@ -44,9 +41,6 @@ inputs:
  vulnerability-check:
    description: A boolean to determine if vulnerability checks should be performed
    required: false
-  comment-summary-in-pr:
-    description: A boolean to determine if the report should be posted as a comment in the PR itself. Setting this to true requires you to give the workflow the write permissions for pull-requests
-    required: false
 runs:
  using: 'node16'
  main: 'dist/index.js'
@@ -1340,28 +1340,6 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
 IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.


-packageurl-js
-MIT
-Copyright (c) the purl authors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
-the Software, and to permit persons to whom the Software is furnished to do so,
-subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-
 safe-buffer
 MIT
 The MIT License (MIT)
@@ -1,232 +0,0 @@
-# Examples on how to use the Dependancy Review Action
-
-## Basic Usage
-
-A very basic example of how to use the action. This will run the action with the default configuration.
-
-The full list of configuration options can be found [here](../README.md#configuration-options).
-
-```yaml
-name: 'Dependency Review'
-on: [pull_request]
-
-permissions:
-  contents: read
-
-jobs:
-  dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v3
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
-```
-
-## Using an inline configuration
-
-The following example will fail the action if any vulnerabilities are found with a severity of medium or higher; and if any packages are found with an incompatible license - in this case, the LGPL-2.0 and BSD-2-Clause licenses.
-
-```yaml
-name: 'Dependency Review'
-on: [pull_request]
-
-permissions:
-  contents: read
-
-jobs:
-  dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v3
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
-        with:
-          fail-on-severity: critical
-          deny-licenses: LGPL-2.0, BSD-2-Clause
-```
-
-## Using a configuration file
-
-The following example will use a configuration file to configure the action. This is useful if you want to keep your configuration in a single place and makes it easier to manage as the configuration grows.
-
-The configuration file can be located in the same repository or in a separate repository. Having it in a separate repository might be useful if you plan to use the same configuration across multiple repositories and control it centrally.
-
-In this example, the configuration file is located in the same repository under `.github/dependency-review-config.yml`. The following configuration will fail the action if any vulnerabilities are found with a severity of critical; and if any packages are found with an incompatible license - in this case, the LGPL-2.0 and BSD-2-Clause licenses.
-
-```yaml
-fail_on_severity: 'critical'
-allow_licenses:
-  - 'LGPL-2.0'
-  - 'BSD-2-Clause'
-```
-
-The Dependancy Review Action workflow file will then look like this:
-
-```yaml
-name: 'Dependency Review'
-on: [pull_request]
-
-permissions:
-  contents: read
-
-jobs:
-  dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v3
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
-        with:
-          config-file: './.github/dependency-review-config.yml'
-```
-
-## Using a configuration file from a external repository
-
-The following example will use a configuration file from an external public GitHub repository to configure the action.
-
-Let's say that the configuration file is located in `github/octorepo/dependency-review-config.yml@main`
-
-The Dependancy Review Action workflow file will then look like this:
-
-```yaml
-name: 'Dependency Review'
-on: [pull_request]
-
-permissions:
-  contents: read
-
-jobs:
-  dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v3
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
-        with:
-          config-file: 'github/octorepo/dependency-review-config.yml@main'
-```
-
-## Using a configuration file from a external repository with a personal access token
-
-The following example will use a configuration file from an external private GtiHub repository to configure the action.
-
-Let's say that the configuration file is located in `github/octorepo-private/dependency-review-config.yml@main`
-
-The Dependancy Review Action workflow file will then look like this:
-
-```yaml
-name: 'Dependency Review'
-on: [pull_request]
-
-permissions:
-  contents: read
-
-jobs:
-  dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v3
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
-        with:
-          config-file: 'github/octorepo-private/dependency-review-config.yml@main'
-          config-file-token: ${{ secrets.GITHUB_TOKEN }} # or a personal access token
-```
-
-## Getting the results of the action in the PR as a comment
-
-Using the `comment-summary-in-pr` you can get the results of the action in the PR as a comment. In order for this to work, the action needs to be able to create a comment in the PR. This requires additional `pull-requests: write` permission.
-
-```yaml
-name: 'Dependency Review'
-on: [pull_request]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v3
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
-        with:
-          fail-on-severity: critical
-          deny-licenses: LGPL-2.0, BSD-2-Clause
-          comment-summary-in-pr: true
-```
-
-## Exclude dependencies from the license check
-
-Using the `allow-dependencies-licenses` you can exclude dependencies from the license check. The values should be provided in [purl](https://github.com/package-url/purl-spec) format.
-
-In this example, we are excluding `lodash` from `npm` and `requests` from `pip` dependencies from the license check
-
-```yaml
-name: 'Dependency Review'
-on: [pull_request]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v3
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
-        with:
-          fail-on-severity: critical
-          deny-licenses: LGPL-2.0, BSD-2-Clause
-          comment-summary-in-pr: true
-          allow-dependencies-licenses: 'pkg:npm/loadash, pkg:pip/requests'
-```
-
-If we were to use configuration file, the configuration would look like this:
-
-```yaml
-fail-on-severity: 'critical'
-allow-licenses:
-  - 'LGPL-2.0'
-  - 'BSD-2-Clause'
-allow-dependencies-licenses:
-  - 'pkg:npm/loadash'
-  - 'pkg:pip/requests'
-```
-
-## Only check for vulnerabilities
-
-To only do the vulnerability check you can use the `license-check` to disable the license compatibility check (which is done by default).
-
-```yaml
-name: 'Dependency Review'
-on: [pull_request]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v3
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
-        with:
-          fail-on-severity: critical
-          comment-summary-in-pr: true
-          license-check: false
-```
@@ -1,11 +1,11 @@
 {
  "name": "dependency-review-action",
-  "version": "3.0.6",
+  "version": "3.0.2",
  "private": true,
  "description": "A GitHub Action for Dependency Review",
  "main": "lib/main.js",
  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc",
    "format": "prettier --write '**/*.ts'",
    "format-check": "prettier --check '**/*.ts'",
    "lint": "eslint src/**/*.ts",
@@ -27,37 +27,36 @@
  "dependencies": {
    "@actions/core": "^1.10.0",
    "@actions/github": "^5.1.1",
-    "@octokit/plugin-retry": "^4.1.1",
+    "@octokit/plugin-retry": "^4.0.3",
    "@octokit/request-error": "^2.1.0",
    "ansi-styles": "^6.2.1",
-    "got": "^12.6.0",
-    "nodemon": "^2.0.22",
-    "octokit": "^2.0.16",
-    "packageurl-js": "^1.0.2",
+    "got": "^12.5.3",
+    "nodemon": "^2.0.20",
+    "octokit": "^2.0.11",
    "spdx-expression-parse": "^3.0.1",
    "spdx-satisfies": "^5.0.1",
-    "yaml": "^2.3.1",
-    "zod": "^3.21.4"
+    "yaml": "^2.2.1",
+    "zod": "^3.20.2"
  },
  "devDependencies": {
    "@types/jest": "^27.5.2",
-    "@types/node": "^16.18.34",
-    "@typescript-eslint/eslint-plugin": "^5.48.1",
+    "@types/node": "^16.18.11",
+    "@typescript-eslint/eslint-plugin": "^5.45.0",
    "@typescript-eslint/parser": "^5.48.0",
    "@types/spdx-expression-parse": "^3.0.2",
    "@types/spdx-satisfies": "^0.1.0",
-    "@typescript-eslint/eslint-plugin": "^5.59.8",
-    "@typescript-eslint/parser": "^5.59.8",
-    "@vercel/ncc": "^0.36.1",
+    "@typescript-eslint/eslint-plugin": "^5.45.0",
+    "@typescript-eslint/parser": "^5.47.1",
+    "@vercel/ncc": "^0.36.0",
    "esbuild-register": "^3.4.2",
-    "eslint": "^8.41.0",
-    "eslint-plugin-github": "^4.7.0",
+    "eslint": "^8.31.0",
+    "eslint-plugin-github": "^4.6.0",
    "eslint-plugin-jest": "^27.2.1",
    "jest": "^27.5.1",
    "js-yaml": "^4.1.0",
-    "nodemon": "^2.0.22",
-    "prettier": "2.8.8",
+    "nodemon": "^2.0.20",
+    "prettier": "2.8.2",
    "ts-jest": "^27.1.4",
-    "typescript": "^4.9.5"
+    "typescript": "^4.9.4"
  }
 }
@@ -1,120 +0,0 @@
-/**
- * This scripts creates example markdown files for the summary in the ./tmp folder.
- * You can use it to preview changes to the summary.
- *
- * You can execute it like this:
- * npx ts-node scripts/create_summary.ts
- */
-
-import {Changes, ConfigurationOptions} from '../src/schemas'
-import {createTestChange} from '../__tests__/fixtures/create-test-change'
-import {InvalidLicenseChanges} from '../src/licenses'
-import * as fs from 'fs'
-import * as core from '@actions/core'
-import * as summary from '../src/summary'
-import * as path from 'path'
-
-const defaultConfig: ConfigurationOptions = {
-  vulnerability_check: true,
-  license_check: true,
-  fail_on_severity: 'high',
-  fail_on_scopes: ['runtime'],
-  allow_ghsas: [],
-  allow_licenses: ['MIT'],
-  deny_licenses: [],
-  allow_dependencies_licenses: [
-    'pkg:npm/express@4.17.1',
-    'pkg:pip/requests',
-    'pkg:pip/certifi',
-    'pkg:pip/pycrypto@2.6.1'
-  ],
-  comment_summary_in_pr: true
-}
-
-const tmpDir = path.resolve(__dirname, '../tmp')
-
-const createExampleSummaries = async (): Promise<void> => {
-  await fs.promises.mkdir(tmpDir, {recursive: true})
-
-  await createNonIssueSummary()
-  await createFullSummary()
-}
-
-const createNonIssueSummary = async (): Promise<void> => {
-  await createSummary(
-    [],
-    {forbidden: [], unresolved: [], unlicensed: []},
-    defaultConfig,
-    'non-issue-summary.md'
-  )
-}
-
-const createFullSummary = async (): Promise<void> => {
-  const changes = [createTestChange()]
-  const licenses: InvalidLicenseChanges = {
-    forbidden: [
-      createTestChange({
-        name: 'underscore',
-        version: '1.12.0',
-        license: 'Apache 2.0'
-      })
-    ],
-    unresolved: [
-      createTestChange({
-        name: 'octoinvader',
-        license: 'Non SPDX License'
-      }),
-      createTestChange({
-        name: 'owner/action-1',
-        license: 'XYZ-License',
-        version: 'v1.2.2',
-        manifest: '.github/workflows/action.yml'
-      })
-    ],
-    unlicensed: [
-      createTestChange({
-        name: 'my-other-dependency',
-        license: null
-      }),
-      createTestChange({
-        name: 'owner/action-2',
-        version: 'main',
-        license: null,
-        manifest: '.github/workflows/action.yml'
-      })
-    ]
-  }
-
-  await createSummary(changes, licenses, defaultConfig, 'full-summary.md')
-}
-
-async function createSummary(
-  vulnerabilities: Changes,
-  licenseIssues: InvalidLicenseChanges,
-  config: ConfigurationOptions,
-  fileName: string
-): Promise<void> {
-  summary.addSummaryToSummary(vulnerabilities, licenseIssues, config)
-  summary.addChangeVulnerabilitiesToSummary(
-    vulnerabilities,
-    config.fail_on_severity
-  )
-  summary.addLicensesToSummary(licenseIssues, defaultConfig)
-
-  const allChanges = [
-    ...vulnerabilities,
-    ...licenseIssues.forbidden,
-    ...licenseIssues.unresolved,
-    ...licenseIssues.unlicensed
-  ]
-
-  summary.addScannedDependencies(allChanges)
-
-  const text = core.summary.stringify()
-  await fs.promises.writeFile(path.resolve(tmpDir, fileName), text, {
-    flag: 'w'
-  })
-  core.summary.emptyBuffer()
-}
-
-createExampleSummaries()
@@ -1,84 +0,0 @@
-import * as github from '@actions/github'
-import * as core from '@actions/core'
-import * as githubUtils from '@actions/github/lib/utils'
-import * as retry from '@octokit/plugin-retry'
-import {RequestError} from '@octokit/request-error'
-
-const retryingOctokit = githubUtils.GitHub.plugin(retry.retry)
-const octo = new retryingOctokit(
-  githubUtils.getOctokitOptions(core.getInput('repo-token', {required: true}))
-)
-
-// Comment Marker to identify an existing comment to update, so we don't spam the PR with comments
-const COMMENT_MARKER = '<!-- dependency-review-pr-comment-marker -->'
-
-export async function commentPr(summary: typeof core.summary): Promise<void> {
-  if (!github.context.payload.pull_request) {
-    core.warning(
-      'Not in the context of a pull request. Skipping comment creation.'
-    )
-    return
-  }
-
-  const commentBody = `${summary.stringify()}\n\n${COMMENT_MARKER}`
-
-  try {
-    const existingCommentId = await findCommentByMarker(COMMENT_MARKER)
-
-    if (existingCommentId) {
-      await octo.rest.issues.updateComment({
-        owner: github.context.repo.owner,
-        repo: github.context.repo.repo,
-        comment_id: existingCommentId,
-        body: commentBody
-      })
-    } else {
-      await octo.rest.issues.createComment({
-        owner: github.context.repo.owner,
-        repo: github.context.repo.repo,
-        issue_number: github.context.payload.pull_request.number,
-        body: commentBody
-      })
-    }
-  } catch (error) {
-    if (error instanceof RequestError && error.status === 403) {
-      core.warning(
-        `Unable to write summary to pull-request. Make sure you are giving this workflow the permission 'pull-requests: write'.`
-      )
-    } else {
-      if (error instanceof Error) {
-        core.warning(
-          `Unable to comment summary to pull-request, received error: ${error.message}`
-        )
-      } else {
-        core.warning(
-          'Unable to comment summary to pull-request: Unexpected fatal error'
-        )
-      }
-    }
-  }
-}
-
-async function findCommentByMarker(
-  commentBodyIncludes: string
-): Promise<number | undefined> {
-  const commentsIterator = octo.paginate.iterator(
-    octo.rest.issues.listComments,
-    {
-      owner: github.context.repo.owner,
-      repo: github.context.repo.repo,
-      // We are already checking if we are in the context of a pull request in the caller
-      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-      issue_number: github.context.payload.pull_request!.number
-    }
-  )
-
-  for await (const {data: comments} of commentsIterator) {
-    const existingComment = comments.find(comment =>
-      comment.body?.includes(commentBodyIncludes)
-    )
-    if (existingComment) return existingComment.id
-  }
-
-  return undefined
-}
@@ -5,7 +5,6 @@ import * as core from '@actions/core'
 import * as z from 'zod'
 import {ConfigurationOptions, ConfigurationOptionsSchema} from './schemas'
 import {isSPDXValid, octokitClient} from './utils'
-import {PackageURL} from 'packageurl-js'

 type ConfigurationOptionsPartial = Partial<ConfigurationOptions>

@@ -30,17 +29,12 @@ function readInlineConfig(): ConfigurationOptionsPartial {
  const fail_on_scopes = parseList(getOptionalInput('fail-on-scopes'))
  const allow_licenses = parseList(getOptionalInput('allow-licenses'))
  const deny_licenses = parseList(getOptionalInput('deny-licenses'))
-  const allow_dependencies_licenses = parseList(
-    getOptionalInput('allow-dependencies-licenses')
-  )
  const allow_ghsas = parseList(getOptionalInput('allow-ghsas'))
  const license_check = getOptionalBoolean('license-check')
  const vulnerability_check = getOptionalBoolean('vulnerability-check')
  const base_ref = getOptionalInput('base-ref')
  const head_ref = getOptionalInput('head-ref')
-  const comment_summary_in_pr = getOptionalBoolean('comment-summary-in-pr')

-  validatePURL(allow_dependencies_licenses)
  validateLicenses('allow-licenses', allow_licenses)
  validateLicenses('deny-licenses', deny_licenses)

@@ -49,13 +43,11 @@ function readInlineConfig(): ConfigurationOptionsPartial {
    fail_on_scopes,
    allow_licenses,
    deny_licenses,
-    allow_dependencies_licenses,
    allow_ghsas,
    license_check,
    vulnerability_check,
    base_ref,
-    head_ref,
-    comment_summary_in_pr
+    head_ref
  }

  return Object.fromEntries(
@@ -136,8 +128,7 @@ function parseConfigFile(configData: string): ConfigurationOptionsPartial {
      'allow-licenses',
      'deny-licenses',
      'fail-on-scopes',
-      'allow-ghsas',
-      'allow-dependencies-licenses'
+      'allow-ghsas'
    ]

    for (const key of Object.keys(data)) {
@@ -156,11 +147,6 @@ function parseConfigFile(configData: string): ConfigurationOptionsPartial {
        validateLicenses(key, data[key])
      }

-      // validate purls from the allow-dependencies-licenses
-      if (key === 'allow-dependencies-licenses') {
-        validatePURL(data[key])
-      }
-
      // get rid of the ugly dashes from the actions conventions
      if (key.includes('-')) {
        data[key.replace(/-/g, '_')] = data[key]
@@ -199,19 +185,3 @@ async function getRemoteConfig(configOpts: {
    throw new Error('Error fetching remote config file')
  }
 }
-function validatePURL(allow_dependencies_licenses: string[] | undefined): void {
-  //validate that the provided elements of the string are in valid purl format
-  if (allow_dependencies_licenses === undefined) {
-    return
-  }
-  const invalid_purls = allow_dependencies_licenses.filter(
-    purl => !PackageURL.fromString(purl)
-  )
-
-  if (invalid_purls.length > 0) {
-    throw new Error(
-      `Invalid purl(s) in allow-dependencies-licenses: ${invalid_purls}`
-    )
-  }
-  return
-}
@@ -1,14 +1,9 @@
 import * as core from '@actions/core'
 import * as githubUtils from '@actions/github/lib/utils'
 import * as retry from '@octokit/plugin-retry'
-import {
-  ChangesSchema,
-  ComparisonResponse,
-  ComparisonResponseSchema
-} from './schemas'
+import {Changes, ChangesSchema} from './schemas'

 const retryingOctokit = githubUtils.GitHub.plugin(retry.retry)
-const SnapshotWarningsHeader = 'x-github-dependency-graph-snapshot-warnings'
 const octo = new retryingOctokit(
  githubUtils.getOctokitOptions(core.getInput('repo-token', {required: true}))
 )
@@ -23,31 +18,14 @@ export async function compare({
  repo: string
  baseRef: string
  headRef: string
-}): Promise<ComparisonResponse> {
-  let snapshot_warnings = ''
+}): Promise<Changes> {
  const changes = await octo.paginate(
+    'GET /repos/{owner}/{repo}/dependency-graph/compare/{basehead}',
    {
-      method: 'GET',
-      url: '/repos/{owner}/{repo}/dependency-graph/compare/{basehead}',
      owner,
      repo,
      basehead: `${baseRef}...${headRef}`
-    },
-    response => {
-      if (
-        response.headers[SnapshotWarningsHeader] &&
-        typeof response.headers[SnapshotWarningsHeader] === 'string'
-      ) {
-        snapshot_warnings = Buffer.from(
-          response.headers[SnapshotWarningsHeader],
-          'base64'
-        ).toString('utf-8')
-      }
-      return ChangesSchema.parse(response.data)
    }
  )
-  return ComparisonResponseSchema.parse({
-    changes,
-    snapshot_warnings
-  })
+  return ChangesSchema.parse(changes)
 }
@@ -1,72 +1,32 @@
 import spdxSatisfies from 'spdx-satisfies'
 import {Change, Changes} from './schemas'
 import {isSPDXValid, octokitClient} from './utils'
-import {PackageURL} from 'packageurl-js'

 /**
 * Loops through a list of changes, filtering and returning the
 * ones that don't conform to the licenses allow/deny lists.
- * It will also filter out the changes which are defined in the licenseExclusions list.
 *
 * Keep in mind that we don't let users specify both an allow and a deny
 * list in their config files, so this code works under the assumption that
 * one of the two list parameters will be empty. If both lists are provided,
 * we will ignore the deny list.
 * @param {Change[]} changes The list of changes to filter.
- * @param { { allow?: string[], deny?: string[], licenseExclusions?: string[]}} licenses An object with `allow`/`deny`/`licenseExclusions` keys, each containing a list of licenses.
+ * @param { { allow?: string[], deny?: string[]}} licenses An object with `allow`/`deny` keys, each containing a list of licenses.
 * @returns {Promise<{Object.<string, Array.<Change>>}} A promise to a Record Object. The keys are strings, unlicensed, unresolved and forbidden. The values are a list of changes
 */
-export type InvalidLicenseChangeTypes =
-  | 'unlicensed'
-  | 'unresolved'
-  | 'forbidden'
-export type InvalidLicenseChanges = Record<InvalidLicenseChangeTypes, Changes>
 export async function getInvalidLicenseChanges(
  changes: Change[],
  licenses: {
    allow?: string[]
    deny?: string[]
-    licenseExclusions?: string[]
  }
-): Promise<InvalidLicenseChanges> {
+): Promise<Record<string, Changes>> {
  const {allow, deny} = licenses
-  const licenseExclusions = licenses.licenseExclusions?.map(
-    (pkgUrl: string) => {
-      return PackageURL.fromString(pkgUrl)
-    }
-  )

  const groupedChanges = await groupChanges(changes)
-
-  // Takes the changes from the groupedChanges object and filters out the ones that are part of the exclusions list
-  // It does by creating a new PackageURL object from the change and comparing it to the exclusions list
-  groupedChanges.licensed = groupedChanges.licensed.filter(change => {
-    if (change.package_url.length === 0) {
-      return true
-    }
-
-    const changeAsPackageURL = PackageURL.fromString(change.package_url)
-
-    // We want to find if the licenseExclussion list contains the PackageURL of the Change
-    // If it does, we want to filter it out and therefore return false
-    // If it doesn't, we want to keep it and therefore return true
-    if (
-      licenseExclusions !== null &&
-      licenseExclusions !== undefined &&
-      licenseExclusions.findIndex(
-        exclusion =>
-          exclusion.type === changeAsPackageURL.type &&
-          exclusion.name === changeAsPackageURL.name
-      ) !== -1
-    ) {
-      return false
-    } else {
-      return true
-    }
-  })
  const licensedChanges: Changes = groupedChanges.licensed

-  const invalidLicenseChanges: InvalidLicenseChanges = {
+  const invalidLicenseChanges: Record<string, Changes> = {
    unlicensed: groupedChanges.unlicensed,
    unresolved: [],
    forbidden: []
@@ -15,27 +15,18 @@ import * as summary from './summary'
 import {getRefs} from './git-refs'

 import {groupDependenciesByManifest} from './utils'
-import {commentPr} from './comment-pr'

 async function run(): Promise<void> {
  try {
    const config = await readConfig()
-
    const refs = getRefs(config, github.context)

-    const comparison = await dependencyGraph.compare({
+    const changes = await dependencyGraph.compare({
      owner: github.context.repo.owner,
      repo: github.context.repo.repo,
      baseRef: refs.base,
      headRef: refs.head
    })
-    const changes = comparison.changes
-    const snapshot_warnings = comparison.snapshot_warnings
-
-    if (!changes) {
-      core.info('No Dependency Changes found. Skipping Dependency Review.')
-      return
-    }

    const minSeverity = config.fail_on_severity
    const scopedChanges = filterChangesByScopes(config.fail_on_scopes, changes)
@@ -44,7 +35,7 @@ async function run(): Promise<void> {
      scopedChanges
    )

-    const vulnerableChanges = filterChangesBySeverity(
+    const addedChanges = filterChangesBySeverity(
      minSeverity,
      filteredChanges
    ).filter(
@@ -58,24 +49,18 @@ async function run(): Promise<void> {
      filteredChanges,
      {
        allow: config.allow_licenses,
-        deny: config.deny_licenses,
-        licenseExclusions: config.allow_dependencies_licenses
+        deny: config.deny_licenses
      }
    )

    summary.addSummaryToSummary(
-      vulnerableChanges,
-      invalidLicenseChanges,
-      config
+      config.vulnerability_check ? addedChanges : null,
+      config.license_check ? invalidLicenseChanges : null
    )

-    if (snapshot_warnings) {
-      summary.addSnapshotWarnings(snapshot_warnings)
-    }
-
    if (config.vulnerability_check) {
-      summary.addChangeVulnerabilitiesToSummary(vulnerableChanges, minSeverity)
-      printVulnerabilitiesBlock(vulnerableChanges, minSeverity)
+      summary.addChangeVulnerabilitiesToSummary(addedChanges, minSeverity)
+      printVulnerabilitiesBlock(addedChanges, minSeverity)
    }
    if (config.license_check) {
      summary.addLicensesToSummary(invalidLicenseChanges, config)
@@ -84,9 +69,6 @@ async function run(): Promise<void> {

    summary.addScannedDependencies(changes)
    printScannedDependencies(changes)
-    if (config.comment_summary_in_pr) {
-      await commentPr(core.summary)
-    }
  } catch (error) {
    if (error instanceof RequestError && error.status === 404) {
      core.setFailed(
@@ -40,14 +40,12 @@ export const ConfigurationOptionsSchema = z
    fail_on_scopes: z.array(z.enum(SCOPES)).default(['runtime']),
    allow_licenses: z.array(z.string()).optional(),
    deny_licenses: z.array(z.string()).optional(),
-    allow_dependencies_licenses: z.array(z.string()).optional(),
    allow_ghsas: z.array(z.string()).default([]),
    license_check: z.boolean().default(true),
    vulnerability_check: z.boolean().default(true),
    config_file: z.string().optional(),
    base_ref: z.string().optional(),
-    head_ref: z.string().optional(),
-    comment_summary_in_pr: z.boolean().default(false)
+    head_ref: z.string().optional()
  })
  .superRefine((config, context) => {
    if (config.allow_licenses && config.deny_licenses) {
@@ -74,14 +72,9 @@ export const ConfigurationOptionsSchema = z
  })

 export const ChangesSchema = z.array(ChangeSchema)
-export const ComparisonResponseSchema = z.object({
-  changes: z.array(ChangeSchema),
-  snapshot_warnings: z.string()
-})

 export type Change = z.infer<typeof ChangeSchema>
 export type Changes = z.infer<typeof ChangesSchema>
-export type ComparisonResponse = z.infer<typeof ComparisonResponseSchema>
 export type ConfigurationOptions = z.infer<typeof ConfigurationOptionsSchema>
 export type Severity = z.infer<typeof SeveritySchema>
 export type Scope = (typeof SCOPES)[number]
@@ -1,82 +1,50 @@
 import * as core from '@actions/core'
 import {ConfigurationOptions, Changes} from './schemas'
 import {SummaryTableRow} from '@actions/core/lib/summary'
-import {InvalidLicenseChanges, InvalidLicenseChangeTypes} from './licenses'
 import {groupDependenciesByManifest, getManifestsSet, renderUrl} from './utils'

-const icons = {
-  check: '✅',
-  cross: '❌',
-  warning: '⚠️'
-}
-
 export function addSummaryToSummary(
-  vulnerableChanges: Changes,
-  invalidLicenseChanges: InvalidLicenseChanges,
-  config: ConfigurationOptions
+  addedPackages: Changes | null,
+  invalidLicenseChanges: Record<string, Changes> | null
 ): void {
-  core.summary.addHeading('Dependency Review', 1)
-
-  if (
-    vulnerableChanges.length === 0 &&
-    countLicenseIssues(invalidLicenseChanges) === 0
-  ) {
-    if (!config.license_check) {
-      core.summary.addRaw(`${icons.check} No vulnerabilities found.`)
-    } else if (!config.vulnerability_check) {
-      core.summary.addRaw(`${icons.check} No license issues found.`)
-    } else {
-      core.summary.addRaw(
-        `${icons.check} No vulnerabilities or license issues found.`
-      )
-    }
-
-    return
-  }
-
  core.summary
-    .addRaw('The following issues were found:')
+    .addHeading('Dependency Review')
+    .addRaw('We found:')
    .addList([
-      ...(config.vulnerability_check
-        ? [
-            `${checkOrFailIcon(vulnerableChanges.length)} ${
-              vulnerableChanges.length
-            } vulnerable package(s)`
-          ]
+      ...(addedPackages
+        ? [`${addedPackages.length} vulnerable package(s)`]
        : []),
-      ...(config.license_check
+      ...(invalidLicenseChanges
        ? [
-            `${checkOrFailIcon(invalidLicenseChanges.forbidden.length)} ${
-              invalidLicenseChanges.forbidden.length
-            } package(s) with incompatible licenses`,
-            `${checkOrFailIcon(invalidLicenseChanges.unresolved.length)} ${
-              invalidLicenseChanges.unresolved.length
-            } package(s) with invalid SPDX license definitions`,
-            `${checkOrWarnIcon(invalidLicenseChanges.unlicensed.length)} ${
-              invalidLicenseChanges.unlicensed.length
-            } package(s) with unknown licenses.`
+            `${invalidLicenseChanges.unresolved.length} package(s) with invalid SPDX license definitions`,
+            `${invalidLicenseChanges.forbidden.length} package(s) with incompatible licenses`,
+            `${invalidLicenseChanges.unlicensed.length} package(s) with unknown licenses.`
          ]
        : [])
    ])
-    .addRaw('See the Details below.')
 }

 export function addChangeVulnerabilitiesToSummary(
-  vulnerableChanges: Changes,
+  addedPackages: Changes,
  severity: string
 ): void {
-  if (vulnerableChanges.length === 0) {
+  const rows: SummaryTableRow[] = []
+
+  const manifests = getManifestsSet(addedPackages)
+
+  core.summary
+    .addHeading('Vulnerabilities')
+    .addQuote(
+      `Vulnerabilities were filtered by minimum severity <strong>${severity}</strong>.`
+    )
+
+  if (addedPackages.length === 0) {
+    core.summary.addQuote('No vulnerabilities found in added packages.')
    return
  }

-  const rows: SummaryTableRow[] = []
-
-  const manifests = getManifestsSet(vulnerableChanges)
-
-  core.summary.addHeading('Vulnerabilities', 2)
-
  for (const manifest of manifests) {
-    for (const change of vulnerableChanges.filter(
+    for (const change of addedPackages.filter(
      pkg => pkg.manifest === manifest
    )) {
      let previous_package = ''
@@ -104,7 +72,7 @@ export function addChangeVulnerabilitiesToSummary(
        previous_version = change.version
      }
    }
-    core.summary.addHeading(`<em>${manifest}</em>`, 4).addTable([
+    core.summary.addHeading(`<em>${manifest}</em>`, 3).addTable([
      [
        {data: 'Name', header: true},
        {data: 'Version', header: true},
@@ -114,24 +82,13 @@ export function addChangeVulnerabilitiesToSummary(
      ...rows
    ])
  }
-
-  if (severity !== 'low') {
-    core.summary.addQuote(
-      `Only included vulnerabilities with severity <strong>${severity}</strong> or higher.`
-    )
-  }
 }

 export function addLicensesToSummary(
-  invalidLicenseChanges: InvalidLicenseChanges,
+  invalidLicenseChanges: Record<string, Changes>,
  config: ConfigurationOptions
 ): void {
-  if (countLicenseIssues(invalidLicenseChanges) === 0) {
-    return
-  }
-
-  core.summary.addHeading('License Issues', 2)
-  printLicenseViolations(invalidLicenseChanges)
+  core.summary.addHeading('Licenses')

  if (config.allow_licenses && config.allow_licenses.length > 0) {
    core.summary.addQuote(
@@ -143,12 +100,10 @@ export function addLicensesToSummary(
      `<strong>Denied Licenses</strong>: ${config.deny_licenses.join(', ')}`
    )
  }
-  if (config.allow_dependencies_licenses) {
-    core.summary.addQuote(
-      `<strong>Excluded from license check</strong>: ${config.allow_dependencies_licenses.join(
-        ', '
-      )}`
-    )
+
+  if (Object.values(invalidLicenseChanges).every(item => item.length === 0)) {
+    core.summary.addQuote('No license violations detected.')
+    return
  }

  core.debug(
@@ -158,43 +113,39 @@ export function addLicensesToSummary(
  core.debug(
    `${invalidLicenseChanges.unresolved.length} licenses could not be validated`
  )
+
+  printLicenseViolation(
+    'Incompatible Licenses',
+    invalidLicenseChanges.forbidden
+  )
+  printLicenseViolation('Unknown Licenses', invalidLicenseChanges.unlicensed)
+  printLicenseViolation(
+    'Invalid SPDX License Definitions',
+    invalidLicenseChanges.unresolved
+  )
 }
+function printLicenseViolation(heading: string, changes: Changes): void {
+  core.summary.addHeading(heading, 5).addSeparator()

-const licenseIssueTypes: InvalidLicenseChangeTypes[] = [
-  'forbidden',
-  'unresolved',
-  'unlicensed'
-]
+  if (changes.length > 0) {
+    const rows: SummaryTableRow[] = []
+    const manifests = getManifestsSet(changes)

-const issueTypeNames: Record<InvalidLicenseChangeTypes, string> = {
-  forbidden: 'Incompatible License',
-  unresolved: 'Invalid SPDX License',
-  unlicensed: 'Unknown License'
-}
+    for (const manifest of manifests) {
+      core.summary.addHeading(`<em>${manifest}</em>`, 4)

-function printLicenseViolations(changes: InvalidLicenseChanges): void {
-  const rowsGroupedByManifest: Record<string, SummaryTableRow[]> = {}
-
-  for (const issueType of licenseIssueTypes) {
-    for (const change of changes[issueType]) {
-      if (!rowsGroupedByManifest[change.manifest]) {
-        rowsGroupedByManifest[change.manifest] = []
+      for (const change of changes.filter(pkg => pkg.manifest === manifest)) {
+        rows.push([
+          renderUrl(change.source_repository_url, change.name),
+          change.version,
+          formatLicense(change.license)
+        ])
      }
-      rowsGroupedByManifest[change.manifest].push([
-        renderUrl(change.source_repository_url, change.name),
-        change.version,
-        formatLicense(change.license),
-        issueTypeNames[issueType]
-      ])
-    }
-  }

-  for (const [manifest, rows] of Object.entries(rowsGroupedByManifest)) {
-    core.summary.addHeading(`<em>${manifest}</em>`, 4)
-    core.summary.addTable([
-      ['Package', 'Version', 'License', 'Issue Type'],
-      ...rows
-    ])
+      core.summary.addTable([['Package', 'Version', 'License'], ...rows])
+    }
+  } else {
+    core.summary.addQuote(`No ${heading.toLowerCase()} detected.`)
  }
 }

@@ -209,7 +160,9 @@ export function addScannedDependencies(changes: Changes): void {
  const dependencies = groupDependenciesByManifest(changes)
  const manifests = dependencies.keys()

-  const summary = core.summary.addHeading('Scanned Manifest Files', 2)
+  const summary = core.summary
+    .addHeading('Scanned Dependencies')
+    .addHeading(`We scanned ${dependencies.size} manifest files:`, 5)

  for (const manifest of manifests) {
    const deps = dependencies.get(manifest)
@@ -221,37 +174,3 @@ export function addScannedDependencies(changes: Changes): void {
    }
  }
 }
-
-export function addSnapshotWarnings(warnings: string): void {
-  // For now, we want to ignore warnings that just complain
-  // about missing snapshots on the head SHA. This is a product
-  // decision to avoid presenting warnings to users who simply
-  // don't use snapshots.
-  const ignore_regex = new RegExp(/No.*snapshot.*found.*head.*/, 'i')
-  if (ignore_regex.test(warnings)) {
-    return
-  }
-
-  core.summary.addHeading('Snapshot Warnings', 2)
-  core.summary.addQuote(`${icons.warning}: ${warnings}`)
-  core.summary.addRaw(
-    'Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.'
-  )
-}
-
-function countLicenseIssues(
-  invalidLicenseChanges: InvalidLicenseChanges
-): number {
-  return Object.values(invalidLicenseChanges).reduce(
-    (acc, val) => acc + val.length,
-    0
-  )
-}
-
-function checkOrFailIcon(count: number): string {
-  return count === 0 ? icons.check : icons.cross
-}
-
-function checkOrWarnIcon(count: number): string {
-  return count === 0 ? icons.check : icons.warning
-}
@@ -8,9 +8,7 @@ export function groupDependenciesByManifest(
 ): Map<string, Changes> {
  const dependencies: Map<string, Changes> = new Map()
  for (const change of changes) {
-    // If the manifest is null or empty, give it a name now to avoid
-    // breaking the HTML rendering later
-    const manifestName = change.manifest || 'Unnamed Manifest'
+    const manifestName = change.manifest

    if (dependencies.get(manifestName) === undefined) {
      dependencies.set(manifestName, [])
@@ -1,8 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "include": ["src"],
-  "compilerOptions": {
-    "outDir": "./lib" /* Redirect output structure to the directory. */,
-    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
-  }
-}
@@ -3,9 +3,10 @@
    "target": "es6" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
    "module": "commonjs" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
    "outDir": "./lib" /* Redirect output structure to the directory. */,
+    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
    "strict": true /* Enable all strict type-checking options. */,
    "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
  },
-  "exclude": ["node_modules"]
+  "exclude": ["node_modules", "**/*.test.ts"]
 }