bumping version

Merge pull request #722 from actions/remove-warn-default
Revert default values in action.yml to fix external configs
2024-03-26 08:04:16 +01:00 · 2024-03-26 07:55:00 +01:00 · 2024-03-25 06:27:19 +01:00 · 2024-03-25 01:27:32 +00:00 · 2024-03-24 14:59:17 +01:00 · 2024-03-24 14:56:57 +01:00
6 changed files with 62 additions and 26 deletions
@@ -22,6 +22,19 @@ const npmChange: Change = {
  ]
 }

+const actionsChange: Change = {
+  manifest: 'workflow.yml',
+  change_type: 'added',
+  ecosystem: 'actions',
+  name: 'actions/checkout/',
+  version: 'v3',
+  package_url: 'pkg:githubactions/actions@v3',
+  license: 'MIT',
+  source_repository_url: 'null',
+  scope: 'runtime',
+  vulnerabilities: []
+}
+
 test('Get scorecard from API', async () => {
  const changes: Changes = [npmChange]
  const scorecard = await getScorecardLevels(changes)
@@ -38,3 +51,11 @@ test('Get project URL from deps.dev API', async () => {
  )
  expect(result).not.toBeNull()
 })
+
+test('Handles Actions special case', async () => {
+  const changes: Changes = [actionsChange]
+  const result = await getScorecardLevels(changes)
+  expect(result).not.toBeNull()
+  expect(result.dependencies).toHaveLength(1)
+  expect(result.dependencies[0].scorecard?.score).toBeGreaterThan(0)
+})
@@ -1043,8 +1043,15 @@ function getScorecardLevels(changes) {
            if (repositoryUrl === null || repositoryUrl === void 0 ? void 0 : repositoryUrl.startsWith('https://')) {
                repositoryUrl = repositoryUrl.replace('https://', '');
            }
+            // Handle the special case for GitHub Actions, where the repository URL is null
+            if (ecosystem === 'actions') {
+                // The package name for GitHub Actions in the API is in the format `owner/repo/`, so we can use that to get the repository URL
+                // If the package name has more than 2 slashes, it's referencing a sub-action, and we need to strip the last part out
+                const parts = packageName.split('/');
+                repositoryUrl = `github.com/${parts[0]}/${parts[1]}`; // e.g. github.com/actions/checkout
+            }
            // If GitHub API doesn't have the repository URL, query deps.dev for it.
-            if (repositoryUrl) {
+            if (!repositoryUrl) {
                // Call the deps.dev API to get the repository URL from there
                repositoryUrl = yield getProjectUrl(ecosystem, packageName, version);
            }
@@ -1069,7 +1076,7 @@ function getScorecardLevels(changes) {
 exports.getScorecardLevels = getScorecardLevels;
 function getScorecard(repositoryUrl) {
    return __awaiter(this, void 0, void 0, function* () {
-        const apiRoot = 'https://api.securityscorecards.dev/';
+        const apiRoot = 'https://api.securityscorecards.dev';
        let scorecardResponse = {};
        const url = `${apiRoot}/projects/${repositoryUrl}`;
        const response = yield fetch(url);
@@ -1,12 +1,12 @@
 {
  "name": "dependency-review-action",
-  "version": "4.2.3",
+  "version": "4.2.5",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "dependency-review-action",
-      "version": "4.2.3",
+      "version": "4.2.5",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^1.10.1",
@@ -33,7 +33,7 @@
        "@typescript-eslint/parser": "^6.21.0",
        "@vercel/ncc": "^0.38.0",
        "esbuild-register": "^3.5.0",
-        "eslint": "^8.56.0",
+        "eslint": "^8.57.0",
        "eslint-plugin-github": "^4.10.1",
        "eslint-plugin-jest": "^27.9.0",
        "eslint-plugin-prettier": "^5.1.3",
@@ -1096,9 +1096,9 @@
      }
    },
    "node_modules/@eslint/js": {
-      "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.56.0.tgz",
-      "integrity": "sha512-gMsVel9D7f2HLkBma9VbtzZRehRogVRfbr++f06nL2vnCGCNlzOD+/MUov/F4p8myyAHspEhVobgjpX64q5m6A==",
+      "version": "8.57.0",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.57.0.tgz",
+      "integrity": "sha512-Ys+3g2TaW7gADOJzPt83SJtCDhMjndcDMFVQ/Tj9iA1BfJzFKD9mAUXT3OenpuPHbI6P/myECxRJrofUsDx/5g==",
      "dev": true,
      "engines": {
        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
@@ -1119,13 +1119,13 @@
      "dev": true
    },
    "node_modules/@humanwhocodes/config-array": {
-      "version": "0.11.13",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.13.tgz",
-      "integrity": "sha512-JSBDMiDKSzQVngfRjOdFXgFfklaXI4K9nLF49Auh21lmBWRLIK3+xTErTWD4KU54pb6coM6ESE7Awz/FNU3zgQ==",
+      "version": "0.11.14",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.14.tgz",
+      "integrity": "sha512-3T8LkOmg45BV5FICb15QQMsyUSWrQ8AygVfC7ZG32zOalnqrilm018ZVCw0eapXux8FtA33q8PSRSstjee3jSg==",
      "dev": true,
      "dependencies": {
-        "@humanwhocodes/object-schema": "^2.0.1",
-        "debug": "^4.1.1",
+        "@humanwhocodes/object-schema": "^2.0.2",
+        "debug": "^4.3.1",
        "minimatch": "^3.0.5"
      },
      "engines": {
@@ -1146,9 +1146,9 @@
      }
    },
    "node_modules/@humanwhocodes/object-schema": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.1.tgz",
-      "integrity": "sha512-dvuCeX5fC9dXgJn9t+X5atfmgQAzUOWqS1254Gh0m6i8wKd10ebXkfNKiRK+1GWi/yTvvLDHpoxLr0xxxeslWw==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.2.tgz",
+      "integrity": "sha512-6EwiSjwWYP7pTckG6I5eyFANjPhmPjUX9JRLUSfNPC7FX7zK9gyZAfUEaECL6ALTpGX5AjnBq3C9XmVWPitNpw==",
      "dev": true
    },
    "node_modules/@istanbuljs/load-nyc-config": {
@@ -3542,16 +3542,16 @@
      }
    },
    "node_modules/eslint": {
-      "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.56.0.tgz",
-      "integrity": "sha512-Go19xM6T9puCOWntie1/P997aXxFsOi37JIHRWI514Hc6ZnaHGKY9xFhrU65RT6CcBEzZoGG1e6Nq+DT04ZtZQ==",
+      "version": "8.57.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.57.0.tgz",
+      "integrity": "sha512-dZ6+mexnaTIbSBZWgou51U6OmzIhYM2VcNdtiTtI7qPNZm35Akpr0f6vtw3w1Kmn5PYo+tZVfh13WrhpS6oLqQ==",
      "dev": true,
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.2.0",
        "@eslint-community/regexpp": "^4.6.1",
        "@eslint/eslintrc": "^2.1.4",
-        "@eslint/js": "8.56.0",
-        "@humanwhocodes/config-array": "^0.11.13",
+        "@eslint/js": "8.57.0",
+        "@humanwhocodes/config-array": "^0.11.14",
        "@humanwhocodes/module-importer": "^1.0.1",
        "@nodelib/fs.walk": "^1.2.8",
        "@ungap/structured-clone": "^1.2.0",
@@ -1,6 +1,6 @@
 {
  "name": "dependency-review-action",
-  "version": "4.2.3",
+  "version": "4.2.5",
  "private": true,
  "description": "A GitHub Action for Dependency Review",
  "main": "lib/main.js",
@@ -49,7 +49,7 @@
    "@typescript-eslint/parser": "^6.21.0",
    "@vercel/ncc": "^0.38.0",
    "esbuild-register": "^3.5.0",
-    "eslint": "^8.56.0",
+    "eslint": "^8.57.0",
    "eslint-plugin-github": "^4.10.1",
    "eslint-plugin-jest": "^27.9.0",
    "eslint-plugin-prettier": "^5.1.3",
@@ -17,8 +17,16 @@ export async function getScorecardLevels(
      repositoryUrl = repositoryUrl.replace('https://', '')
    }

+    // Handle the special case for GitHub Actions, where the repository URL is null
+    if (ecosystem === 'actions') {
+      // The package name for GitHub Actions in the API is in the format `owner/repo/`, so we can use that to get the repository URL
+      // If the package name has more than 2 slashes, it's referencing a sub-action, and we need to strip the last part out
+      const parts = packageName.split('/')
+      repositoryUrl = `github.com/${parts[0]}/${parts[1]}` // e.g. github.com/actions/checkout
+    }
+
    // If GitHub API doesn't have the repository URL, query deps.dev for it.
-    if (repositoryUrl) {
+    if (!repositoryUrl) {
      // Call the deps.dev API to get the repository URL from there
      repositoryUrl = await getProjectUrl(ecosystem, packageName, version)
    }
@@ -41,7 +49,7 @@ export async function getScorecardLevels(
 }

 async function getScorecard(repositoryUrl: string): Promise<ScorecardApi> {
-  const apiRoot = 'https://api.securityscorecards.dev/'
+  const apiRoot = 'https://api.securityscorecards.dev'
  let scorecardResponse: ScorecardApi = {} as ScorecardApi

  const url = `${apiRoot}/projects/${repositoryUrl}`
Author	SHA1	Message	Date
Federico Builes	5bbc3ba658	bumping version	2024-03-26 08:04:16 +01:00
Federico Builes	c59184aa7f	Merge pull request #722 from actions/remove-warn-default Revert default values in action.yml to fix external configs	2024-03-26 07:55:00 +01:00
Federico Builes	54c06574f4	Merge pull request #728 from actions/dependabot/npm_and_yarn/eslint-8.57.0 Bump eslint from 8.56.0 to 8.57.0	2024-03-25 06:27:19 +01:00
dependabot[bot]	21941b530b	Bump eslint from 8.56.0 to 8.57.0 Bumps [eslint](https://github.com/eslint/eslint) from 8.56.0 to 8.57.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.56.0...v8.57.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2024-03-25 01:27:32 +00:00
Federico Builes	733dd5d4a5	bumping to 4.2.4	2024-03-24 14:59:17 +01:00
Federico Builes	9093495859	Merge pull request #725 from actions/issue-718 Bug fixes to #718	2024-03-24 14:56:57 +01:00
Justin Hutchings	35b83b4207	Fix prettier issues	2024-03-22 21:59:08 +00:00
Justin Hutchings	e057056594	Add packaged code update	2024-03-22 21:31:00 +00:00
Justin Hutchings	d684d038b2	Add trailing slash to tests	2024-03-22 21:21:52 +00:00
Justin Hutchings	2b0aaf1638	Fix extra slash issue	2024-03-22 21:20:15 +00:00
Justin Hutchings	d9209374af	Fix repositoryUrl issues around GitHub Actions	2024-03-22 21:00:38 +00:00