doing npm audit fix

Bump zod from 3.20.2 to 3.20.6

__tests__/dependency-graph.int.test.ts

@@ -0,0 +1,29 @@
+import {RequestError} from '@octokit/request-error'
+import * as dependencyGraph from '../src/dependency-graph'
+import * as core from '@actions/core'
+
+// mock call to core.getInput('repo-token'.. to avoid environment setup - Input required and not supplied: repo-token
+jest.mock('@actions/core', () => ({
+  getInput: (input: string) => {
+    if (input === 'repo-token') {
+      return 'gh_testtoken'
+    }
+  }
+}))
+
+test('it properly catches RequestError type', async () => {
+  const token = core.getInput('repo-token', {required: true})
+  expect(token).toBe('gh_testtoken')
+
+  //Integration test to make an API request using current dependencies and ensure response can parse into RequestError
+  try {
+    await dependencyGraph.compare({
+      owner: 'actions',
+      repo: 'dependency-review-action',
+      baseRef: 'refs/heads/master',
+      headRef: 'refs/heads/master'
+    })
+  } catch (error) {
+    expect(error).toBeInstanceOf(RequestError)
+  }
+})

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",
@@ -27,34 +27,36 @@
   "dependencies": {
     "@actions/core": "^1.10.0",
     "@actions/github": "^5.1.1",
-    "@octokit/plugin-retry": "^4.0.3",
-    "@octokit/request-error": "^3.0.2",
+    "@octokit/plugin-retry": "^4.1.1",
+    "@octokit/request-error": "^2.1.0",
     "ansi-styles": "^6.2.1",
     "got": "^12.5.3",
     "nodemon": "^2.0.20",
-    "octokit": "^2.0.11",
+    "octokit": "^2.0.14",
     "spdx-expression-parse": "^3.0.1",
     "spdx-satisfies": "^5.0.1",
     "yaml": "^2.2.1",
-    "zod": "^3.20.2"
+    "zod": "^3.20.6"
   },
   "devDependencies": {
     "@types/jest": "^27.5.2",
-    "@types/node": "^16.18.11",
-    "@typescript-eslint/eslint-plugin": "^5.45.0",
+    "@types/node": "^16.18.12",
+    "@typescript-eslint/eslint-plugin": "^5.48.1",
     "@typescript-eslint/parser": "^5.48.0",
     "@types/spdx-expression-parse": "^3.0.2",
     "@types/spdx-satisfies": "^0.1.0",
-    "@vercel/ncc": "^0.36.0",
+    "@typescript-eslint/eslint-plugin": "^5.51.0",
+    "@typescript-eslint/parser": "^5.51.0",
+    "@vercel/ncc": "^0.36.1",
     "esbuild-register": "^3.4.2",
-    "eslint": "^8.31.0",
+    "eslint": "^8.34.0",
     "eslint-plugin-github": "^4.6.0",
     "eslint-plugin-jest": "^27.2.1",
     "jest": "^27.5.1",
     "js-yaml": "^4.1.0",
     "nodemon": "^2.0.20",
-    "prettier": "2.8.2",
+    "prettier": "2.8.4",
     "ts-jest": "^27.1.4",
-    "typescript": "^4.9.4"
+    "typescript": "^4.9.5"
   }
 }

src/main.ts

@@ -76,7 +76,7 @@ async function run(): Promise<void> {
       )
     } else if (error instanceof RequestError && error.status === 403) {
       core.setFailed(
-        `Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled, see https://github.com/${github.context.repo.owner}/${github.context.repo.repo}/settings/security_analysis`
+        `Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled along with GitHub Advanced Security on private repositories, see https://github.com/${github.context.repo.owner}/${github.context.repo.repo}/settings/security_analysis`
       )
     } else {
       if (error instanceof Error) {