Merge branch 'main' into add-summary

# Conflicts:
#	README.md
#	dist/index.js
#	dist/index.js.map
#	src/main.ts

CONTRIBUTING.md

@@ -75,7 +75,6 @@ Here are a few things you can do that will increase the likelihood of your pull
 
 ## Cutting a new release
 
-1. Update the version number in [package.json](https://github.com/actions/dependency-review-action/blob/main/package.json).
 1. Go to [Draft a new
 release](https://github.com/actions/dependency-review-action/releases/new)
 in the Releases page.

README.md

@@ -38,7 +38,7 @@ jobs:
 
 ### GitHub Enterprise Server
 
-This action is available in Enterprise Server starting with version 3.6. Make sure
+This action is available in GHES starting with version 3.6. Make sure
 [GitHub Advanced
 Security](https://docs.github.com/en/enterprise-server@3.6/admin/code-security/managing-github-advanced-security-for-your-enterprise/enabling-github-advanced-security-for-your-enterprise)
 and [GitHub
@@ -50,6 +50,7 @@ with the label of any of your runners (the default label
 is `self-hosted`):
 
 ```yaml
+
 # ...
 
 jobs:
@@ -85,14 +86,11 @@ jobs:
           # Possible values: "critical", "high", "moderate", "low"
           # fail-on-severity: critical
           #
-          # Possible values in comma separated list: "unknown", "runtime", or "development"
-          # fail-on-scopes: runtime, development
-          #
           # Possible values: Any available git ref
           # base-ref: ${{ github.event.pull_request.base.ref }}
           # head-ref: ${{ github.event.pull_request.head.ref }}
           #
-          # You can only include one of these two options: `allow-licenses` and `deny-licenses`. These options are not supported on Enterprise Server.
+          # You can only include one of these two options: `allow-licenses` and `deny-licenses`. These options are not supported on GHES. 
           #
           # Possible values: Any `spdx_id` value(s) from https://docs.github.com/en/rest/licenses
           # allow-licenses: GPL-3.0, BSD-3-Clause, MIT
@@ -122,23 +120,12 @@ This example will only fail on pull requests with `critical` and `high` vulnerab
     fail-on-severity: high
 ```
 
-### Dependency Scoping
-
-By default the action will only fail on `runtime` dependencies that have vulnerabilities or unacceptable licenses, ignoring `development` dependencies. You can override this behavior with the `fail-on-scopes` option, which will allow you to list the specific dependency scopes you care about. The possible values are: `unknown`, `runtime`, and `development`. Note: Filtering by scope will not be supported on Enterprise Server just yet, as the REST API's introduction of `scope` will be released in an upcoming Enterprise Server version. We will treat all dependencies on Enterprise Server as having a `runtime` scope and thus will not be filtered away.
-
-```yaml
-- name: Dependency Review
-  uses: actions/dependency-review-action@v2
-  with:
-    fail-on-scopes: runtime, development
-```
-
 ### Licenses
 
 You can set the action to fail on pull requests based on the licenses of the dependencies
 they introduce. With `allow-licenses` you can define the list of licenses
 your repository will accept. Alternatively, you can use `deny-licenses` to only
-forbid a subset of licenses. These options are not supported on Enterprise Server.
+forbid a subset of licenses. These options are not supported on GHES.
 
 You can use the [Licenses
 API](https://docs.github.com/en/rest/licenses) to see the full list of
@@ -163,7 +150,6 @@ to filter. A couple of examples:
 
 **Important**
 
-- Checking for licenses is not supported on Enterprise Server.
 - The action will only accept one of the two parameters; an error will
   be raised if you provide both.
 - By default both parameters are empty (no license checking is

__tests__/config.test.ts

@@ -13,7 +13,6 @@ function setInput(input: string, value: string) {
 function clearInputs() {
   const allowedOptions = [
     'FAIL-ON-SEVERITY',
-    'FAIL-ON-SCOPES',
     'ALLOW-LICENSES',
     'DENY-LICENSES',
     'BASE-REF',
@@ -83,22 +82,3 @@ test('it raises an error when no refs are provided and the event is not a pull r
     })
   ).toThrow()
 })
-
-test('it defaults to runtime scope', async () => {
-  const options = readConfig()
-  expect(options.fail_on_scopes).toEqual(['runtime'])
-})
-test('it parses custom scopes preference', async () => {
-  setInput('fail-on-scopes', 'runtime, development')
-  let options = readConfig()
-  expect(options.fail_on_scopes).toEqual(['runtime', 'development'])
-
-  clearInputs()
-  setInput('fail-on-scopes', 'development')
-  options = readConfig()
-  expect(options.fail_on_scopes).toEqual(['development'])
-})
-test('it raises an error when given invalid scope', async () => {
-  setInput('fail-on-scopes', 'runtime, zombies')
-  expect(() => readConfig()).toThrow()
-})

__tests__/filter.test.ts

@@ -1,6 +1,6 @@
 import {expect, test} from '@jest/globals'
 import {Change, Changes} from '../src/schemas'
-import {filterChangesBySeverity, filterChangesByScopes} from '../src/filter'
+import {filterChangesBySeverity} from '../src/filter'
 
 let npmChange: Change = {
   manifest: 'package.json',
@@ -11,7 +11,6 @@ let npmChange: Change = {
   package_url: 'pkg:npm/reeuhq@1.0.2',
   license: 'MIT',
   source_repository_url: 'github.com/some-repo',
-  scope: 'runtime',
   vulnerabilities: [
     {
       severity: 'critical',
@@ -31,7 +30,6 @@ let rubyChange: Change = {
   package_url: 'pkg:gem/actionsomething@3.2.0',
   license: 'BSD',
   source_repository_url: 'github.com/some-repo',
-  scope: 'development',
   vulnerabilities: [
     {
       severity: 'moderate',
@@ -59,16 +57,3 @@ test('it properly filters changes by severity', async () => {
   result = filterChangesBySeverity('critical', changes)
   expect(changes).toEqual([npmChange, rubyChange])
 })
-
-test('it properly filters changes by scope', async () => {
-  const changes = [npmChange, rubyChange]
-
-  let result = filterChangesByScopes(['runtime'], changes)
-  expect(result).toEqual([npmChange])
-
-  result = filterChangesByScopes(['development'], changes)
-  expect(result).toEqual([rubyChange])
-
-  result = filterChangesByScopes(['runtime', 'development'], changes)
-  expect(result).toEqual([npmChange, rubyChange])
-})

__tests__/licenses.test.ts

@@ -11,7 +11,6 @@ let npmChange: Change = {
   package_url: 'pkg:npm/reeuhq@1.0.2',
   license: 'MIT',
   source_repository_url: 'github.com/some-repo',
-  scope: 'runtime',
   vulnerabilities: [
     {
       severity: 'critical',
@@ -31,7 +30,6 @@ let rubyChange: Change = {
   package_url: 'pkg:gem/actionsomething@3.2.0',
   license: 'BSD',
   source_repository_url: 'github.com/some-repo',
-  scope: 'runtime',
   vulnerabilities: [
     {
       severity: 'moderate',

action.yml

@@ -10,10 +10,6 @@ inputs:
     description: Don't block PRs below this severity. Possible values are `low`, `moderate`, `high`, `critical`.
     required: false
     default: 'low'
-  fail-on-scopes:
-    description: Dependency scopes to block PRs on. Comma-separated list. Possible values are 'unknown', 'runtime', and 'development' (e.g. "runtime, development")
-    required: false
-    default: 'runtime'
   base-ref:
     description: The base git ref to be used for this check. Has a default value when the workflow event is `pull_request` or `pull_request_target`. Must be provided otherwise.
     required: false

dist/index.js

@@ -220,12 +220,10 @@ function run() {
                 allow: config.allow_licenses,
                 deny: config.deny_licenses
             };
-            const scopes = config.fail_on_scopes;
-            const scopedChanges = (0, filter_1.filterChangesByScopes)(scopes, changes);
-            const addedChanges = (0, filter_1.filterChangesBySeverity)(minSeverity, scopedChanges).filter(change => change.change_type === 'added' &&
+            const addedChanges = (0, filter_1.filterChangesBySeverity)(minSeverity, changes).filter(change => change.change_type === 'added' &&
                 change.vulnerabilities !== undefined &&
                 change.vulnerabilities.length > 0);
-            const [licenseErrors, unknownLicenses] = (0, licenses_1.getDeniedLicenseChanges)(scopedChanges, licenses);
+            const [licenseErrors, unknownLicenses] = (0, licenses_1.getDeniedLicenseChanges)(changes, licenses);
             summary.addSummaryToSummary(addedChanges, licenseErrors, unknownLicenses);
             if (addedChanges.length > 0) {
                 for (const change of addedChanges) {
@@ -335,10 +333,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SCOPES = exports.SEVERITIES = void 0;
+exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SEVERITIES = void 0;
 const z = __importStar(__nccwpck_require__(3301));
 exports.SEVERITIES = ['critical', 'high', 'moderate', 'low'];
-exports.SCOPES = ['unknown', 'runtime', 'development'];
 exports.ChangeSchema = z.object({
     change_type: z.enum(['added', 'removed']),
     manifest: z.string(),
@@ -348,10 +345,9 @@ exports.ChangeSchema = z.object({
     package_url: z.string(),
     license: z.string().nullable(),
     source_repository_url: z.string().nullable(),
-    scope: z.enum(exports.SCOPES).optional(),
     vulnerabilities: z
         .array(z.object({
-        severity: z.enum(exports.SEVERITIES),
+        severity: z.enum(['critical', 'high', 'moderate', 'low']),
         advisory_ghsa_id: z.string(),
         advisory_summary: z.string(),
         advisory_url: z.string()
@@ -367,7 +363,6 @@ exports.PullRequestSchema = z.object({
 exports.ConfigurationOptionsSchema = z
     .object({
     fail_on_severity: z.enum(exports.SEVERITIES).default('low'),
-    fail_on_scopes: z.array(z.enum(exports.SCOPES)).default(['runtime']),
     allow_licenses: z.array(z.string()).default([]),
     deny_licenses: z.array(z.string()).default([]),
     base_ref: z.string(),
@@ -11648,7 +11643,8 @@ function wrappy (fn, cb) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.ZodError = exports.quotelessJson = exports.ZodIssueCode = void 0;
+exports.getErrorMap = exports.setErrorMap = exports.defaultErrorMap = exports.ZodError = exports.quotelessJson = exports.ZodIssueCode = void 0;
+const parseUtil_1 = __nccwpck_require__(888);
 const util_1 = __nccwpck_require__(3985);
 exports.ZodIssueCode = util_1.util.arrayToEnum([
     "invalid_type",
@@ -11749,7 +11745,7 @@ class ZodError extends Error {
         return this.message;
     }
     get message() {
-        return JSON.stringify(this.issues, util_1.util.jsonStringifyReplacer, 2);
+        return JSON.stringify(this.issues, parseUtil_1.jsonStringifyReplacer, 2);
     }
     get isEmpty() {
         return this.issues.length === 0;
@@ -11777,23 +11773,101 @@ ZodError.create = (issues) => {
     const error = new ZodError(issues);
     return error;
 };
-
-
-/***/ }),
-
-/***/ 9566:
-/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
-
-"use strict";
-
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+const defaultErrorMap = (issue, _ctx) => {
+    let message;
+    switch (issue.code) {
+        case exports.ZodIssueCode.invalid_type:
+            if (issue.received === util_1.ZodParsedType.undefined) {
+                message = "Required";
+            }
+            else {
+                message = `Expected ${issue.expected}, received ${issue.received}`;
+            }
+            break;
+        case exports.ZodIssueCode.invalid_literal:
+            message = `Invalid literal value, expected ${JSON.stringify(issue.expected, parseUtil_1.jsonStringifyReplacer)}`;
+            break;
+        case exports.ZodIssueCode.unrecognized_keys:
+            message = `Unrecognized key(s) in object: ${util_1.util.joinValues(issue.keys, ", ")}`;
+            break;
+        case exports.ZodIssueCode.invalid_union:
+            message = `Invalid input`;
+            break;
+        case exports.ZodIssueCode.invalid_union_discriminator:
+            message = `Invalid discriminator value. Expected ${util_1.util.joinValues(issue.options)}`;
+            break;
+        case exports.ZodIssueCode.invalid_enum_value:
+            message = `Invalid enum value. Expected ${util_1.util.joinValues(issue.options)}, received '${issue.received}'`;
+            break;
+        case exports.ZodIssueCode.invalid_arguments:
+            message = `Invalid function arguments`;
+            break;
+        case exports.ZodIssueCode.invalid_return_type:
+            message = `Invalid function return type`;
+            break;
+        case exports.ZodIssueCode.invalid_date:
+            message = `Invalid date`;
+            break;
+        case exports.ZodIssueCode.invalid_string:
+            if (typeof issue.validation === "object") {
+                if ("startsWith" in issue.validation) {
+                    message = `Invalid input: must start with "${issue.validation.startsWith}"`;
+                }
+                else if ("endsWith" in issue.validation) {
+                    message = `Invalid input: must end with "${issue.validation.endsWith}"`;
+                }
+                else {
+                    util_1.util.assertNever(issue.validation);
+                }
+            }
+            else if (issue.validation !== "regex") {
+                message = `Invalid ${issue.validation}`;
+            }
+            else {
+                message = "Invalid";
+            }
+            break;
+        case exports.ZodIssueCode.too_small:
+            if (issue.type === "array")
+                message = `Array must contain ${issue.inclusive ? `at least` : `more than`} ${issue.minimum} element(s)`;
+            else if (issue.type === "string")
+                message = `String must contain ${issue.inclusive ? `at least` : `over`} ${issue.minimum} character(s)`;
+            else if (issue.type === "number")
+                message = `Number must be greater than ${issue.inclusive ? `or equal to ` : ``}${issue.minimum}`;
+            else if (issue.type === "date")
+                message = `Date must be greater than ${issue.inclusive ? `or equal to ` : ``}${new Date(issue.minimum)}`;
+            else
+                message = "Invalid input";
+            break;
+        case exports.ZodIssueCode.too_big:
+            if (issue.type === "array")
+                message = `Array must contain ${issue.inclusive ? `at most` : `less than`} ${issue.maximum} element(s)`;
+            else if (issue.type === "string")
+                message = `String must contain ${issue.inclusive ? `at most` : `under`} ${issue.maximum} character(s)`;
+            else if (issue.type === "number")
+                message = `Number must be less than ${issue.inclusive ? `or equal to ` : ``}${issue.maximum}`;
+            else if (issue.type === "date")
+                message = `Date must be smaller than ${issue.inclusive ? `or equal to ` : ``}${new Date(issue.maximum)}`;
+            else
+                message = "Invalid input";
+            break;
+        case exports.ZodIssueCode.custom:
+            message = `Invalid input`;
+            break;
+        case exports.ZodIssueCode.invalid_intersection_types:
+            message = `Intersection results could not be merged`;
+            break;
+        case exports.ZodIssueCode.not_multiple_of:
+            message = `Number must be a multiple of ${issue.multipleOf}`;
+            break;
+        default:
+            message = _ctx.defaultError;
+            util_1.util.assertNever(issue);
+    }
+    return { message };
 };
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getErrorMap = exports.setErrorMap = exports.defaultErrorMap = void 0;
-const en_1 = __importDefault(__nccwpck_require__(468));
-exports.defaultErrorMap = en_1.default;
-let overrideErrorMap = en_1.default;
+exports.defaultErrorMap = defaultErrorMap;
+let overrideErrorMap = exports.defaultErrorMap;
 function setErrorMap(map) {
     overrideErrorMap = map;
 }
@@ -11823,7 +11897,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ZodParsedType = exports.getParsedType = void 0;
-__exportStar(__nccwpck_require__(9566), exports);
 __exportStar(__nccwpck_require__(888), exports);
 __exportStar(__nccwpck_require__(9449), exports);
 var util_1 = __nccwpck_require__(3985);
@@ -11852,17 +11925,13 @@ var errorUtil;
 /***/ }),
 
 /***/ 888:
-/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.isAsync = exports.isValid = exports.isDirty = exports.isAborted = exports.OK = exports.DIRTY = exports.INVALID = exports.ParseStatus = exports.addIssueToContext = exports.EMPTY_PATH = exports.makeIssue = void 0;
-const errors_1 = __nccwpck_require__(9566);
-const en_1 = __importDefault(__nccwpck_require__(468));
+exports.jsonStringifyReplacer = exports.isAsync = exports.isValid = exports.isDirty = exports.isAborted = exports.OK = exports.DIRTY = exports.INVALID = exports.ParseStatus = exports.addIssueToContext = exports.EMPTY_PATH = exports.makeIssue = void 0;
+const ZodError_1 = __nccwpck_require__(9892);
 const makeIssue = (params) => {
     const { data, path, errorMaps, issueData } = params;
     const fullPath = [...path, ...(issueData.path || [])];
@@ -11894,8 +11963,8 @@ function addIssueToContext(ctx, issueData) {
         errorMaps: [
             ctx.common.contextualErrorMap,
             ctx.schemaErrorMap,
-            errors_1.getErrorMap(),
-            en_1.default,
+            ZodError_1.getErrorMap(),
+            ZodError_1.defaultErrorMap,
         ].filter((x) => !!x),
     });
     ctx.common.issues.push(issue);
@@ -11969,6 +12038,13 @@ const isValid = (x) => x.status === "valid";
 exports.isValid = isValid;
 const isAsync = (x) => typeof Promise !== undefined && x instanceof Promise;
 exports.isAsync = isAsync;
+const jsonStringifyReplacer = (_, value) => {
+    if (typeof value === "bigint") {
+        return value.toString();
+    }
+    return value;
+};
+exports.jsonStringifyReplacer = jsonStringifyReplacer;
 
 
 /***/ }),
@@ -12046,12 +12122,6 @@ var util;
             .join(separator);
     }
     util.joinValues = joinValues;
-    util.jsonStringifyReplacer = (_, value) => {
-        if (typeof value === "bigint") {
-            return value.toString();
-        }
-        return value;
-    };
 })(util = exports.util || (exports.util = {}));
 exports.ZodParsedType = util.arrayToEnum([
     "string",
@@ -12157,112 +12227,6 @@ __exportStar(__nccwpck_require__(9906), exports);
 exports["default"] = mod;
 
 
-/***/ }),
-
-/***/ 468:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-const util_1 = __nccwpck_require__(3985);
-const ZodError_1 = __nccwpck_require__(9892);
-const errorMap = (issue, _ctx) => {
-    let message;
-    switch (issue.code) {
-        case ZodError_1.ZodIssueCode.invalid_type:
-            if (issue.received === util_1.ZodParsedType.undefined) {
-                message = "Required";
-            }
-            else {
-                message = `Expected ${issue.expected}, received ${issue.received}`;
-            }
-            break;
-        case ZodError_1.ZodIssueCode.invalid_literal:
-            message = `Invalid literal value, expected ${JSON.stringify(issue.expected, util_1.util.jsonStringifyReplacer)}`;
-            break;
-        case ZodError_1.ZodIssueCode.unrecognized_keys:
-            message = `Unrecognized key(s) in object: ${util_1.util.joinValues(issue.keys, ", ")}`;
-            break;
-        case ZodError_1.ZodIssueCode.invalid_union:
-            message = `Invalid input`;
-            break;
-        case ZodError_1.ZodIssueCode.invalid_union_discriminator:
-            message = `Invalid discriminator value. Expected ${util_1.util.joinValues(issue.options)}`;
-            break;
-        case ZodError_1.ZodIssueCode.invalid_enum_value:
-            message = `Invalid enum value. Expected ${util_1.util.joinValues(issue.options)}, received '${issue.received}'`;
-            break;
-        case ZodError_1.ZodIssueCode.invalid_arguments:
-            message = `Invalid function arguments`;
-            break;
-        case ZodError_1.ZodIssueCode.invalid_return_type:
-            message = `Invalid function return type`;
-            break;
-        case ZodError_1.ZodIssueCode.invalid_date:
-            message = `Invalid date`;
-            break;
-        case ZodError_1.ZodIssueCode.invalid_string:
-            if (typeof issue.validation === "object") {
-                if ("startsWith" in issue.validation) {
-                    message = `Invalid input: must start with "${issue.validation.startsWith}"`;
-                }
-                else if ("endsWith" in issue.validation) {
-                    message = `Invalid input: must end with "${issue.validation.endsWith}"`;
-                }
-                else {
-                    util_1.util.assertNever(issue.validation);
-                }
-            }
-            else if (issue.validation !== "regex") {
-                message = `Invalid ${issue.validation}`;
-            }
-            else {
-                message = "Invalid";
-            }
-            break;
-        case ZodError_1.ZodIssueCode.too_small:
-            if (issue.type === "array")
-                message = `Array must contain ${issue.inclusive ? `at least` : `more than`} ${issue.minimum} element(s)`;
-            else if (issue.type === "string")
-                message = `String must contain ${issue.inclusive ? `at least` : `over`} ${issue.minimum} character(s)`;
-            else if (issue.type === "number")
-                message = `Number must be greater than ${issue.inclusive ? `or equal to ` : ``}${issue.minimum}`;
-            else if (issue.type === "date")
-                message = `Date must be greater than ${issue.inclusive ? `or equal to ` : ``}${new Date(issue.minimum)}`;
-            else
-                message = "Invalid input";
-            break;
-        case ZodError_1.ZodIssueCode.too_big:
-            if (issue.type === "array")
-                message = `Array must contain ${issue.inclusive ? `at most` : `less than`} ${issue.maximum} element(s)`;
-            else if (issue.type === "string")
-                message = `String must contain ${issue.inclusive ? `at most` : `under`} ${issue.maximum} character(s)`;
-            else if (issue.type === "number")
-                message = `Number must be less than ${issue.inclusive ? `or equal to ` : ``}${issue.maximum}`;
-            else if (issue.type === "date")
-                message = `Date must be smaller than ${issue.inclusive ? `or equal to ` : ``}${new Date(issue.maximum)}`;
-            else
-                message = "Invalid input";
-            break;
-        case ZodError_1.ZodIssueCode.custom:
-            message = `Invalid input`;
-            break;
-        case ZodError_1.ZodIssueCode.invalid_intersection_types:
-            message = `Intersection results could not be merged`;
-            break;
-        case ZodError_1.ZodIssueCode.not_multiple_of:
-            message = `Number must be a multiple of ${issue.multipleOf}`;
-            break;
-        default:
-            message = _ctx.defaultError;
-            util_1.util.assertNever(issue);
-    }
-    return { message };
-};
-exports["default"] = errorMap;
-
-
 /***/ }),
 
 /***/ 9335:
@@ -12272,8 +12236,7 @@ exports["default"] = errorMap;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports["function"] = exports["enum"] = exports.effect = exports.discriminatedUnion = exports.date = exports.boolean = exports.bigint = exports.array = exports.any = exports.ZodFirstPartyTypeKind = exports.late = exports.ZodSchema = exports.Schema = exports.custom = exports.ZodBranded = exports.BRAND = exports.ZodNaN = exports.ZodDefault = exports.ZodNullable = exports.ZodOptional = exports.ZodTransformer = exports.ZodEffects = exports.ZodPromise = exports.ZodNativeEnum = exports.ZodEnum = exports.ZodLiteral = exports.ZodLazy = exports.ZodFunction = exports.ZodSet = exports.ZodMap = exports.ZodRecord = exports.ZodTuple = exports.ZodIntersection = exports.ZodDiscriminatedUnion = exports.ZodUnion = exports.ZodObject = exports.objectUtil = exports.ZodArray = exports.ZodVoid = exports.ZodNever = exports.ZodUnknown = exports.ZodAny = exports.ZodNull = exports.ZodUndefined = exports.ZodDate = exports.ZodBoolean = exports.ZodBigInt = exports.ZodNumber = exports.ZodString = exports.ZodType = void 0;
-exports.NEVER = exports["void"] = exports.unknown = exports.union = exports.undefined = exports.tuple = exports.transformer = exports.string = exports.strictObject = exports.set = exports.record = exports.promise = exports.preprocess = exports.ostring = exports.optional = exports.onumber = exports.oboolean = exports.object = exports.number = exports.nullable = exports["null"] = exports.never = exports.nativeEnum = exports.nan = exports.map = exports.literal = exports.lazy = exports.intersection = exports["instanceof"] = void 0;
-const errors_1 = __nccwpck_require__(9566);
+exports["void"] = exports.unknown = exports.union = exports.undefined = exports.tuple = exports.transformer = exports.string = exports.strictObject = exports.set = exports.record = exports.promise = exports.preprocess = exports.ostring = exports.optional = exports.onumber = exports.oboolean = exports.object = exports.number = exports.nullable = exports["null"] = exports.never = exports.nativeEnum = exports.nan = exports.map = exports.literal = exports.lazy = exports.intersection = exports["instanceof"] = void 0;
 const errorUtil_1 = __nccwpck_require__(2513);
 const parseUtil_1 = __nccwpck_require__(888);
 const util_1 = __nccwpck_require__(3985);
@@ -12306,7 +12269,7 @@ function processCreateParams(params) {
         return {};
     const { errorMap, invalid_type_error, required_error, description } = params;
     if (errorMap && (invalid_type_error || required_error)) {
-        throw new Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);
+        throw new Error(`Can't use "invalid" or "required" in conjunction with custom error map.`);
     }
     if (errorMap)
         return { errorMap: errorMap, description };
@@ -13442,12 +13405,9 @@ class ZodObject extends ZodType {
         const { status, ctx } = this._processInputParams(input);
         const { shape, keys: shapeKeys } = this._getCached();
         const extraKeys = [];
-        if (!(this._def.catchall instanceof ZodNever &&
-            this._def.unknownKeys === "strip")) {
-            for (const key in ctx.data) {
-                if (!shapeKeys.includes(key)) {
-                    extraKeys.push(key);
-                }
+        for (const key in ctx.data) {
+            if (!shapeKeys.includes(key)) {
+                extraKeys.push(key);
             }
         }
         const pairs = [];
@@ -14021,9 +13981,6 @@ class ZodTuple extends ZodType {
 }
 exports.ZodTuple = ZodTuple;
 ZodTuple.create = (schemas, params) => {
-    if (!Array.isArray(schemas)) {
-        throw new Error("You must pass an array of schemas to z.tuple([ ... ])");
-    }
     return new ZodTuple({
         items: schemas,
         typeName: ZodFirstPartyTypeKind.ZodTuple,
@@ -14254,8 +14211,8 @@ class ZodFunction extends ZodType {
                 errorMaps: [
                     ctx.common.contextualErrorMap,
                     ctx.schemaErrorMap,
-                    errors_1.getErrorMap(),
-                    errors_1.defaultErrorMap,
+                    ZodError_1.getErrorMap(),
+                    ZodError_1.defaultErrorMap,
                 ].filter((x) => !!x),
                 issueData: {
                     code: ZodError_1.ZodIssueCode.invalid_arguments,
@@ -14270,8 +14227,8 @@ class ZodFunction extends ZodType {
                 errorMaps: [
                     ctx.common.contextualErrorMap,
                     ctx.schemaErrorMap,
-                    errors_1.getErrorMap(),
-                    errors_1.defaultErrorMap,
+                    ZodError_1.getErrorMap(),
+                    ZodError_1.defaultErrorMap,
                 ].filter((x) => !!x),
                 issueData: {
                     code: ZodError_1.ZodIssueCode.invalid_return_type,
@@ -14341,18 +14298,18 @@ class ZodFunction extends ZodType {
         const validatedFunc = this.parse(func);
         return validatedFunc;
     }
-    static create(args, returns, params) {
-        return new ZodFunction({
-            args: (args
-                ? args
-                : ZodTuple.create([]).rest(ZodUnknown.create())),
-            returns: returns || ZodUnknown.create(),
-            typeName: ZodFirstPartyTypeKind.ZodFunction,
-            ...processCreateParams(params),
-        });
-    }
 }
 exports.ZodFunction = ZodFunction;
+ZodFunction.create = (args, returns, params) => {
+    return new ZodFunction({
+        args: (args
+            ? args.rest(ZodUnknown.create())
+            : ZodTuple.create([]).rest(ZodUnknown.create())),
+        returns: returns || ZodUnknown.create(),
+        typeName: ZodFirstPartyTypeKind.ZodFunction,
+        ...processCreateParams(params),
+    });
+};
 class ZodLazy extends ZodType {
     get schema() {
         return this._def.getter();
@@ -14810,12 +14767,6 @@ var ZodFirstPartyTypeKind;
     ZodFirstPartyTypeKind["ZodPromise"] = "ZodPromise";
     ZodFirstPartyTypeKind["ZodBranded"] = "ZodBranded";
 })(ZodFirstPartyTypeKind = exports.ZodFirstPartyTypeKind || (exports.ZodFirstPartyTypeKind = {}));
-// new approach that works for abstract classes
-// but required TS 4.4+
-// abstract class Class {
-//   constructor(..._: any[]) {}
-// }
-// const instanceOfType = <T extends typeof Class>(
 const instanceOfType = (cls, params = {
     message: `Input not instance of ${cls.name}`,
 }) => exports.custom((data) => data instanceof cls, params, true);
@@ -14891,7 +14842,6 @@ const onumber = () => numberType().optional();
 exports.onumber = onumber;
 const oboolean = () => booleanType().optional();
 exports.oboolean = oboolean;
-exports.NEVER = parseUtil_1.INVALID;
 
 
 /***/ }),
@@ -14933,23 +14883,11 @@ function getOptionalInput(name) {
     const value = core.getInput(name);
     return value.length > 0 ? value : undefined;
 }
-function parseList(list) {
-    if (list === undefined) {
-        return list;
-    }
-    else {
-        return list.split(',').map(x => x.trim());
-    }
-}
 function readConfig() {
     const fail_on_severity = z
         .enum(schemas_1.SEVERITIES)
         .default('low')
         .parse(getOptionalInput('fail-on-severity'));
-    const fail_on_scopes = z
-        .array(z.enum(schemas_1.SCOPES))
-        .default(['runtime'])
-        .parse(parseList(getOptionalInput('fail-on-scopes')));
     const allow_licenses = getOptionalInput('allow-licenses');
     const deny_licenses = getOptionalInput('deny-licenses');
     if (allow_licenses !== undefined && deny_licenses !== undefined) {
@@ -14959,9 +14897,8 @@ function readConfig() {
     const head_ref = getOptionalInput('head-ref');
     return {
         fail_on_severity,
-        fail_on_scopes,
-        allow_licenses: parseList(allow_licenses),
-        deny_licenses: parseList(deny_licenses),
+        allow_licenses: allow_licenses === null || allow_licenses === void 0 ? void 0 : allow_licenses.split(',').map(x => x.trim()),
+        deny_licenses: deny_licenses === null || deny_licenses === void 0 ? void 0 : deny_licenses.split(',').map(x => x.trim()),
         base_ref,
         head_ref
     };
@@ -14977,7 +14914,7 @@ exports.readConfig = readConfig;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.filterChangesByScopes = exports.filterChangesBySeverity = void 0;
+exports.filterChangesBySeverity = void 0;
 const schemas_1 = __nccwpck_require__(1129);
 function filterChangesBySeverity(severity, changes) {
     const severityIdx = schemas_1.SEVERITIES.indexOf(severity);
@@ -15001,15 +14938,6 @@ function filterChangesBySeverity(severity, changes) {
     return filteredChanges;
 }
 exports.filterChangesBySeverity = filterChangesBySeverity;
-function filterChangesByScopes(scopes, changes) {
-    const filteredChanges = changes.filter(change => {
-        // if there is no scope on the change (Enterprise Server API for now), we will assume it is a runtime scope
-        const scope = change.scope || 'runtime';
-        return scopes.includes(scope);
-    });
-    return filteredChanges;
-}
-exports.filterChangesByScopes = filterChangesByScopes;
 
 
 /***/ }),
@@ -15043,10 +14971,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SCOPES = exports.SEVERITIES = void 0;
+exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SEVERITIES = void 0;
 const z = __importStar(__nccwpck_require__(3301));
 exports.SEVERITIES = ['critical', 'high', 'moderate', 'low'];
-exports.SCOPES = ['unknown', 'runtime', 'development'];
 exports.ChangeSchema = z.object({
     change_type: z.enum(['added', 'removed']),
     manifest: z.string(),
@@ -15056,10 +14983,9 @@ exports.ChangeSchema = z.object({
     package_url: z.string(),
     license: z.string().nullable(),
     source_repository_url: z.string().nullable(),
-    scope: z.enum(exports.SCOPES).optional(),
     vulnerabilities: z
         .array(z.object({
-        severity: z.enum(exports.SEVERITIES),
+        severity: z.enum(['critical', 'high', 'moderate', 'low']),
         advisory_ghsa_id: z.string(),
         advisory_summary: z.string(),
         advisory_url: z.string()
@@ -15075,7 +15001,6 @@ exports.PullRequestSchema = z.object({
 exports.ConfigurationOptionsSchema = z
     .object({
     fail_on_severity: z.enum(exports.SEVERITIES).default('low'),
-    fail_on_scopes: z.array(z.enum(exports.SCOPES)).default(['runtime']),
     allow_licenses: z.array(z.string()).default([]),
     deny_licenses: z.array(z.string()).default([]),
     base_ref: z.string(),
@@ -15245,7 +15170,7 @@ function assembleStyles() {
 			overline: [53, 55],
 			inverse: [7, 27],
 			hidden: [8, 28],
-			strikethrough: [9, 29],
+			strikethrough: [9, 29]
 		},
 		color: {
 			black: [30, 39],
@@ -15265,7 +15190,7 @@ function assembleStyles() {
 			blueBright: [94, 39],
 			magentaBright: [95, 39],
 			cyanBright: [96, 39],
-			whiteBright: [97, 39],
+			whiteBright: [97, 39]
 		},
 		bgColor: {
 			bgBlack: [40, 49],
@@ -15285,8 +15210,8 @@ function assembleStyles() {
 			bgBlueBright: [104, 49],
 			bgMagentaBright: [105, 49],
 			bgCyanBright: [106, 49],
-			bgWhiteBright: [107, 49],
-		},
+			bgWhiteBright: [107, 49]
+		}
 	};
 
 	// Alias bright black as gray (and grey)
@@ -15299,7 +15224,7 @@ function assembleStyles() {
 		for (const [styleName, style] of Object.entries(group)) {
 			styles[styleName] = {
 				open: `\u001B[${style[0]}m`,
-				close: `\u001B[${style[1]}m`,
+				close: `\u001B[${style[1]}m`
 			};
 
 			group[styleName] = styles[styleName];
@@ -15309,13 +15234,13 @@ function assembleStyles() {
 
 		Object.defineProperty(styles, groupName, {
 			value: group,
-			enumerable: false,
+			enumerable: false
 		});
 	}
 
 	Object.defineProperty(styles, 'codes', {
 		value: codes,
-		enumerable: false,
+		enumerable: false
 	});
 
 	styles.color.close = '\u001B[39m';
@@ -15346,41 +15271,39 @@ function assembleStyles() {
 					return Math.round(((red - 8) / 247) * 24) + 232;
 				}
 
-				return 16
-					+ (36 * Math.round(red / 255 * 5))
-					+ (6 * Math.round(green / 255 * 5))
-					+ Math.round(blue / 255 * 5);
+				return 16 +
+					(36 * Math.round(red / 255 * 5)) +
+					(6 * Math.round(green / 255 * 5)) +
+					Math.round(blue / 255 * 5);
 			},
-			enumerable: false,
+			enumerable: false
 		},
 		hexToRgb: {
 			value: hex => {
-				const matches = /[a-f\d]{6}|[a-f\d]{3}/i.exec(hex.toString(16));
+				const matches = /(?<colorString>[a-f\d]{6}|[a-f\d]{3})/i.exec(hex.toString(16));
 				if (!matches) {
 					return [0, 0, 0];
 				}
 
-				let [colorString] = matches;
+				let {colorString} = matches.groups;
 
 				if (colorString.length === 3) {
-					colorString = [...colorString].map(character => character + character).join('');
+					colorString = colorString.split('').map(character => character + character).join('');
 				}
 
 				const integer = Number.parseInt(colorString, 16);
 
 				return [
-					/* eslint-disable no-bitwise */
 					(integer >> 16) & 0xFF,
 					(integer >> 8) & 0xFF,
-					integer & 0xFF,
-					/* eslint-enable no-bitwise */
+					integer & 0xFF
 				];
 			},
-			enumerable: false,
+			enumerable: false
 		},
 		hexToAnsi256: {
 			value: hex => styles.rgbToAnsi256(...styles.hexToRgb(hex)),
-			enumerable: false,
+			enumerable: false
 		},
 		ansi256ToAnsi: {
 			value: code => {
@@ -15416,7 +15339,6 @@ function assembleStyles() {
 					return 30;
 				}
 
-				// eslint-disable-next-line no-bitwise
 				let result = 30 + ((Math.round(blue) << 2) | (Math.round(green) << 1) | Math.round(red));
 
 				if (value === 2) {
@@ -15425,16 +15347,16 @@ function assembleStyles() {
 
 				return result;
 			},
-			enumerable: false,
+			enumerable: false
 		},
 		rgbToAnsi: {
 			value: (red, green, blue) => styles.ansi256ToAnsi(styles.rgbToAnsi256(red, green, blue)),
-			enumerable: false,
+			enumerable: false
 		},
 		hexToAnsi: {
 			value: hex => styles.ansi256ToAnsi(styles.hexToAnsi256(hex)),
-			enumerable: false,
-		},
+			enumerable: false
+		}
 	});
 
 	return styles;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "2.2.0",
+  "version": "2.0.4",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",
@@ -29,26 +29,26 @@
     "@actions/github": "^5.0.3",
     "@octokit/plugin-retry": "^3.0.9",
     "@octokit/request-error": "^3.0.1",
-    "ansi-styles": "^6.1.1",
-    "got": "^12.5.0",
-    "nodemon": "^2.0.20",
+    "ansi-styles": "^6.1.0",
+    "got": "^12.3.1",
+    "nodemon": "^2.0.19",
     "yaml": "^2.1.1",
-    "zod": "^3.19.1"
+    "zod": "^3.18.0"
   },
   "devDependencies": {
-    "@types/node": "^16.11.59",
-    "@typescript-eslint/eslint-plugin": "^5.38.0",
-    "@typescript-eslint/parser": "^5.38.0",
+    "@types/node": "^16.11.49",
+    "@typescript-eslint/eslint-plugin": "^5.33.1",
+    "@typescript-eslint/parser": "^5.33.1",
     "@vercel/ncc": "^0.34.0",
     "esbuild-register": "^3.3.3",
-    "eslint": "^8.23.1",
+    "eslint": "^8.22.0",
     "eslint-plugin-github": "^4.3.7",
-    "eslint-plugin-jest": "^27.0.4",
+    "eslint-plugin-jest": "^26.8.3",
     "jest": "^27.5.1",
     "js-yaml": "^4.1.0",
-    "nodemon": "^2.0.20",
+    "nodemon": "^2.0.19",
     "prettier": "2.7.1",
     "ts-jest": "^27.1.4",
-    "typescript": "^4.8.3"
+    "typescript": "^4.7.4"
   }
 }

scripts/scan_pr

@@ -32,25 +32,17 @@ event_file = Tempfile.new
 event_file.write("{ \"pull_request\": #{pr.to_h.to_json}}")
 event_file.close
 
-action_inputs = {
-  "repo-token" => github_token
-}
-
 dev_cmd_env = {
+  "INPUT_REPO-TOKEN" => github_token,
   "GITHUB_REPOSITORY" => repo_nwo,
   "GITHUB_EVENT_NAME" => "pull_request",
-  "GITHUB_EVENT_PATH" => event_file.path,
-  "GITHUB_STEP_SUMMARY" => "/dev/null"
+  "GITHUB_EVENT_PATH" => event_file.path
 }
 
-# bash does not like variable names with dashes like the ones Actions
-# uses (e.g. INPUT_REPO-TOKEN). Passing them through `env` instead of
-# manually setting them does the job.
-action_inputs_env_str = action_inputs.map { |name, value| "\"INPUT_#{name.upcase}=#{value}\"" }.join(" ")
-dev_cmd = "./node_modules/.bin/nodemon --exec \"env #{action_inputs_env_str} node -r esbuild-register\" src/main.ts"
+dev_cmd = "./node_modules/.bin/nodemon --exec \"node -r esbuild-register\" src/main.ts"
 
 Open3.popen2e(dev_cmd_env, dev_cmd) do |stdin, out|
   while line = out.gets
-    puts line.gsub(github_token, "<REDACTED>")
+    puts line
   end
 end

src/config.ts

@@ -1,29 +1,17 @@
 import * as core from '@actions/core'
 import * as z from 'zod'
-import {ConfigurationOptions, SEVERITIES, SCOPES} from './schemas'
+import {ConfigurationOptions, SEVERITIES} from './schemas'
 
 function getOptionalInput(name: string): string | undefined {
   const value = core.getInput(name)
   return value.length > 0 ? value : undefined
 }
 
-function parseList(list: string | undefined): string[] | undefined {
-  if (list === undefined) {
-    return list
-  } else {
-    return list.split(',').map(x => x.trim())
-  }
-}
-
 export function readConfig(): ConfigurationOptions {
   const fail_on_severity = z
     .enum(SEVERITIES)
     .default('low')
     .parse(getOptionalInput('fail-on-severity'))
-  const fail_on_scopes = z
-    .array(z.enum(SCOPES))
-    .default(['runtime'])
-    .parse(parseList(getOptionalInput('fail-on-scopes')))
   const allow_licenses = getOptionalInput('allow-licenses')
   const deny_licenses = getOptionalInput('deny-licenses')
 
@@ -36,9 +24,8 @@ export function readConfig(): ConfigurationOptions {
 
   return {
     fail_on_severity,
-    fail_on_scopes,
-    allow_licenses: parseList(allow_licenses),
-    deny_licenses: parseList(deny_licenses),
+    allow_licenses: allow_licenses?.split(',').map(x => x.trim()),
+    deny_licenses: deny_licenses?.split(',').map(x => x.trim()),
     base_ref,
     head_ref
   }

src/filter.ts

@@ -1,4 +1,4 @@
-import {Changes, Severity, SEVERITIES, Scope} from './schemas'
+import {Changes, Severity, SEVERITIES} from './schemas'
 
 export function filterChangesBySeverity(
   severity: Severity,
@@ -33,16 +33,3 @@ export function filterChangesBySeverity(
   )
   return filteredChanges
 }
-
-export function filterChangesByScopes(
-  scopes: Scope[],
-  changes: Changes
-): Changes {
-  const filteredChanges = changes.filter(change => {
-    // if there is no scope on the change (Enterprise Server API for now), we will assume it is a runtime scope
-    const scope = change.scope || 'runtime'
-    return scopes.includes(scope)
-  })
-
-  return filteredChanges
-}

src/main.ts

@@ -3,9 +3,9 @@ import * as dependencyGraph from './dependency-graph'
 import * as github from '@actions/github'
 import styles from 'ansi-styles'
 import {RequestError} from '@octokit/request-error'
-import {Change, Severity, Scope} from './schemas'
+import {Change, Severity} from './schemas'
 import {readConfig} from '../src/config'
-import {filterChangesBySeverity, filterChangesByScopes} from '../src/filter'
+import {filterChangesBySeverity} from '../src/filter'
 import {getDeniedLicenseChanges} from './licenses'
 import * as summary from './summary'
 import {getRefs} from './git-refs'
@@ -30,13 +30,9 @@ async function run(): Promise<void> {
       deny: config.deny_licenses
     }
 
-    const scopes = config.fail_on_scopes
-
-    const scopedChanges = filterChangesByScopes(scopes as Scope[], changes)
-
     const addedChanges = filterChangesBySeverity(
       minSeverity as Severity,
-      scopedChanges
+      changes
     ).filter(
       change =>
         change.change_type === 'added' &&
@@ -45,7 +41,7 @@ async function run(): Promise<void> {
     )
 
     const [licenseErrors, unknownLicenses] = getDeniedLicenseChanges(
-      scopedChanges,
+      changes,
       licenses
     )
 

src/schemas.ts

@@ -1,7 +1,6 @@
 import * as z from 'zod'
 
 export const SEVERITIES = ['critical', 'high', 'moderate', 'low'] as const
-export const SCOPES = ['unknown', 'runtime', 'development'] as const
 
 export const ChangeSchema = z.object({
   change_type: z.enum(['added', 'removed']),
@@ -12,11 +11,10 @@ export const ChangeSchema = z.object({
   package_url: z.string(),
   license: z.string().nullable(),
   source_repository_url: z.string().nullable(),
-  scope: z.enum(SCOPES).optional(),
   vulnerabilities: z
     .array(
       z.object({
-        severity: z.enum(SEVERITIES),
+        severity: z.enum(['critical', 'high', 'moderate', 'low']),
         advisory_ghsa_id: z.string(),
         advisory_summary: z.string(),
         advisory_url: z.string()
@@ -35,7 +33,6 @@ export const PullRequestSchema = z.object({
 export const ConfigurationOptionsSchema = z
   .object({
     fail_on_severity: z.enum(SEVERITIES).default('low'),
-    fail_on_scopes: z.array(z.enum(SCOPES)).default(['runtime']),
     allow_licenses: z.array(z.string()).default([]),
     deny_licenses: z.array(z.string()).default([]),
     base_ref: z.string(),
@@ -53,4 +50,3 @@ export type Change = z.infer<typeof ChangeSchema>
 export type Changes = z.infer<typeof ChangesSchema>
 export type ConfigurationOptions = z.infer<typeof ConfigurationOptionsSchema>
 export type Severity = typeof SEVERITIES[number]
-export type Scope = typeof SCOPES[number]