Merge pull request #81 from actions/elireisman/fix-default-case

Fix default-case in error handling

.github/workflows/check-dist.yml

@@ -46,7 +46,7 @@ jobs:
         id: diff
 
       # If index.js was different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         if: ${{ failure() && steps.diff.conclusion == 'failure' }}
         with:
           name: dist

CONTRIBUTING.md

@@ -40,7 +40,11 @@ npm run test
 ## Local Development
 
 We have a script to scan a given PR for vulnerabilities, this will
-help you test your local changes. Make sure to [grab a Personal Access Token (PAT)](https://github.com/settings/tokens) before proceeding!
+help you test your local changes. Make sure to [grab a Personal Access Token (PAT)](https://github.com/settings/tokens) before proceeding (you'll need `repo` permissions for private repos):
+
+<img width="480" alt="Screenshot 2022-05-12 at 10 22 21" src="https://user-images.githubusercontent.com/2161/168026161-16788a0a-b6c8-428e-bb6a-83ea2a403070.png">
+
+The syntax of the script is:
 
 ```sh
 $ GITHUB_TOKEN=<token> ./scripts/scan_pr <pr_url>

README.md

@@ -1,8 +1,8 @@
 # dependency-review-action
 
-This Action scans your pull requests for vulnerabilities introduced
-when adding or updating your project's dependencies. A check in your 
-Pull Requests will let notify you of the results.
+This action scans your pull requests for dependency changes and will raise an error if any new dependencies have existing vulnerabilities. The action is supported by an [API endpoint](https://docs.github.com/en/rest/reference/dependency-graph#dependency-review) that diffs the dependencies between any two revisions.
+
+The action is available for all public repositories, as well as private repositories that have Github Advanced Security licensed. 
 
 <img width="854" alt="Screen Shot 2022-03-31 at 1 10 51 PM" src="https://user-images.githubusercontent.com/2161/161042286-b22d7dd3-13cb-458d-8744-ce70ed9bf562.png">
 
@@ -28,6 +28,8 @@ jobs:
         uses: actions/dependency-review-action@v1
 ```
 
+Please keep in mind that you need a GitHub Advanced Security license if you're running this Action on private repos.
+
 ## Getting help
 
 If you have bug reports, questions or suggestions please [create a new

action.yml

@@ -1,5 +1,5 @@
 name: 'Dependency Review'
-description: 'GitHub Action for Dependency Review'
+description: 'Prevent the introduction of dependencies with known vulnerabilities'
 author: 'GitHub'
 inputs:
   repo-token:

package.json

@@ -25,29 +25,29 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/core": "^1.6.0",
-    "@actions/github": "^5.0.0",
+    "@actions/core": "^1.8.2",
+    "@actions/github": "^5.0.3",
     "@octokit/plugin-retry": "^3.0.9",
     "@octokit/request-error": "^2.1.0",
     "ansi-styles": "^6.1.0",
-    "got": "^12.0.1",
-    "nodemon": "^2.0.15",
-    "zod": "^3.13.4"
+    "got": "^12.0.4",
+    "nodemon": "^2.0.16",
+    "zod": "^3.17.2"
   },
   "devDependencies": {
-    "@types/node": "^17.0.23",
-    "@typescript-eslint/eslint-plugin": "^5.14.0",
-    "@typescript-eslint/parser": "^5.14.0",
-    "@vercel/ncc": "^0.33.3",
+    "@types/node": "^17.0.35",
+    "@typescript-eslint/eslint-plugin": "^5.25.0",
+    "@typescript-eslint/parser": "^5.26.0",
+    "@vercel/ncc": "^0.33.4",
     "esbuild-register": "^3.3.2",
-    "eslint": "^8.12.0",
+    "eslint": "^8.16.0",
     "eslint-plugin-github": "^4.3.6",
-    "eslint-plugin-jest": "^26.1.1",
+    "eslint-plugin-jest": "^26.2.2",
     "jest": "^27.5.1",
     "js-yaml": "^4.1.0",
-    "nodemon": "^2.0.15",
-    "prettier": "2.6.1",
-    "ts-jest": "^27.1.3",
-    "typescript": "^4.6.3"
+    "nodemon": "^2.0.16",
+    "prettier": "2.6.2",
+    "ts-jest": "^27.1.4",
+    "typescript": "^4.6.4"
   }
 }

src/main.ts

@@ -53,11 +53,19 @@ async function run(): Promise<void> {
     }
   } catch (error) {
     if (error instanceof RequestError && error.status === 404) {
+      core.setFailed(
+        `Dependency review could not obtain dependency data for the specified owner, repository, or revision range.`
+      )
+    } else if (error instanceof RequestError && error.status === 403) {
       core.setFailed(
         `Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled, see https://github.com/${github.context.repo.owner}/${github.context.repo.repo}/settings/security_analysis`
       )
-    } else if (error instanceof Error) {
-      core.setFailed(error.message)
+    } else {
+      if (error instanceof Error) {
+        core.setFailed(error.message)
+      } else {
+        core.setFailed('Unexpected fatal error')
+      }
     }
   }
 }