npm run package

CONTRIBUTING.md

@@ -16,7 +16,7 @@ If you've encountered a problem, please let us know by [submitting an issue](htt
 
 ## Enhancements and feature requests
 
-If you've got an idea for a new feature or a significant change to the code or its dependencies, please submit as [an issue](https://github.com/actions/dependency-review-action/issues/new) so that the community can see it, and we can discuss it there. We may not be able to respond to every single issue, but will make a best effort!
+If you've got an idea for a new feature, please submit as [an issue](https://github.com/actions/dependency-review-action/issues/new) so that the community can see it, and we can discuss it there. We may not be able to respond to every single issue, but will make a best effort!
 
 If you'd like to make a contribution yourself, we ask that before significant effort is put into code changes, that we have agreement that the change aligns with our strategy for the action. Since this is a verified Action owned by GitHub we want to make sure that contributions are high quality, and that they maintain consistency with the rest of the action's behavior.
 

__tests__/config.test.ts

@@ -124,51 +124,6 @@ test('it raises an error when no refs are provided and the event is not a pull r
   ).toThrow()
 })
 
-const pullRequestLikeEvents = [
-  'pull_request',
-  'pull_request_target',
-  'merge_group'
-]
-
-test.each(pullRequestLikeEvents)(
-  'it uses the given refs even when the event is %s',
-  async eventName => {
-    setInput('base-ref', 'a-custom-base-ref')
-    setInput('head-ref', 'a-custom-head-ref')
-
-    const refs = getRefs(await readConfig(), {
-      payload: {
-        pull_request: {
-          number: 42,
-          base: {sha: 'pr-base-ref'},
-          head: {sha: 'pr-head-ref'}
-        }
-      },
-      eventName
-    })
-    expect(refs.base).toEqual('a-custom-base-ref')
-    expect(refs.head).toEqual('a-custom-head-ref')
-  }
-)
-
-test.each(pullRequestLikeEvents)(
-  'it uses the event refs when the event is %s and the no refs are input',
-  async eventName => {
-    const refs = getRefs(await readConfig(), {
-      payload: {
-        pull_request: {
-          number: 42,
-          base: {sha: 'pr-base-ref'},
-          head: {sha: 'pr-head-ref'}
-        }
-      },
-      eventName
-    })
-    expect(refs.base).toEqual('pr-base-ref')
-    expect(refs.head).toEqual('pr-head-ref')
-  }
-)
-
 test('it defaults to runtime scope', async () => {
   const config = await readConfig()
   expect(config.fail_on_scopes).toEqual(['runtime'])

__tests__/spdx.test.ts

@@ -1,7 +1,7 @@
-import {expect, test, describe} from '@jest/globals'
+import {expect, test} from '@jest/globals'
 import * as spdx from '../src/spdx'
 
-describe('satisfiesAny', () => {
+test('satisfiesAny', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -59,14 +59,17 @@ describe('satisfiesAny', () => {
   ]
 
   for (const unit of units) {
-    const got: boolean = spdx.satisfiesAny(unit.candidate, unit.licenses)
+    let got: boolean = spdx.satisfiesAny(unit.candidate, unit.licenses)
-    test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.licenses}")`, () => {
+    if (got != unit.expected) {
-      expect(got).toBe(unit.expected)
+      console.log(
-    })
+        `failing unit test inputs: candidate(${unit.candidate}) licenses(${unit.licenses})`
+      )
+    }
+    expect(got).toBe(unit.expected)
   }
 })
 
-describe('satisfiesAll', () => {
+test('satisfiesAll', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -134,14 +137,17 @@ describe('satisfiesAll', () => {
   ]
 
   for (const unit of units) {
-    const got: boolean = spdx.satisfiesAll(unit.candidate, unit.licenses)
+    let got: boolean = spdx.satisfiesAll(unit.candidate, unit.licenses)
-    test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.licenses}")`, () => {
+    if (got != unit.expected) {
-      expect(got).toBe(unit.expected)
+      console.log(
-    })
+        `failing unit test inputs: candidate(${unit.candidate}) licenses(${unit.licenses})`
+      )
+    }
+    expect(got).toBe(unit.expected)
   }
 })
 
-describe('satisfies', () => {
+test('satisfies', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -214,14 +220,17 @@ describe('satisfies', () => {
   ]
 
   for (const unit of units) {
-    const got: boolean = spdx.satisfies(unit.candidate, unit.constraint)
+    let got: boolean = spdx.satisfies(unit.candidate, unit.constraint)
-    test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.constraint}")`, () => {
+    if (got != unit.expected) {
-      expect(got).toBe(unit.expected)
+      console.log(
-    })
+        `failing unit test inputs: candidateExpr(${unit.candidate}) constraintExpr(${unit.constraint})`
+      )
+    }
+    expect(got).toBe(unit.expected)
   }
 })
 
-describe('isValid', () => {
+test('isValid', () => {
   const units = [
     {
       candidate: 'MIT',
@@ -249,9 +258,10 @@ describe('isValid', () => {
     }
   ]
   for (const unit of units) {
-    const got: boolean = spdx.isValid(unit.candidate)
+    let got: boolean = spdx.isValid(unit.candidate)
-    test(`should return ${unit.expected} for ("${unit.candidate}")`, () => {
+    if (got != unit.expected) {
-      expect(got).toBe(unit.expected)
+      console.log(`failing unit test inputs: candidateExpr(${unit.candidate})`)
-    })
+    }
+    expect(got).toBe(unit.expected)
   }
 })

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "dependency-review-action",
-  "version": "4.3.4",
+  "version": "4.3.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dependency-review-action",
-      "version": "4.3.4",
+      "version": "4.3.3",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.1",
@@ -15,14 +15,14 @@
         "@octokit/request-error": "^5.0.1",
         "@onebeyond/spdx-license-satisfies": "^1.0.1",
         "ansi-styles": "^6.2.1",
-        "got": "^14.4.1",
+        "got": "^14.2.0",
         "jest": "^29.7.0",
         "octokit": "^3.1.2",
         "spdx-expression-parse": "^3.0.1",
         "spdx-satisfies": "^5.0.1",
         "ts-jest": "^29.1.2",
         "yaml": "^2.3.4",
-        "zod": "^3.23.8"
+        "zod": "^3.22.3"
       },
       "devDependencies": {
         "@types/jest": "^29.5.12",
@@ -1945,20 +1945,15 @@
         "url": "https://opencollective.com/unts"
       }
     },
-    "node_modules/@sec-ant/readable-stream": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@sec-ant/readable-stream/-/readable-stream-0.4.1.tgz",
-      "integrity": "sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg=="
-    },
     "node_modules/@sinclair/typebox": {
       "version": "0.27.8",
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.8.tgz",
       "integrity": "sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA=="
     },
     "node_modules/@sindresorhus/is": {
-      "version": "6.3.1",
+      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-6.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-6.1.0.tgz",
-      "integrity": "sha512-FX4MfcifwJyFOI2lPoX7PQxCqx8BG1HCho7WdiXwpEQx1Ycij0JxkfYtGK7yqNScrZGSlt6RE6sw8QYoH7eKnQ==",
+      "integrity": "sha512-BuvU07zq3tQ/2SIgBsEuxKYDyDjC0n7Zir52bpHy2xnBbW81+po43aLFPLbeV3HRAheFbGud1qgcqSYfhtHMAg==",
       "engines": {
         "node": ">=16"
       },
@@ -2816,11 +2811,11 @@
       }
     },
     "node_modules/braces": {
-      "version": "3.0.3",
+      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
-      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
       "dependencies": {
-        "fill-range": "^7.1.1"
+        "fill-range": "^7.0.1"
       },
       "engines": {
         "node": ">=8"
@@ -2900,46 +2895,20 @@
       }
     },
     "node_modules/cacheable-request": {
-      "version": "12.0.1",
+      "version": "10.2.14",
-      "resolved": "https://registry.npmjs.org/cacheable-request/-/cacheable-request-12.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/cacheable-request/-/cacheable-request-10.2.14.tgz",
-      "integrity": "sha512-Yo9wGIQUaAfIbk+qY0X4cDQgCosecfBe3V9NSyeY4qPC2SAkbCS4Xj79VP8WOzitpJUZKc/wsRCYF5ariDIwkg==",
+      "integrity": "sha512-zkDT5WAF4hSSoUgyfg5tFIxz8XQK+25W/TLVojJTMKBaxevLBBtLxgqguAuVQB8PVW79FVjHcU+GJ9tVbDZ9mQ==",
       "dependencies": {
-        "@types/http-cache-semantics": "^4.0.4",
+        "@types/http-cache-semantics": "^4.0.2",
-        "get-stream": "^9.0.1",
+        "get-stream": "^6.0.1",
         "http-cache-semantics": "^4.1.1",
-        "keyv": "^4.5.4",
+        "keyv": "^4.5.3",
         "mimic-response": "^4.0.0",
-        "normalize-url": "^8.0.1",
+        "normalize-url": "^8.0.0",
         "responselike": "^3.0.0"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=14.16"
-      }
-    },
-    "node_modules/cacheable-request/node_modules/get-stream": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-9.0.1.tgz",
-      "integrity": "sha512-kVCxPF3vQM/N0B1PmoqVUqgHP+EeVjmZSQn+1oCRPxd2P21P2F19lIgbR3HBosbB1PUhOAoctJnfEn2GbN2eZA==",
-      "dependencies": {
-        "@sec-ant/readable-stream": "^0.4.1",
-        "is-stream": "^4.0.1"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/cacheable-request/node_modules/is-stream": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-4.0.1.tgz",
-      "integrity": "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A==",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/call-bind": {
@@ -4516,9 +4485,9 @@
       }
     },
     "node_modules/fill-range": {
-      "version": "7.1.1",
+      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
-      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
       "dependencies": {
         "to-regex-range": "^5.0.1"
       },
@@ -4792,22 +4761,21 @@
       }
     },
     "node_modules/got": {
-      "version": "14.4.1",
+      "version": "14.2.0",
-      "resolved": "https://registry.npmjs.org/got/-/got-14.4.1.tgz",
+      "resolved": "https://registry.npmjs.org/got/-/got-14.2.0.tgz",
-      "integrity": "sha512-IvDJbJBUeexX74xNQuMIVgCRRuNOm5wuK+OC3Dc2pnSoh1AOmgc7JVj7WC+cJ4u0aPcO9KZ2frTXcqK4W/5qTQ==",
+      "integrity": "sha512-dBq2KkHcQl3AwPoIWsLsQScCPpUgRulz1qZVthjPYKYOPmYfBnekR3vxecjZbm91Vc3JUGnV9mqFX7B+Fe2quw==",
       "dependencies": {
-        "@sindresorhus/is": "^6.3.1",
+        "@sindresorhus/is": "^6.1.0",
         "@szmarczak/http-timer": "^5.0.1",
         "cacheable-lookup": "^7.0.0",
-        "cacheable-request": "^12.0.1",
+        "cacheable-request": "^10.2.14",
         "decompress-response": "^6.0.0",
         "form-data-encoder": "^4.0.2",
         "get-stream": "^8.0.1",
         "http2-wrapper": "^2.2.1",
         "lowercase-keys": "^3.0.0",
         "p-cancelable": "^4.0.1",
-        "responselike": "^3.0.0",
+        "responselike": "^3.0.0"
-        "type-fest": "^4.19.0"
       },
       "engines": {
         "node": ">=20"
@@ -4827,17 +4795,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/got/node_modules/type-fest": {
-      "version": "4.20.0",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.20.0.tgz",
-      "integrity": "sha512-MBh+PHUHHisjXf4tlx0CFWoMdjx8zCMLJHOjnV1prABYZFHqtFOyauCIK2/7w4oIfwkF8iNhLtnJEfVY2vn3iw==",
-      "engines": {
-        "node": ">=16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/graceful-fs": {
       "version": "4.2.11",
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
@@ -6484,9 +6441,9 @@
       }
     },
     "node_modules/normalize-url": {
-      "version": "8.0.1",
+      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.0.0.tgz",
-      "integrity": "sha512-IO9QvjUMWxPQQhs60oOu10CRkWCiZzSUkzbXGGV9pviYl1fXYcvkzQ5jV9z8Y6un8ARoVRl4EtC6v6jNqbaJ/w==",
+      "integrity": "sha512-uVFpKhj5MheNBJRTiMZ9pE/7hD1QTeEvugSJW/OmLzAp78PB5O6adfMNTvmfKhXBkvCzC+rqifWcVYpGFwTjnw==",
       "engines": {
         "node": ">=14.16"
       },
@@ -7902,9 +7859,9 @@
       "dev": true
     },
     "node_modules/undici": {
-      "version": "5.28.4",
+      "version": "5.28.3",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.4.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.3.tgz",
-      "integrity": "sha512-72RFADWFqKmUb2hmmvNODKL3p9hcB6Gt2DOQMis1SEBaV6a4MH8soBvzg+95CYhCKPFedut2JY9bMfrDl9D23g==",
+      "integrity": "sha512-3ItfzbrhDlINjaP0duwnNsKpDQk3acHI3gVJ1z4fmwMK31k5G9OVIAMLSIaP6w4FaGkaAkN6zaQO9LUvZ1t7VA==",
       "dependencies": {
         "@fastify/busboy": "^2.0.0"
       },
@@ -8209,9 +8166,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "3.23.8",
+      "version": "3.22.4",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.23.8.tgz",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.22.4.tgz",
-      "integrity": "sha512-XBx9AXhXktjUqnepgTiE5flcKIYWi/rme0Eaj+5Y0lftuGBq+jyRu/md4WnuxqgP1ubdpNCsYEYPxrzVHD8d6g==",
+      "integrity": "sha512-iC+8Io04lddc+mVqQ9AZ7OQ2MrUKGN+oIQyq1vemgt46jwCwLfhq7/pwnBnNXXXZb8VTVLKwp9EDkx+ryxIWmg==",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "4.3.4",
+  "version": "4.3.3",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",
@@ -31,14 +31,14 @@
     "@octokit/request-error": "^5.0.1",
     "@onebeyond/spdx-license-satisfies": "^1.0.1",
     "ansi-styles": "^6.2.1",
-    "got": "^14.4.1",
+    "got": "^14.2.0",
     "jest": "^29.7.0",
     "octokit": "^3.1.2",
     "spdx-expression-parse": "^3.0.1",
     "spdx-satisfies": "^5.0.1",
     "ts-jest": "^29.1.2",
     "yaml": "^2.3.4",
-    "zod": "^3.23.8"
+    "zod": "^3.22.3"
   },
   "devDependencies": {
     "@types/jest": "^29.5.12",

src/git-refs.ts

@@ -11,8 +11,7 @@ export function getRefs(
   // The base/head ref from the config take priority, if provided.
   if (
     context.eventName === 'pull_request' ||
-    context.eventName === 'pull_request_target' ||
+    context.eventName === 'pull_request_target'
-    context.eventName === 'merge_group'
   ) {
     const pull_request = PullRequestSchema.parse(context.payload.pull_request)
     base_ref = base_ref || pull_request.base.sha
@@ -23,19 +22,19 @@ export function getRefs(
     throw new Error(
       'Both a base ref and head ref must be provided, either via the `base_ref`/`head_ref` ' +
         'config options, `base-ref`/`head-ref` workflow action options, or by running a ' +
-        '`pull_request`/`pull_request_target`/`merge_group` workflow.'
+        '`pull_request`/`pull_request_target` workflow.'
     )
   } else if (!base_ref) {
     throw new Error(
       'A base ref must be provided, either via the `base_ref` config option, ' +
         '`base-ref` workflow action option, or by running a ' +
-        '`pull_request`/`pull_request_target`/`merge_group` workflow.'
+        '`pull_request`/`pull_request_target` workflow.'
     )
   } else if (!head_ref) {
     throw new Error(
       'A head ref must be provided, either via the `head_ref` config option, ' +
         '`head-ref` workflow action option, or by running a ' +
-        'or by running a `pull_request`/`pull_request_target`/`merge_group` workflow.'
+        'or by running a `pull_request`/`pull_request_target` workflow.'
     )
   }
 

src/main.ts

@@ -125,9 +125,7 @@ async function run(): Promise<void> {
       config.deny_groups
     )
 
-    // generate informational scorecard entries for all added changes in the PR
+    const scorecard = await getScorecardLevels(filteredChanges)
-    const scorecardChanges = getScorecardChanges(changes)
-    const scorecard = await getScorecardLevels(scorecardChanges)
 
     const minSummary = summary.addSummaryToSummary(
       vulnerableChanges,
@@ -371,7 +369,7 @@ function printScannedDependencies(changes: Changes): void {
 }
 
 function printDeniedDependencies(
-  changes: Changes,
+  changes: Change[],
   config: ConfigurationOptions
 ): void {
   core.group('Denied', async () => {
@@ -386,17 +384,6 @@ function printDeniedDependencies(
   })
 }
 
-function getScorecardChanges(changes: Changes): Changes {
-  const out: Changes = []
-  for (const change of changes) {
-    if (change.change_type === 'added') {
-      out.push(change)
-    }
-  }
-
-  return out
-}
-
 async function createScorecardWarnings(
   scorecards: Scorecard,
   config: ConfigurationOptions

types/spdx-license-satisfies.d.ts

@@ -13,4 +13,6 @@ declare module '@onebeyond/spdx-license-satisfies' {
     candidateExpr: string,
     licenses: string[]
   ): boolean
+
+  export function isValid(candidateExpr: string): boolean
 }