Update external-repo-token requirements

README.md

@@ -115,7 +115,7 @@ You can use an external configuration file to specify the settings for this acti
 | Option                | Usage                                                                                                                                                                                    | Possible values                                                                                                                |
 |-----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
 | `config-file`         | A path to a file in the current repository or an external repository. Use this syntax for external files: `OWNER/REPOSITORY/FILENAME@BRANCH`                                             | **Local file**: `./.github/dependency-review-config.yml` <br> **External repo**: `github/octorepo/dependency-review-config.yml@main` |
-| `external-repo-token` | Specifies a token for fetching the configuration file if the file resides in a private external repository. Create a token in [developer settings](https://github.com/settings/tokens). | Any token with `read` permissions to the repository hosting the config file.                                                   |
+| `external-repo-token` | Specifies a token for fetching the configuration file. It is required if the file resides in a private external repository and for all GitHub Enterprise Server repositories. Create a token in [developer settings](https://github.com/settings/tokens). | Any token with `read` permissions to the repository hosting the config file.                                                   |
 
 #### Example
 

dist/index.js

@@ -802,6 +802,11 @@ function isSPDXValid(license) {
     }
 }
 exports.isSPDXValid = isSPDXValid;
+function isEnterprise() {
+    var _a;
+    const serverUrl = new URL((_a = process.env['GITHUB_SERVER_URL']) !== null && _a !== void 0 ? _a : 'https://github.com');
+    return serverUrl.hostname.toLowerCase() !== 'github.com';
+}
 function octokitClient(token = 'repo-token', required = true) {
     const opts = {};
     // auth is only added if token is present. For remote config files in public
@@ -810,6 +815,11 @@ function octokitClient(token = 'repo-token', required = true) {
     if (auth !== undefined) {
         opts['auth'] = auth;
     }
+    //baseUrl is required for GitHub Enterprise Server
+    //https://github.com/octokit/octokit.js/blob/9c8fa89d5b0bc4ddbd6dec638db00a2f6c94c298/README.md?plain=1#L196
+    if (isEnterprise()) {
+        opts['baseUrl'] = new URL('api/v3', process.env['GITHUB_SERVER_URL']);
+    }
     return new octokit_1.Octokit(opts);
 }
 exports.octokitClient = octokitClient;
@@ -27830,6 +27840,11 @@ function isSPDXValid(license) {
     }
 }
 exports.isSPDXValid = isSPDXValid;
+function isEnterprise() {
+    var _a;
+    const serverUrl = new URL((_a = process.env['GITHUB_SERVER_URL']) !== null && _a !== void 0 ? _a : 'https://github.com');
+    return serverUrl.hostname.toLowerCase() !== 'github.com';
+}
 function octokitClient(token = 'repo-token', required = true) {
     const opts = {};
     // auth is only added if token is present. For remote config files in public
@@ -27838,6 +27853,11 @@ function octokitClient(token = 'repo-token', required = true) {
     if (auth !== undefined) {
         opts['auth'] = auth;
     }
+    //baseUrl is required for GitHub Enterprise Server
+    //https://github.com/octokit/octokit.js/blob/9c8fa89d5b0bc4ddbd6dec638db00a2f6c94c298/README.md?plain=1#L196
+    if (isEnterprise()) {
+        opts['baseUrl'] = new URL('api/v3', process.env['GITHUB_SERVER_URL']);
+    }
     return new octokit_1.Octokit(opts);
 }
 exports.octokitClient = octokitClient;

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "dependency-review-action",
-  "version": "2.5.1",
+  "version": "3.0.0",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "dependency-review-action",
-      "version": "2.5.1",
+      "version": "3.0.0",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "2.5.1",
+  "version": "3.0.0",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",

src/utils.ts

@@ -41,6 +41,13 @@ export function isSPDXValid(license: string): boolean {
   }
 }
 
+function isEnterprise(): boolean {
+  const serverUrl = new URL(
+    process.env['GITHUB_SERVER_URL'] ?? 'https://github.com'
+  )
+  return serverUrl.hostname.toLowerCase() !== 'github.com'
+}
+
 export function octokitClient(token = 'repo-token', required = true): Octokit {
   const opts: Record<string, unknown> = {}
 
@@ -51,5 +58,11 @@ export function octokitClient(token = 'repo-token', required = true): Octokit {
     opts['auth'] = auth
   }
 
+  //baseUrl is required for GitHub Enterprise Server
+  //https://github.com/octokit/octokit.js/blob/9c8fa89d5b0bc4ddbd6dec638db00a2f6c94c298/README.md?plain=1#L196
+  if (isEnterprise()) {
+    opts['baseUrl'] = new URL('api/v3', process.env['GITHUB_SERVER_URL'])
+  }
+
   return new Octokit(opts)
 }