Update summary.ts

correct max length

.github/dependabot.yml

@@ -12,8 +12,3 @@ updates:
     ignore:
       - dependency-name: '@types/node'
         update-types: ['version-update:semver-major']
-    groups:
-      minor-updates:
-        update-types:
-        - "minor"
-        - "patch"

.github/workflows/dependency-review.yml

@@ -1,5 +1,4 @@
 name: 'Dependency Review'
-
 on: [pull_request]
 
 permissions:
@@ -12,4 +11,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@v4
       - name: Dependency Review
-        uses: ./
+        uses: actions/dependency-review-action@main

.github/workflows/stale.yaml

@@ -12,15 +12,12 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v9.1.0
+    - uses: actions/stale@v9.0.0
       name: Clean up stale PRs and Issues
       with:
-        stale-pr-message: "👋 This pull request has been marked as stale because it has been open with no activity for 180 days. You can: comment on the PR or remove the stale label to hold stalebot off for a while, add the `Keep` label to hold stale off permanently, or do nothing. If you do nothing, this pull request will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details."
+        stale-pr-message: "👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the `Keep` label to hold stale off permanently, or do nothing. If you do nothing, this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details."
         stale-pr-label: "Stale"
-        close-pr-message: "👋 This pull request has been closed by stalebot because it has been open with no activity for over 180 days. Please see CONTRIBUTING.md for more policy details."
         stale-issue-label: "Stale"
-        stale-issue-message: "👋 This issue has been marked as stale because it has been open with no activity for 180 days. You can: comment on the issue or remove the stale label to hold stalebot off for a while, add the `Keep` label to hold stale off permanently, or do nothing. If you do nothing, this issue will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details."
-        close-issue-message: "👋 This issue has been closed by stalebot because it has been open with no activity for over 180 days. Please see CONTRIBUTING.md for more policy details."
         exempt-pr-labels: "Keep" # a "Keep" label will keep the PR from being closed as stale
         exempt-issue-labels: "Keep" # a "Keep" label will keep the issue from being closed as stale
         days-before-pr-stale: 180 # when the PR is considered stale

CONTRIBUTING.md

@@ -35,11 +35,11 @@ Ready to contribute to `dependency-review-action`?  Here is some information to
 
 This action makes an authenticated query to the [Dependency Review API](https://docs.github.com/en/rest/dependency-graph/dependency-review) endpoint (`GET /repos/{owner}/{repo}/dependency-graph/compare/{basehead}`) to find out the set of added and removed dependencies for each manifest.
 
-The action then evaluates the differences between the pushes based on the rules defined in the action configuration, and summarizes the differences and any violations of the rules you have defined as a comment in the pull request that triggered it and the action outputs.
+The action then evaluates the differences between the pushes based on the the rules defined in the action configuration, and summarizes the differences and any violations of the rules you have defined as a comment in the pull request that triggered it and the action outputs.
 
 ### Local Development
 
-Before you begin, you need to have [Node.js](https://nodejs.org/en/) installed, minimum version 20.
+Before you begin, you need to have [Node.js](https://nodejs.org/en/) installed, minimum version 18.
 
 #### Bootstrapping the project
 
@@ -81,7 +81,7 @@ $ GITHUB_TOKEN=<token> ./scripts/scan_pr --config-file my_custom_config.yml <pr_
 npm run test
 ```
 
-_Note_: We don't have a very comprehensive test suite, so any contributions to the existing tests are welcome!
+_Note_: We don't a very comprehensive test suite, so any contributions to the existing tests are welcome!
 
 ### Submitting a pull request
 

README.md

@@ -110,7 +110,7 @@ All configuration options are optional.
 | `vulnerability-check`                  | Enable or disable the vulnerability check performed by the action.                                                                                                                                         | `true`, `false`                                                                                              | `true`        |
 | `allow-dependencies-licenses`\*        | Contains a list of packages that will be excluded from license checks.                                                                                                                                     | Any package(s) in [purl](https://github.com/package-url/purl-spec) format                                    | none          |
 | `base-ref`/`head-ref`                  | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`.                           | Any valid git ref(s) in your project                                                                         | none          |
-| `comment-summary-in-pr`                | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job the `pull-requests: write` permission. With each execution, a new comment will overwrite the existing one.                                      | `always`, `on-failure`, `never`                                                                              | `never`       |
+| `comment-summary-in-pr`                | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job the `pull-requests: write` permission.                                      | `always`, `on-failure`, `never`                                                                              | `never`       |
 | `deny-packages`                        | Any number of packages to block in a PR. This option will match on the exact version provided. If no version is provided, the option will treat the specified package as a wildcard and deny all versions. | Package(s) in [purl](https://github.com/package-url/purl-spec) format                                        | empty         |
 | `deny-groups`                          | Any number of groups (namespaces) to block in a PR.                                                                                                                                                        | Namespace(s) in [purl](https://github.com/package-url/purl-spec) format (no package name, no version number) | empty         |
 | `retry-on-snapshot-warnings`\*         | Enable or disable retrying the action every 10 seconds while waiting for dependency submission actions to complete.                                                                                        | `true`, `false`                                                                                              | `false`       |

__tests__/config.test.ts

@@ -124,7 +124,11 @@ test('it raises an error when no refs are provided and the event is not a pull r
   ).toThrow()
 })
 
-const pullRequestLikeEvents = ['pull_request', 'pull_request_target']
+const pullRequestLikeEvents = [
+  'pull_request',
+  'pull_request_target',
+  'merge_group'
+]
 
 test.each(pullRequestLikeEvents)(
   'it uses the given refs even when the event is %s',
@@ -148,7 +152,7 @@ test.each(pullRequestLikeEvents)(
 )
 
 test.each(pullRequestLikeEvents)(
-  'it uses the event refs when the event is %s and no refs are provided in config',
+  'it uses the event refs when the event is %s and the no refs are input',
   async eventName => {
     const refs = getRefs(await readConfig(), {
       payload: {
@@ -165,37 +169,6 @@ test.each(pullRequestLikeEvents)(
   }
 )
 
-test('it uses the given refs even when the event is merge_group', async () => {
-  setInput('base-ref', 'a-custom-base-ref')
-  setInput('head-ref', 'a-custom-head-ref')
-
-  const refs = getRefs(await readConfig(), {
-    payload: {
-      merge_group: {
-        base_sha: 'pr-base-ref',
-        head_sha: 'pr-head-ref'
-      }
-    },
-    eventName: 'merge_group'
-  })
-  expect(refs.base).toEqual('a-custom-base-ref')
-  expect(refs.head).toEqual('a-custom-head-ref')
-})
-
-test('it uses the event refs when the event is merge_group and no refs are provided in config', async () => {
-  const refs = getRefs(await readConfig(), {
-    payload: {
-      merge_group: {
-        base_sha: 'pr-base-ref',
-        head_sha: 'pr-head-ref'
-      }
-    },
-    eventName: 'merge_group'
-  })
-  expect(refs.base).toEqual('pr-base-ref')
-  expect(refs.head).toEqual('pr-head-ref')
-})
-
 test('it defaults to runtime scope', async () => {
   const config = await readConfig()
   expect(config.fail_on_scopes).toEqual(['runtime'])

__tests__/deny.test.ts

@@ -134,62 +134,3 @@ test('allows packages not defined in the deny packages and groups list', async (
 
   expect(deniedChanges.length).toEqual(0)
 })
-
-test('deny packages does not prevent removal of denied packages', async () => {
-  const changes: Changes = [
-    createTestChange({
-      change_type: 'added',
-      name: 'deny-by-name-and-version',
-      version: '1.0.0',
-      ecosystem: 'npm'
-    }),
-    createTestChange({
-      change_type: 'removed',
-      name: 'pass-by-name-and-version',
-      version: '1.0.0',
-      ecosystem: 'npm'
-    }),
-    createTestChange({
-      change_type: 'added',
-      name: 'deny-by-name',
-      version: '1.0.0',
-      ecosystem: 'npm'
-    }),
-    createTestChange({
-      change_type: 'removed',
-      name: 'pass-by-name',
-      version: '1.0.0',
-      ecosystem: 'npm'
-    }),
-    createTestChange({
-      change_type: 'added',
-      package_url: 'pkg:npm/org.test.deny.by.namespace/[email protected]',
-      ecosystem: 'npm'
-    }),
-    createTestChange({
-      change_type: 'removed',
-      package_url: 'pkg:npm/org.test.pass.by.namespace/[email protected]',
-      ecosystem: 'npm'
-    })
-  ]
-  const deniedPackages = createTestPURLs([
-    'pkg:npm/org.test.deny.by/[email protected]',
-    'pkg:npm/org.test.pass.by/[email protected]',
-    'pkg:npm/org.test.deny.by/deny-by-name',
-    'pkg:npm/org.test.pass.by/pass-by-name'
-  ])
-  const deniedGroups = createTestPURLs([
-    'pkg:npm/org.test.deny.by.namespace/',
-    'pkg:npm/org.test.pass.by.namespace/'
-  ])
-  const deniedChanges = await getDeniedChanges(
-    changes,
-    deniedPackages,
-    deniedGroups
-  )
-
-  expect(deniedChanges.length).toEqual(3)
-  expect(deniedChanges[0]).toBe(changes[0])
-  expect(deniedChanges[1]).toBe(changes[2])
-  expect(deniedChanges[2]).toBe(changes[4])
-})

__tests__/summary.test.ts

@@ -109,6 +109,42 @@ test('prints headline as h1', () => {
   expect(text).toContain('<h1>Dependency Review</h1>')
 })
 
+test('returns minimal summary in case the core.summary is too large for a PR comment', () => {
+  let changes: Changes = [
+    createTestChange({name: 'lodash', version: '1.2.3'}),
+    createTestChange({name: 'colors', version: '2.3.4'}),
+    createTestChange({name: '@foo/bar', version: '*'})
+  ]
+
+  let minSummary: string = summary.addSummaryToSummary(
+    changes,
+    emptyInvalidLicenseChanges,
+    emptyChanges,
+    scorecard,
+    defaultConfig
+  )
+
+  // side effect DR report into core.summary as happens in main.ts
+  summary.addScannedDependencies(changes)
+  const text = core.summary.stringify()
+
+  expect(text).toContain('<h1>Dependency Review</h1>')
+  expect(minSummary).toContain('# Dependency Review')
+
+  expect(text).toContain('❌ 3 vulnerable package(s)')
+  expect(text).not.toContain('* ❌ 3 vulnerable package(s)')
+  expect(text).toContain('lodash')
+  expect(text).toContain('colors')
+  expect(text).toContain('@foo/bar')
+
+  expect(minSummary).toContain('* ❌ 3 vulnerable package(s)')
+  expect(minSummary).not.toContain('lodash')
+  expect(minSummary).not.toContain('colors')
+  expect(minSummary).not.toContain('@foo/bar')
+
+  expect(text.length).toBeGreaterThan(minSummary.length)
+})
+
 test('returns minimal summary formatted for posting as a PR comment', () => {
   const OLD_ENV = process.env
 
@@ -196,10 +232,14 @@ test('groups dependencies with empty manifest paths together', () => {
     emptyScorecard,
     defaultConfig
   )
-  summary.addScannedFiles(changesWithEmptyManifests)
+  summary.addScannedDependencies(changesWithEmptyManifests)
   const text = core.summary.stringify()
-  expect(text).toContain('Unnamed Manifest')
-  expect(text).toContain('python/dist-info/METADATA')
+
+  expect(text).toContain('<summary>Unnamed Manifest</summary>')
+  expect(text).toContain('castore')
+  expect(text).toContain('connection')
+  expect(text).toContain('<summary>python/dist-info/METADATA</summary>')
+  expect(text).toContain('pygments')
 })
 
 test('does not include status section if nothing was found', () => {

dist/licenses.txt

@@ -1460,7 +1460,7 @@ lru-cache
 ISC
 The ISC License
 
-Copyright (c) 2010-2023 Isaac Z. Schlueter and Contributors
+Copyright (c) Isaac Z. Schlueter and Contributors
 
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
@@ -1764,6 +1764,25 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
 IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 
+yallist
+ISC
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
 yaml
 ISC
 Copyright Eemeli Aro <[email protected]>

docs/examples.md

@@ -1,4 +1,4 @@
-# Examples of how to use the Dependency Review Action
+# Examples on how to use the Dependency Review Action
 
 ## Basic Usage
 
@@ -89,7 +89,7 @@ The following example will use a configuration file from an external public GitH
 
 Let's say that the configuration file is located in `github/octorepo/dependency-review-config.yml@main`
 
-The Dependency Review Action workflow file will then look like this:
+The Dependancy Review Action workflow file will then look like this:
 
 ```yaml
 name: 'Dependency Review'
@@ -116,7 +116,7 @@ The following example will use a configuration file from an external private Gti
 
 Let's say that the configuration file is located in `github/octorepo-private/dependency-review-config.yml@main`
 
-The Dependency Review Action workflow file will then look like this:
+The Dependancy Review Action workflow file will then look like this:
 
 ```yaml
 name: 'Dependency Review'

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "4.6.0",
+  "version": "4.3.4",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",
@@ -27,19 +27,18 @@
   "dependencies": {
     "@actions/core": "^1.10.1",
     "@actions/github": "^6.0.0",
-    "@octokit/plugin-retry": "^6.1.0",
-    "@octokit/request-error": "^5.1.1",
-    "@octokit/types": "12.5.0",
+    "@octokit/plugin-retry": "^6.0.1",
+    "@octokit/request-error": "^5.0.1",
     "@onebeyond/spdx-license-satisfies": "^1.0.1",
     "ansi-styles": "^6.2.1",
-    "got": "^14.4.5",
+    "got": "^14.4.1",
     "jest": "^29.7.0",
     "octokit": "^3.1.2",
     "spdx-expression-parse": "^3.0.1",
     "spdx-satisfies": "^5.0.1",
-    "ts-jest": "^29.2.5",
+    "ts-jest": "^29.1.2",
     "yaml": "^2.3.4",
-    "zod": "^3.24.1"
+    "zod": "^3.23.8"
   },
   "devDependencies": {
     "@types/jest": "^29.5.12",
@@ -48,19 +47,15 @@
     "@types/spdx-satisfies": "^0.1.1",
     "@typescript-eslint/eslint-plugin": "^6.21.0",
     "@typescript-eslint/parser": "^6.21.0",
-    "@vercel/ncc": "^0.38.3",
-    "esbuild-register": "^3.6.0",
+    "@vercel/ncc": "^0.38.0",
+    "esbuild-register": "^3.5.0",
     "eslint": "^8.57.0",
     "eslint-plugin-github": "^4.10.2",
-    "eslint-plugin-jest": "^28.8.3",
+    "eslint-plugin-jest": "^27.9.0",
     "eslint-plugin-prettier": "^5.1.3",
     "js-yaml": "^4.1.0",
-    "nodemon": "^3.1.9",
+    "nodemon": "^3.1.0",
     "prettier": "3.2.5",
     "typescript": "^5.4.5"
-  },
-  "overrides": {
-    "cross-spawn": ">=7.0.5",
-    "@octokit/[email protected]": "5.1.1"
   }
 }

scripts/create_summary.ts

@@ -143,7 +143,7 @@ async function createSummary(
     ...licenseIssues.unlicensed
   ]
 
-  summary.addScannedFiles(allChanges)
+  summary.addScannedDependencies(allChanges)
 
   const text = core.summary.stringify()
   await fs.promises.writeFile(path.resolve(tmpDir, fileName), text, {

src/comment-pr.ts

@@ -17,13 +17,13 @@ const COMMENT_MARKER = '<!-- dependency-review-pr-comment-marker -->'
 
 export async function commentPr(
   commentContent: string,
-  config: ConfigurationOptions,
-  issueFound: boolean
+  config: ConfigurationOptions
 ): Promise<void> {
   if (
     !(
       config.comment_summary_in_pr === 'always' ||
-      (config.comment_summary_in_pr === 'on-failure' && issueFound)
+      (config.comment_summary_in_pr === 'on-failure' &&
+        process.exitCode === core.ExitCode.Failure)
     )
   ) {
     return

src/deny.ts

@@ -9,17 +9,15 @@ export async function getDeniedChanges(
 ): Promise<Change[]> {
   const changesDenied: Change[] = []
 
+  let hasDeniedPackage = false
   for (const change of changes) {
-    if (change.change_type === 'removed') {
-      continue
-    }
-
     for (const denied of deniedPackages) {
       if (
         (!denied.version || change.version === denied.version) &&
         change.name === denied.name
       ) {
         changesDenied.push(change)
+        hasDeniedPackage = true
       }
     }
 
@@ -32,10 +30,17 @@ export async function getDeniedChanges(
       }
       if (namespace && namespace === denied.namespace) {
         changesDenied.push(change)
+        hasDeniedPackage = true
       }
     }
   }
 
+  if (hasDeniedPackage) {
+    core.setFailed('Dependency review detected denied packages.')
+  } else {
+    core.info('Dependency review did not detect any denied packages')
+  }
+
   return changesDenied
 }
 

src/git-refs.ts

@@ -1,34 +1,22 @@
-import {
-  PullRequestSchema,
-  ConfigurationOptions,
-  MergeGroupSchema
-} from './schemas'
+import {PullRequestSchema, ConfigurationOptions} from './schemas'
 
 export function getRefs(
   config: ConfigurationOptions,
-  context: {
-    payload: {pull_request?: unknown; merge_group?: unknown}
-    eventName: string
-  }
+  context: {payload: {pull_request?: unknown}; eventName: string}
 ): {base: string; head: string} {
   let base_ref = config.base_ref
   let head_ref = config.head_ref
 
   // If possible, source default base & head refs from the GitHub event.
   // The base/head ref from the config take priority, if provided.
-  if (!base_ref && !head_ref) {
-    if (
-      context.eventName === 'pull_request' ||
-      context.eventName === 'pull_request_target'
-    ) {
-      const pull_request = PullRequestSchema.parse(context.payload.pull_request)
-      base_ref = base_ref || pull_request.base.sha
-      head_ref = head_ref || pull_request.head.sha
-    } else if (context.eventName === 'merge_group') {
-      const merge_group = MergeGroupSchema.parse(context.payload.merge_group)
-      base_ref = base_ref || merge_group.base_sha
-      head_ref = head_ref || merge_group.head_sha
-    }
+  if (
+    context.eventName === 'pull_request' ||
+    context.eventName === 'pull_request_target' ||
+    context.eventName === 'merge_group'
+  ) {
+    const pull_request = PullRequestSchema.parse(context.payload.pull_request)
+    base_ref = base_ref || pull_request.base.sha
+    head_ref = head_ref || pull_request.head.sha
   }
 
   if (!base_ref && !head_ref) {

src/main.ts

@@ -24,6 +24,7 @@ import {getRefs} from './git-refs'
 import {groupDependenciesByManifest} from './utils'
 import {commentPr, MAX_COMMENT_LENGTH} from './comment-pr'
 import {getDeniedChanges} from './deny'
+import {MAX_SUMMARY_LENGTH} from './summary'
 
 async function delay(ms: number): Promise<void> {
   return new Promise(resolve => setTimeout(resolve, ms))
@@ -141,16 +142,10 @@ async function run(): Promise<void> {
       summary.addSnapshotWarnings(config, snapshot_warnings)
     }
 
-    let issueFound = false
-
     if (config.vulnerability_check) {
       core.setOutput('vulnerable-changes', JSON.stringify(vulnerableChanges))
       summary.addChangeVulnerabilitiesToSummary(vulnerableChanges, minSeverity)
-      issueFound ||= await printVulnerabilitiesBlock(
-        vulnerableChanges,
-        minSeverity,
-        warnOnly
-      )
+      printVulnerabilitiesBlock(vulnerableChanges, minSeverity, warnOnly)
     }
     if (config.license_check) {
       core.setOutput(
@@ -158,12 +153,12 @@ async function run(): Promise<void> {
         JSON.stringify(invalidLicenseChanges)
       )
       summary.addLicensesToSummary(invalidLicenseChanges, config)
-      issueFound ||= await printLicensesBlock(invalidLicenseChanges, warnOnly)
+      printLicensesBlock(invalidLicenseChanges, warnOnly)
     }
     if (config.deny_packages || config.deny_groups) {
       core.setOutput('denied-changes', JSON.stringify(deniedChanges))
       summary.addDeniedToSummary(deniedChanges)
-      issueFound ||= await printDeniedDependencies(deniedChanges, config)
+      printDeniedDependencies(deniedChanges, config)
     }
     if (config.show_openssf_scorecard) {
       summary.addScorecardToSummary(scorecard, config)
@@ -172,7 +167,7 @@ async function run(): Promise<void> {
     }
 
     core.setOutput('dependency-changes', JSON.stringify(changes))
-    summary.addScannedFiles(changes)
+    summary.addScannedDependencies(changes)
     printScannedDependencies(changes)
 
     // include full summary in output; Actions will truncate if oversized
@@ -188,7 +183,7 @@ async function run(): Promise<void> {
     }
 
     // update the PR comment if needed with the right-sized summary
-    await commentPr(rendered, config, issueFound)
+    await commentPr(rendered, config)
   } catch (error) {
     if (error instanceof RequestError && error.status === 404) {
       core.setFailed(
@@ -196,7 +191,7 @@ async function run(): Promise<void> {
       )
     } else if (error instanceof RequestError && error.status === 403) {
       core.setFailed(
-        `Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled along with GitHub Advanced Security on private repositories, see ${github.context.serverUrl}/${github.context.repo.owner}/${github.context.repo.repo}/settings/security_analysis`
+        `Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled along with GitHub Advanced Security on private repositories, see https://github.com/${github.context.repo.owner}/${github.context.repo.repo}/settings/security_analysis`
       )
     } else {
       if (error instanceof Error) {
@@ -206,20 +201,22 @@ async function run(): Promise<void> {
       }
     }
   } finally {
-    await core.summary.write()
+    await core.summary.write() // need to write the minSummary content to this 
   }
 }
 
-async function printVulnerabilitiesBlock(
+function printVulnerabilitiesBlock(
   addedChanges: Changes,
   minSeverity: Severity,
   warnOnly: boolean
-): Promise<boolean> {
-  return core.group('Vulnerabilities', async () => {
-    let vulFound = false
-
-    for (const change of addedChanges) {
-      vulFound ||= printChangeVulnerabilities(change)
+): void {
+  let vulFound = false
+  core.group('Vulnerabilities', async () => {
+    if (addedChanges.length > 0) {
+      for (const change of addedChanges) {
+        printChangeVulnerabilities(change)
+      }
+      vulFound = true
     }
 
     if (vulFound) {
@@ -234,12 +231,10 @@ async function printVulnerabilitiesBlock(
         `Dependency review did not detect any vulnerable packages with severity level "${minSeverity}" or higher.`
       )
     }
-
-    return vulFound
   })
 }
 
-function printChangeVulnerabilities(change: Change): boolean {
+function printChangeVulnerabilities(change: Change): void {
   for (const vuln of change.vulnerabilities) {
     core.info(
       `${styles.bold.open}${change.manifest} » ${change.name}@${
@@ -250,18 +245,14 @@ function printChangeVulnerabilities(change: Change): boolean {
     )
     core.info(`  ↪ ${vuln.advisory_url}`)
   }
-  return change.vulnerabilities.length > 0
 }
 
-async function printLicensesBlock(
+function printLicensesBlock(
   invalidLicenseChanges: Record<string, Changes>,
   warnOnly: boolean
-): Promise<boolean> {
-  return core.group('Licenses', async () => {
-    let issueFound = false
-
+): void {
+  core.group('Licenses', async () => {
     if (invalidLicenseChanges.forbidden.length > 0) {
-      issueFound = true
       core.info('\nThe following dependencies have incompatible licenses:')
       printLicensesError(invalidLicenseChanges.forbidden)
       const msg = 'Dependency review detected incompatible licenses.'
@@ -272,7 +263,6 @@ async function printLicensesBlock(
       }
     }
     if (invalidLicenseChanges.unresolved.length > 0) {
-      issueFound = true
       core.warning(
         '\nThe validity of the licenses of the dependencies below could not be determined. Ensure that they are valid SPDX licenses:'
       )
@@ -282,8 +272,6 @@ async function printLicensesBlock(
       )
     }
     printNullLicenses(invalidLicenseChanges.unlicensed)
-
-    return issueFound
   })
 }
 
@@ -383,13 +371,11 @@ function printScannedDependencies(changes: Changes): void {
   })
 }
 
-async function printDeniedDependencies(
+function printDeniedDependencies(
   changes: Changes,
   config: ConfigurationOptions
-): Promise<boolean> {
-  return core.group('Denied', async () => {
-    let issueFound = false
-
+): void {
+  core.group('Denied', async () => {
     for (const denied of config.deny_packages) {
       core.info(`Config: ${denied}`)
     }
@@ -398,15 +384,6 @@ async function printDeniedDependencies(
       core.info(`Change: ${change.name}@${change.version} is denied`)
       core.info(`Change: ${change.package_url} is denied`)
     }
-
-    if (changes.length > 0) {
-      issueFound = true
-      core.setFailed('Dependency review detected denied packages.')
-    } else {
-      core.info('Dependency review did not detect any denied packages')
-    }
-
-    return issueFound
   })
 }
 

src/schemas.ts

@@ -91,11 +91,6 @@ export const PullRequestSchema = z.object({
   head: z.object({sha: z.string()})
 })
 
-export const MergeGroupSchema = z.object({
-  base_sha: z.string(),
-  head_sha: z.string()
-})
-
 export const ConfigurationOptionsSchema = z
   .object({
     fail_on_severity: SeveritySchema,

src/summary.ts

@@ -1,7 +1,7 @@
 import * as core from '@actions/core'
+import {ConfigurationOptions, Changes, Change, Scorecard} from './schemas'
 import {SummaryTableRow} from '@actions/core/lib/summary'
 import {InvalidLicenseChanges, InvalidLicenseChangeTypes} from './licenses'
-import {Change, Changes, ConfigurationOptions, Scorecard} from './schemas'
 import {groupDependenciesByManifest, getManifestsSet, renderUrl} from './utils'
 
 const icons = {
@@ -10,7 +10,7 @@ const icons = {
   warning: '⚠️'
 }
 
-const MAX_SCANNED_FILES_BYTES = 1048576
+export const MAX_SUMMARY_LENGTH = 1048576
 
 // generates the DR report summmary and caches it to the Action's core.summary.
 // returns the DR summary string, ready to be posted as a PR comment if the
@@ -265,37 +265,20 @@ function formatLicense(license: string | null): string {
   return license
 }
 
-export function addScannedFiles(changes: Changes): void {
-  const manifests = Array.from(
-    groupDependenciesByManifest(changes).keys()
-  ).sort()
+export function addScannedDependencies(changes: Changes): void {
+  const dependencies = groupDependenciesByManifest(changes)
+  const manifests = dependencies.keys()
 
-  let sf_size = 0
-  let trunc_at = -1
+  const summary = core.summary.addHeading('Scanned Manifest Files', 2)
 
-  for (const [index, entry] of manifests.entries()) {
-    if (sf_size + entry.length >= MAX_SCANNED_FILES_BYTES) {
-      trunc_at = index
-      break
+  for (const manifest of manifests) {
+    const deps = dependencies.get(manifest)
+    if (deps) {
+      const dependencyNames = deps.map(
+        dependency => `<li>${dependency.name}@${dependency.version}</li>`
+      )
+      summary.addDetails(manifest, `<ul>${dependencyNames.join('')}</ul>`)
     }
-    sf_size += entry.length
-  }
-
-  if (trunc_at >= 0) {
-    // truncate the manifests list if it will overflow the summary output
-    manifests.slice(0, trunc_at)
-    // if there's room between cutoff size and list size, add a warning
-    const size_diff = MAX_SCANNED_FILES_BYTES - sf_size
-    if (size_diff < 12) {
-      manifests.push('(truncated)')
-    }
-  }
-
-  const summary = core.summary.addHeading('Scanned Files', 2)
-  if (manifests.length === 0) {
-    summary.addRaw('None')
-  } else {
-    summary.addList(manifests)
   }
 }
 
@@ -321,9 +304,6 @@ export function addScorecardToSummary(
   scorecard: Scorecard,
   config: ConfigurationOptions
 ): void {
-  if (scorecard.dependencies.length === 0) {
-    return
-  }
   core.summary.addHeading('OpenSSF Scorecard', 2)
   if (scorecard.dependencies.length > 10) {
     core.summary.addRaw(`<details><summary>Scorecard details</summary>`, true)