57 |
58 | The syntax of the script is:
59 |
60 | ```sh
61 | $ GITHUB_TOKEN=
105 |
106 | _Note: these instructions are for maintainers_
107 |
108 | 1. Update the version number in [package.json](https://github.com/actions/dependency-review-action/blob/main/package.json) and run `npm i` to update the lockfile.
109 | 1. Go to [Draft a new
110 | release](https://github.com/actions/dependency-review-action/releases/new)
111 | in the Releases page.
112 | 1. Make sure that the `Publish this Action to the GitHub Marketplace`
113 | checkbox is enabled
114 |
115 | 
116 |
117 | 3. Click "Choose a tag" and then "Create new tag", where the tag name
118 | will be your version prefixed by a `v` (e.g. `v1.2.3`).
119 | 4. Use a version number for the release title (e.g. "1.2.3").
120 |
121 | 
122 |
123 | 5. Add your release notes. If this is a major version make sure to
124 | include a small description of the biggest changes in the new version.
125 | 6. Click "Publish Release".
126 |
127 | You now have a tag and release using the semver version you used
128 | above. The last remaining thing to do is to move the dynamic version
129 | identifier to match the current SHA. This allows users to adopt a
130 | major version number (e.g. `v1`) in their workflows while
131 | automatically getting all the
132 | minor/patch updates.
133 |
134 | To do this just checkout `main`, force-create a new annotated tag, and push it:
135 |
136 | ```
137 | git tag -fa v4 -m "Updating v4 to 4.0.1"
138 | git push origin v4 --force
139 | ```
140 |
141 |
142 |
143 | ## Resources
144 |
145 | - [Creating JavaScript GitHub actions](https://docs.github.com/en/actions/creating-actions/creating-a-javascript-action)
146 | - [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)
147 | - [Using Pull Requests](https://help.github.com/articles/about-pull-requests/)
148 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | The MIT License (MIT)
2 |
3 | Copyright (c) 2022 GitHub, Inc. and contributors
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in
13 | all copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
21 | THE SOFTWARE.
--------------------------------------------------------------------------------
/SECURITY.md:
--------------------------------------------------------------------------------
1 | If you discover a security issue in this repo, please submit it through the [GitHub Security Bug Bounty](https://bounty.github.com/)
2 |
3 | Thanks for helping make GitHub Actions safe for everyone.
4 |
--------------------------------------------------------------------------------
/__tests__/config.test.ts:
--------------------------------------------------------------------------------
1 | import {expect, test, beforeEach} from '@jest/globals'
2 | import {readConfig} from '../src/config'
3 | import {getRefs} from '../src/git-refs'
4 | import * as spdx from '../src/spdx'
5 | import {setInput, clearInputs} from './test-helpers'
6 |
7 | beforeEach(() => {
8 | clearInputs()
9 | })
10 |
11 | test('it defaults to low severity', async () => {
12 | const config = await readConfig()
13 | expect(config.fail_on_severity).toEqual('low')
14 | })
15 |
16 | test('it reads custom configs', async () => {
17 | setInput('fail-on-severity', 'critical')
18 | setInput('allow-licenses', 'ISC, GPL-2.0')
19 |
20 | const config = await readConfig()
21 | expect(config.fail_on_severity).toEqual('critical')
22 | expect(config.allow_licenses).toEqual(['ISC', 'GPL-2.0'])
23 | })
24 |
25 | test('it defaults to false for warn-only', async () => {
26 | const config = await readConfig()
27 | expect(config.warn_only).toEqual(false)
28 | })
29 |
30 | test('it defaults to empty allow/deny lists ', async () => {
31 | const config = await readConfig()
32 |
33 | expect(config.allow_licenses).toEqual(undefined)
34 | expect(config.deny_licenses).toEqual(undefined)
35 | })
36 |
37 | test('it raises an error if both an allow and denylist are specified', async () => {
38 | setInput('allow-licenses', 'MIT')
39 | setInput('deny-licenses', 'BSD-3-Clause')
40 |
41 | await expect(readConfig()).rejects.toThrow(
42 | 'You cannot specify both allow-licenses and deny-licenses'
43 | )
44 | })
45 | test('it raises an error if an empty allow list is specified', async () => {
46 | setInput('config-file', './__tests__/fixtures/config-empty-allow-sample.yml')
47 |
48 | await expect(readConfig()).rejects.toThrow(
49 | 'You should provide at least one license in allow-licenses'
50 | )
51 | })
52 |
53 | test('it successfully parses allow-dependencies-licenses', async () => {
54 | setInput(
55 | 'allow-dependencies-licenses',
56 | 'pkg:npm/@test/package@1.2.3,pkg:npm/example'
57 | )
58 | const config = await readConfig()
59 | expect(config.allow_dependencies_licenses).toEqual([
60 | 'pkg:npm/@test/package@1.2.3',
61 | 'pkg:npm/example'
62 | ])
63 | })
64 |
65 | test('it raises an error when an invalid package-url is used for allow-dependencies-licenses', async () => {
66 | setInput('allow-dependencies-licenses', 'not-a-purl')
67 | await expect(readConfig()).rejects.toThrow(`Error parsing package-url`)
68 | })
69 |
70 | test('it raises an error when a nameless package-url is used for allow-dependencies-licenses', async () => {
71 | setInput('allow-dependencies-licenses', 'pkg:npm/@namespace/')
72 | await expect(readConfig()).rejects.toThrow(
73 | `Error parsing package-url: name is required`
74 | )
75 | })
76 |
77 | test('it raises an error when an invalid package-url is used for deny-packages', async () => {
78 | setInput('deny-packages', 'not-a-purl')
79 |
80 | await expect(readConfig()).rejects.toThrow(`Error parsing package-url`)
81 | })
82 |
83 | test('it raises an error when a nameless package-url is used for deny-packages', async () => {
84 | setInput('deny-packages', 'pkg:npm/@namespace/')
85 |
86 | await expect(readConfig()).rejects.toThrow(
87 | `Error parsing package-url: name is required`
88 | )
89 | })
90 |
91 | test('it raises an error when an argument to deny-groups is missing a namespace', async () => {
92 | setInput('deny-groups', 'pkg:npm/my-fun-org')
93 |
94 | await expect(readConfig()).rejects.toThrow(
95 | `package-url must have a namespace`
96 | )
97 | })
98 |
99 | test('it raises an error when given an unknown severity', async () => {
100 | setInput('fail-on-severity', 'zombies')
101 |
102 | await expect(readConfig()).rejects.toThrow(/received 'zombies'/)
103 | })
104 |
105 | test('it uses the given refs when the event is not a pull request', async () => {
106 | setInput('base-ref', 'a-custom-base-ref')
107 | setInput('head-ref', 'a-custom-head-ref')
108 |
109 | const refs = getRefs(await readConfig(), {
110 | payload: {},
111 | eventName: 'workflow_dispatch'
112 | })
113 | expect(refs.base).toEqual('a-custom-base-ref')
114 | expect(refs.head).toEqual('a-custom-head-ref')
115 | })
116 |
117 | test('it raises an error when no refs are provided and the event is not a pull request', async () => {
118 | const config = await readConfig()
119 | expect(() =>
120 | getRefs(config, {
121 | payload: {},
122 | eventName: 'workflow_dispatch'
123 | })
124 | ).toThrow()
125 | })
126 |
127 | const pullRequestLikeEvents = ['pull_request', 'pull_request_target']
128 |
129 | test.each(pullRequestLikeEvents)(
130 | 'it uses the given refs even when the event is %s',
131 | async eventName => {
132 | setInput('base-ref', 'a-custom-base-ref')
133 | setInput('head-ref', 'a-custom-head-ref')
134 |
135 | const refs = getRefs(await readConfig(), {
136 | payload: {
137 | pull_request: {
138 | number: 42,
139 | base: {sha: 'pr-base-ref'},
140 | head: {sha: 'pr-head-ref'}
141 | }
142 | },
143 | eventName
144 | })
145 | expect(refs.base).toEqual('a-custom-base-ref')
146 | expect(refs.head).toEqual('a-custom-head-ref')
147 | }
148 | )
149 |
150 | test.each(pullRequestLikeEvents)(
151 | 'it uses the event refs when the event is %s and no refs are provided in config',
152 | async eventName => {
153 | const refs = getRefs(await readConfig(), {
154 | payload: {
155 | pull_request: {
156 | number: 42,
157 | base: {sha: 'pr-base-ref'},
158 | head: {sha: 'pr-head-ref'}
159 | }
160 | },
161 | eventName
162 | })
163 | expect(refs.base).toEqual('pr-base-ref')
164 | expect(refs.head).toEqual('pr-head-ref')
165 | }
166 | )
167 |
168 | test('it uses the given refs even when the event is merge_group', async () => {
169 | setInput('base-ref', 'a-custom-base-ref')
170 | setInput('head-ref', 'a-custom-head-ref')
171 |
172 | const refs = getRefs(await readConfig(), {
173 | payload: {
174 | merge_group: {
175 | base_sha: 'pr-base-ref',
176 | head_sha: 'pr-head-ref'
177 | }
178 | },
179 | eventName: 'merge_group'
180 | })
181 | expect(refs.base).toEqual('a-custom-base-ref')
182 | expect(refs.head).toEqual('a-custom-head-ref')
183 | })
184 |
185 | test('it uses the event refs when the event is merge_group and no refs are provided in config', async () => {
186 | const refs = getRefs(await readConfig(), {
187 | payload: {
188 | merge_group: {
189 | base_sha: 'pr-base-ref',
190 | head_sha: 'pr-head-ref'
191 | }
192 | },
193 | eventName: 'merge_group'
194 | })
195 | expect(refs.base).toEqual('pr-base-ref')
196 | expect(refs.head).toEqual('pr-head-ref')
197 | })
198 |
199 | test('it defaults to runtime scope', async () => {
200 | const config = await readConfig()
201 | expect(config.fail_on_scopes).toEqual(['runtime'])
202 | })
203 |
204 | test('it parses custom scopes preference', async () => {
205 | setInput('fail-on-scopes', 'runtime, development')
206 | let config = await readConfig()
207 | expect(config.fail_on_scopes).toEqual(['runtime', 'development'])
208 |
209 | clearInputs()
210 | setInput('fail-on-scopes', 'development')
211 | config = await readConfig()
212 | expect(config.fail_on_scopes).toEqual(['development'])
213 | })
214 |
215 | test('it raises an error when given invalid scope', async () => {
216 | setInput('fail-on-scopes', 'runtime, zombies')
217 | await expect(readConfig()).rejects.toThrow(/received 'zombies'/)
218 | })
219 |
220 | test('it defaults to an empty GHSA allowlist', async () => {
221 | const config = await readConfig()
222 | expect(config.allow_ghsas).toEqual([])
223 | })
224 |
225 | test('it successfully parses GHSA allowlist', async () => {
226 | setInput('allow-ghsas', 'GHSA-abcd-1234-5679, GHSA-efgh-1234-5679')
227 | const config = await readConfig()
228 | expect(config.allow_ghsas).toEqual([
229 | 'GHSA-abcd-1234-5679',
230 | 'GHSA-efgh-1234-5679'
231 | ])
232 | })
233 |
234 | test('it defaults to checking licenses', async () => {
235 | const config = await readConfig()
236 | expect(config.license_check).toBe(true)
237 | })
238 |
239 | test('it parses the license-check input', async () => {
240 | setInput('license-check', 'false')
241 | let config = await readConfig()
242 | expect(config.license_check).toEqual(false)
243 |
244 | clearInputs()
245 | setInput('license-check', 'true')
246 | config = await readConfig()
247 | expect(config.license_check).toEqual(true)
248 | })
249 |
250 | test('it defaults to checking vulnerabilities', async () => {
251 | const config = await readConfig()
252 | expect(config.vulnerability_check).toBe(true)
253 | })
254 |
255 | test('it parses the vulnerability-check input', async () => {
256 | setInput('vulnerability-check', 'false')
257 | let config = await readConfig()
258 | expect(config.vulnerability_check).toEqual(false)
259 |
260 | clearInputs()
261 | setInput('vulnerability-check', 'true')
262 | config = await readConfig()
263 | expect(config.vulnerability_check).toEqual(true)
264 | })
265 |
266 | test('it is not possible to disable both checks', async () => {
267 | setInput('license-check', 'false')
268 | setInput('vulnerability-check', 'false')
269 | await expect(readConfig()).rejects.toThrow(
270 | /Can't disable both license-check and vulnerability-check/
271 | )
272 | })
273 |
274 | describe('licenses that are not valid SPDX licenses', () => {
275 | test('it raises an error for invalid licenses in allow-licenses', async () => {
276 | setInput('allow-licenses', ' BSD-YOLO, GPL-2.0')
277 | await expect(readConfig()).rejects.toThrow(
278 | 'Invalid license(s) in allow-licenses: BSD-YOLO'
279 | )
280 | })
281 |
282 | test('it raises an error for invalid licenses in deny-licenses', async () => {
283 | setInput('deny-licenses', ' GPL-2.0, BSD-YOLO, Apache-2.0, ToIll')
284 | await expect(readConfig()).rejects.toThrow(
285 | 'Invalid license(s) in deny-licenses: BSD-YOLO, ToIll'
286 | )
287 | })
288 | })
289 |
290 | test('it parses the comment-summary-in-pr input', async () => {
291 | setInput('comment-summary-in-pr', 'true')
292 | let config = await readConfig()
293 | expect(config.comment_summary_in_pr).toBe('always')
294 |
295 | clearInputs()
296 | setInput('comment-summary-in-pr', 'false')
297 | config = await readConfig()
298 | expect(config.comment_summary_in_pr).toBe('never')
299 |
300 | clearInputs()
301 | setInput('comment-summary-in-pr', 'always')
302 | config = await readConfig()
303 | expect(config.comment_summary_in_pr).toBe('always')
304 |
305 | clearInputs()
306 | setInput('comment-summary-in-pr', 'never')
307 | config = await readConfig()
308 | expect(config.comment_summary_in_pr).toBe('never')
309 |
310 | clearInputs()
311 | setInput('comment-summary-in-pr', 'on-failure')
312 | config = await readConfig()
313 | expect(config.comment_summary_in_pr).toBe('on-failure')
314 | })
315 |
--------------------------------------------------------------------------------
/__tests__/deny.test.ts:
--------------------------------------------------------------------------------
1 | import {expect, jest, test} from '@jest/globals'
2 | import {Change, Changes} from '../src/schemas'
3 | import {createTestChange, createTestPURLs} from './fixtures/create-test-change'
4 | import {getDeniedChanges} from '../src/deny'
5 |
6 | jest.mock('@actions/core')
7 |
8 | const mockOctokit = {
9 | rest: {
10 | licenses: {
11 | getForRepo: jest
12 | .fn()
13 | .mockReturnValue({data: {license: {spdx_id: 'AGPL'}}})
14 | }
15 | }
16 | }
17 |
18 | let npmChange: Change
19 | let rubyChange: Change
20 | let pipChange: Change
21 | let mvnChange: Change
22 |
23 | jest.mock('octokit', () => {
24 | return {
25 | // eslint-disable-next-line @typescript-eslint/no-extraneous-class
26 | Octokit: class {
27 | constructor() {
28 | return mockOctokit
29 | }
30 | }
31 | }
32 | })
33 |
34 | beforeEach(async () => {
35 | jest.resetModules()
36 |
37 | npmChange = createTestChange({ecosystem: 'npm'})
38 | rubyChange = createTestChange({ecosystem: 'rubygems'})
39 | pipChange = createTestChange({ecosystem: 'pip'})
40 | mvnChange = createTestChange({ecosystem: 'maven'})
41 | })
42 |
43 | test('denies packages from the deny packages list', async () => {
44 | const changes: Changes = [npmChange, rubyChange]
45 | const deniedPackages = createTestPURLs(['pkg:gem/actionsomething@3.2.0'])
46 | const deniedChanges = await getDeniedChanges(changes, deniedPackages)
47 |
48 | expect(deniedChanges[0]).toBe(rubyChange)
49 | expect(deniedChanges.length).toEqual(1)
50 | })
51 |
52 | test('denies packages only for the specified version from deny packages list', async () => {
53 | const deniedPackageWithDifferentVersion = createTestPURLs([
54 | 'pkg:npm/lodash@1.2.3'
55 | ])
56 | const changes: Changes = [npmChange]
57 | const deniedChanges = await getDeniedChanges(
58 | changes,
59 | deniedPackageWithDifferentVersion
60 | )
61 |
62 | expect(deniedChanges.length).toEqual(0)
63 | })
64 |
65 | test('if no specified version from deny packages list, it will treat package as wildcard and deny all versions', async () => {
66 | const changes: Changes = [
67 | createTestChange({name: 'lodash', version: '1.2.3'}),
68 | createTestChange({name: 'lodash', version: '4.5.6'}),
69 | createTestChange({name: 'lodash', version: '7.8.9'})
70 | ]
71 | const denyAllLodashVersions = createTestPURLs(['pkg:npm/lodash'])
72 | const deniedChanges = await getDeniedChanges(changes, denyAllLodashVersions)
73 |
74 | expect(deniedChanges.length).toEqual(3)
75 | })
76 |
77 | test('denies packages from the deny group list', async () => {
78 | const changes: Changes = [mvnChange, rubyChange]
79 | const deniedGroups = createTestPURLs(['pkg:maven/org.apache.logging.log4j/'])
80 | const deniedChanges = await getDeniedChanges(changes, [], deniedGroups)
81 |
82 | expect(deniedChanges[0]).toBe(mvnChange)
83 | expect(deniedChanges.length).toEqual(1)
84 | })
85 |
86 | test('denies packages that match the deny group list exactly', async () => {
87 | const changes: Changes = [
88 | createTestChange({
89 | package_url: 'pkg:npm/org.test.pass/pass-this@1.0.0',
90 | ecosystem: 'npm'
91 | }),
92 | createTestChange({
93 | package_url: 'pkg:npm/org.test/deny-this@1.0.0',
94 | ecosystem: 'npm'
95 | })
96 | ]
97 | const deniedGroups = createTestPURLs(['pkg:npm/org.test/'])
98 | const deniedChanges = await getDeniedChanges(changes, [], deniedGroups)
99 |
100 | expect(deniedChanges.length).toEqual(1)
101 | expect(deniedChanges[0]).toBe(changes[1])
102 | })
103 |
104 | test(`denies packages using the namespace from the name when there's no package_url`, async () => {
105 | const changes: Changes = [
106 | createTestChange({
107 | package_url: 'pkg:npm/org.test.pass/pass-this@1.0.0',
108 | ecosystem: 'npm'
109 | }),
110 | createTestChange({
111 | name: 'org.test:deny-this',
112 | package_url: '',
113 | ecosystem: 'maven'
114 | })
115 | ]
116 | const deniedGroups = createTestPURLs(['pkg:maven/org.test/'])
117 | const deniedChanges = await getDeniedChanges(changes, [], deniedGroups)
118 |
119 | expect(deniedChanges.length).toEqual(1)
120 | expect(deniedChanges[0]).toBe(changes[1])
121 | })
122 |
123 | test('allows packages not defined in the deny packages and groups list', async () => {
124 | const changes: Changes = [npmChange, pipChange]
125 | const deniedPackages = createTestPURLs([
126 | 'pkg:gem/package-not-in-changes@1.0.0'
127 | ])
128 | const deniedGroups = createTestPURLs(['pkg:maven/group.not.in.changes/'])
129 | const deniedChanges = await getDeniedChanges(
130 | changes,
131 | deniedPackages,
132 | deniedGroups
133 | )
134 |
135 | expect(deniedChanges.length).toEqual(0)
136 | })
137 |
138 | test('deny packages does not prevent removal of denied packages', async () => {
139 | const changes: Changes = [
140 | createTestChange({
141 | change_type: 'added',
142 | name: 'deny-by-name-and-version',
143 | version: '1.0.0',
144 | ecosystem: 'npm'
145 | }),
146 | createTestChange({
147 | change_type: 'removed',
148 | name: 'pass-by-name-and-version',
149 | version: '1.0.0',
150 | ecosystem: 'npm'
151 | }),
152 | createTestChange({
153 | change_type: 'added',
154 | name: 'deny-by-name',
155 | version: '1.0.0',
156 | ecosystem: 'npm'
157 | }),
158 | createTestChange({
159 | change_type: 'removed',
160 | name: 'pass-by-name',
161 | version: '1.0.0',
162 | ecosystem: 'npm'
163 | }),
164 | createTestChange({
165 | change_type: 'added',
166 | package_url: 'pkg:npm/org.test.deny.by.namespace/only@1.0.0',
167 | ecosystem: 'npm'
168 | }),
169 | createTestChange({
170 | change_type: 'removed',
171 | package_url: 'pkg:npm/org.test.pass.by.namespace/only@1.0.0',
172 | ecosystem: 'npm'
173 | })
174 | ]
175 | const deniedPackages = createTestPURLs([
176 | 'pkg:npm/org.test.deny.by/deny-by-name-and-version@1.0.0',
177 | 'pkg:npm/org.test.pass.by/pass-by-name-and-version@1.0.0',
178 | 'pkg:npm/org.test.deny.by/deny-by-name',
179 | 'pkg:npm/org.test.pass.by/pass-by-name'
180 | ])
181 | const deniedGroups = createTestPURLs([
182 | 'pkg:npm/org.test.deny.by.namespace/',
183 | 'pkg:npm/org.test.pass.by.namespace/'
184 | ])
185 | const deniedChanges = await getDeniedChanges(
186 | changes,
187 | deniedPackages,
188 | deniedGroups
189 | )
190 |
191 | expect(deniedChanges.length).toEqual(3)
192 | expect(deniedChanges[0]).toBe(changes[0])
193 | expect(deniedChanges[1]).toBe(changes[2])
194 | expect(deniedChanges[2]).toBe(changes[4])
195 | })
196 |
--------------------------------------------------------------------------------
/__tests__/dependency-graph.test.ts:
--------------------------------------------------------------------------------
1 | import {RequestError} from '@octokit/request-error'
2 | import * as dependencyGraph from '../src/dependency-graph'
3 | import * as core from '@actions/core'
4 |
5 | // mock call to core.getInput('repo-token'.. to avoid environment setup - Input required and not supplied: repo-token
6 | jest.mock('@actions/core', () => ({
7 | getInput: (input: string) => {
8 | if (input === 'repo-token') {
9 | return 'gh_testtoken'
10 | }
11 | }
12 | }))
13 |
14 | test('it properly catches RequestError type', async () => {
15 | const token = core.getInput('repo-token', {required: true})
16 | expect(token).toBe('gh_testtoken')
17 |
18 | //Integration test to make an API request using current dependencies and ensure response can parse into RequestError
19 | try {
20 | await dependencyGraph.compare({
21 | owner: 'actions',
22 | repo: 'dependency-review-action',
23 | baseRef: 'refs/heads/master',
24 | headRef: 'refs/heads/master'
25 | })
26 | } catch (error) {
27 | expect(error).toBeInstanceOf(RequestError)
28 | }
29 | })
30 |
--------------------------------------------------------------------------------
/__tests__/external-config.test.ts:
--------------------------------------------------------------------------------
1 | import {expect, test, beforeEach} from '@jest/globals'
2 | import {readConfig} from '../src/config'
3 | import * as spdx from '../src/spdx'
4 | import {setInput, clearInputs} from './test-helpers'
5 |
6 | const externalConfig = `fail_on_severity: 'high'
7 | allow_licenses: ['GPL-2.0-only']
8 | `
9 | const mockOctokit = {
10 | rest: {
11 | repos: {
12 | getContent: jest.fn().mockReturnValue({data: externalConfig})
13 | }
14 | }
15 | }
16 |
17 | jest.mock('octokit', () => {
18 | return {
19 | // eslint-disable-next-line @typescript-eslint/no-extraneous-class
20 | Octokit: class {
21 | constructor() {
22 | return mockOctokit
23 | }
24 | }
25 | }
26 | })
27 |
28 | beforeEach(() => {
29 | clearInputs()
30 | })
31 |
32 | test('it reads an external config file', async () => {
33 | setInput('config-file', './__tests__/fixtures/config-allow-sample.yml')
34 |
35 | const config = await readConfig()
36 | expect(config.fail_on_severity).toEqual('critical')
37 | expect(config.allow_licenses).toEqual(['BSD-3-Clause', 'GPL-2.0'])
38 | })
39 |
40 | test('raises an error when the config file was not found', async () => {
41 | setInput('config-file', 'fixtures/i-dont-exist')
42 | await expect(readConfig()).rejects.toThrow(/Unable to fetch/)
43 | })
44 |
45 | test('it parses options from both sources', async () => {
46 | setInput('config-file', './__tests__/fixtures/config-allow-sample.yml')
47 |
48 | let config = await readConfig()
49 | expect(config.fail_on_severity).toEqual('critical')
50 |
51 | setInput('base-ref', 'a-custom-base-ref')
52 | config = await readConfig()
53 | expect(config.base_ref).toEqual('a-custom-base-ref')
54 | })
55 |
56 | test('in case of conflicts, the inline config is the source of truth', async () => {
57 | setInput('fail-on-severity', 'low')
58 | setInput('config-file', './__tests__/fixtures/config-allow-sample.yml') // this will set fail-on-severity to 'critical'
59 |
60 | const config = await readConfig()
61 | expect(config.fail_on_severity).toEqual('low')
62 | })
63 |
64 | test('it uses the default values when loading external files', async () => {
65 | setInput('config-file', './__tests__/fixtures/no-licenses-config.yml')
66 | let config = await readConfig()
67 | expect(config.allow_licenses).toEqual(undefined)
68 | expect(config.deny_licenses).toEqual(undefined)
69 |
70 | setInput('config-file', './__tests__/fixtures/license-config-sample.yml')
71 | config = await readConfig()
72 | expect(config.fail_on_severity).toEqual('low')
73 | })
74 |
75 | test('it accepts an external configuration filename', async () => {
76 | setInput('config-file', './__tests__/fixtures/no-licenses-config.yml')
77 | const config = await readConfig()
78 | expect(config.fail_on_severity).toEqual('critical')
79 | })
80 |
81 | test('it raises an error when given an unknown severity in an external config file', async () => {
82 | setInput('config-file', './__tests__/fixtures/invalid-severity-config.yml')
83 | await expect(readConfig()).rejects.toThrow()
84 | })
85 |
86 | test('it supports comma-separated lists', async () => {
87 | setInput(
88 | 'config-file',
89 | './__tests__/fixtures/inline-license-config-sample.yml'
90 | )
91 | const config = await readConfig()
92 |
93 | expect(config.allow_licenses).toEqual(['MIT', 'GPL-2.0-only'])
94 | })
95 |
96 | test('it reads a config file hosted in another repo', async () => {
97 | setInput(
98 | 'config-file',
99 | 'future-funk/anyone-cualkiera/external-config.yml@main'
100 | )
101 | setInput('external-repo-token', 'gh_viptoken')
102 |
103 | const config = await readConfig()
104 |
105 | expect(config.fail_on_severity).toEqual('high')
106 | expect(config.allow_licenses).toEqual(['GPL-2.0-only'])
107 | })
108 |
--------------------------------------------------------------------------------
/__tests__/filter.test.ts:
--------------------------------------------------------------------------------
1 | import {expect, test} from '@jest/globals'
2 | import {Change} from '../src/schemas'
3 | import {
4 | filterChangesBySeverity,
5 | filterChangesByScopes,
6 | filterAllowedAdvisories
7 | } from '../src/filter'
8 |
9 | const npmChange: Change = {
10 | manifest: 'package.json',
11 | change_type: 'added',
12 | ecosystem: 'npm',
13 | name: 'Reeuhq',
14 | version: '1.0.2',
15 | package_url: 'pkg:npm/reeuhq@1.0.2',
16 | license: 'MIT',
17 | source_repository_url: 'github.com/some-repo',
18 | scope: 'runtime',
19 | vulnerabilities: [
20 | {
21 | severity: 'critical',
22 | advisory_ghsa_id: 'vulnerable-ghsa-id',
23 | advisory_summary: 'very dangerous',
24 | advisory_url: 'github.com/future-funk'
25 | }
26 | ]
27 | }
28 |
29 | const rubyChange: Change = {
30 | change_type: 'added',
31 | manifest: 'Gemfile.lock',
32 | ecosystem: 'rubygems',
33 | name: 'actionsomething',
34 | version: '3.2.0',
35 | package_url: 'pkg:gem/actionsomething@3.2.0',
36 | license: 'BSD',
37 | source_repository_url: 'github.com/some-repo',
38 | scope: 'development',
39 | vulnerabilities: [
40 | {
41 | severity: 'moderate',
42 | advisory_ghsa_id: 'moderate-ghsa-id',
43 | advisory_summary: 'not so dangerous',
44 | advisory_url: 'github.com/future-funk'
45 | },
46 | {
47 | severity: 'low',
48 | advisory_ghsa_id: 'low-ghsa-id',
49 | advisory_summary: 'dont page me',
50 | advisory_url: 'github.com/future-funk'
51 | }
52 | ]
53 | }
54 |
55 | const noVulnNpmChange: Change = {
56 | manifest: 'package.json',
57 | change_type: 'added',
58 | ecosystem: 'npm',
59 | name: 'helpful',
60 | version: '1.0.0',
61 | package_url: 'pkg:npm/helpful@1.0.0',
62 | license: 'MIT',
63 | source_repository_url: 'github.com/some-repo',
64 | scope: 'runtime',
65 | vulnerabilities: []
66 | }
67 |
68 | const lodashChange: Change = {
69 | change_type: 'added',
70 | manifest: 'package.json',
71 | ecosystem: 'npm',
72 | name: 'lodash',
73 | version: '4.17.0',
74 | package_url: 'pkg:npm/lodash@4.17.0',
75 | license: 'MIT',
76 | source_repository_url: 'https://github.com/lodash/lodash',
77 | scope: 'runtime',
78 | vulnerabilities: [
79 | {
80 | severity: 'critical',
81 | advisory_ghsa_id: 'GHSA-jf85-cpcp-j695',
82 | advisory_summary: 'Prototype Pollution in lodash',
83 | advisory_url: 'https://github.com/advisories/GHSA-jf85-cpcp-j695'
84 | },
85 | {
86 | severity: 'high',
87 | advisory_ghsa_id: 'GHSA-4xc9-xhrj-v574',
88 | advisory_summary: 'Prototype Pollution in lodash',
89 | advisory_url: 'https://github.com/advisories/GHSA-4xc9-xhrj-v574'
90 | },
91 | {
92 | severity: 'high',
93 | advisory_ghsa_id: 'GHSA-35jh-r3h4-6jhm',
94 | advisory_summary: 'Command Injection in lodash',
95 | advisory_url: 'https://github.com/advisories/GHSA-35jh-r3h4-6jhm'
96 | },
97 | {
98 | severity: 'high',
99 | advisory_ghsa_id: 'GHSA-p6mc-m468-83gw',
100 | advisory_summary: 'Prototype Pollution in lodash',
101 | advisory_url: 'https://github.com/advisories/GHSA-p6mc-m468-83gw'
102 | },
103 | {
104 | severity: 'moderate',
105 | advisory_ghsa_id: 'GHSA-x5rq-j2xg-h7qm',
106 | advisory_summary:
107 | 'Regular Expression Denial of Service (ReDoS) in lodash',
108 | advisory_url: 'https://github.com/advisories/GHSA-x5rq-j2xg-h7qm'
109 | },
110 | {
111 | severity: 'moderate',
112 | advisory_ghsa_id: 'GHSA-29mw-wpgm-hmr9',
113 | advisory_summary:
114 | 'Regular Expression Denial of Service (ReDoS) in lodash',
115 | advisory_url: 'https://github.com/advisories/GHSA-29mw-wpgm-hmr9'
116 | },
117 | {
118 | severity: 'low',
119 | advisory_ghsa_id: 'GHSA-fvqr-27wr-82fm',
120 | advisory_summary: 'Prototype Pollution in lodash',
121 | advisory_url: 'https://github.com/advisories/GHSA-fvqr-27wr-82fm'
122 | }
123 | ]
124 | }
125 |
126 | test('it properly filters changes by severity', async () => {
127 | const changes = [npmChange, rubyChange]
128 | let result = filterChangesBySeverity('high', changes)
129 | expect(result).toEqual([npmChange])
130 |
131 | result = filterChangesBySeverity('low', changes)
132 | expect(changes).toEqual([npmChange, rubyChange])
133 |
134 | result = filterChangesBySeverity('critical', changes)
135 | expect(changes).toEqual([npmChange, rubyChange])
136 | })
137 |
138 | test('it properly filters changes by scope', async () => {
139 | const changes = [npmChange, rubyChange]
140 |
141 | let result = filterChangesByScopes(['runtime'], changes)
142 | expect(result).toEqual([npmChange])
143 |
144 | result = filterChangesByScopes(['development'], changes)
145 | expect(result).toEqual([rubyChange])
146 |
147 | result = filterChangesByScopes(['runtime', 'development'], changes)
148 | expect(result).toEqual([npmChange, rubyChange])
149 | })
150 |
151 | test('it properly handles undefined advisory IDs', async () => {
152 | const changes = [npmChange, rubyChange, noVulnNpmChange]
153 | const result = filterAllowedAdvisories(undefined, changes)
154 | expect(result).toEqual([npmChange, rubyChange, noVulnNpmChange])
155 | })
156 |
157 | test('it properly filters changes with allowed vulnerabilities', async () => {
158 | const changes = [npmChange, rubyChange, noVulnNpmChange]
159 |
160 | const fakeGHSAChanges = filterAllowedAdvisories(['notrealGHSAID'], changes)
161 | expect(fakeGHSAChanges).toEqual([npmChange, rubyChange, noVulnNpmChange])
162 | })
163 |
164 | test('it properly filters only allowed vulnerabilities', async () => {
165 | const changes = [npmChange, rubyChange, noVulnNpmChange]
166 | const oldVulns = [
167 | ...npmChange.vulnerabilities,
168 | ...rubyChange.vulnerabilities,
169 | ...noVulnNpmChange.vulnerabilities
170 | ]
171 |
172 | const vulnerable = filterAllowedAdvisories(['vulnerable-ghsa-id'], changes)
173 |
174 | const newVulns = vulnerable.map(change => change.vulnerabilities).flat()
175 |
176 | expect(newVulns.length).toEqual(oldVulns.length - 1)
177 | expect(newVulns).not.toContainEqual(
178 | expect.objectContaining({advisory_ghsa_id: 'vulnerable-ghsa-id'})
179 | )
180 | })
181 |
182 | test('does not drop dependencies when filtering by GHSA', async () => {
183 | const changes = [npmChange, rubyChange, noVulnNpmChange]
184 | const result = filterAllowedAdvisories(
185 | ['moderate-ghsa-id', 'low-ghsa-id', 'GHSA-jf85-cpcp-j695'],
186 | changes
187 | )
188 |
189 | expect(result.map(change => change.name)).toEqual(
190 | changes.map(change => change.name)
191 | )
192 | })
193 |
194 | test('it properly filters multiple GHSAs', async () => {
195 | const allowedGHSAs = ['vulnerable-ghsa-id', 'moderate-ghsa-id', 'low-ghsa-id']
196 | const changes = [npmChange, rubyChange, noVulnNpmChange]
197 | const oldVulns = changes.map(change => change.vulnerabilities).flat()
198 |
199 | const result = filterAllowedAdvisories(allowedGHSAs, changes)
200 |
201 | const newVulns = result.map(change => change.vulnerabilities).flat()
202 |
203 | expect(newVulns.length).toEqual(oldVulns.length - 3)
204 | })
205 |
206 | test('it filters out GHSA dependencies', async () => {
207 | const lodash = filterAllowedAdvisories(
208 | ['GHSA-jf85-cpcp-j695'],
209 | [lodashChange]
210 | )[0]
211 | // the filter should have removed a single GHSA from the list
212 | const expected = lodashChange.vulnerabilities.filter(
213 | vuln => vuln.advisory_ghsa_id !== 'GHSA-jf85-cpcp-j695'
214 | )
215 | expect(expected.length).toEqual(lodashChange.vulnerabilities.length - 1)
216 | expect(lodash.vulnerabilities).toEqual(expected)
217 | })
218 |
--------------------------------------------------------------------------------
/__tests__/fixtures/config-allow-sample.yml:
--------------------------------------------------------------------------------
1 | fail_on_severity: critical
2 | allow_licenses:
3 | - 'BSD-3-Clause'
4 | - 'GPL-2.0'
5 |
--------------------------------------------------------------------------------
/__tests__/fixtures/config-empty-allow-sample.yml:
--------------------------------------------------------------------------------
1 | fail_on_severity: critical
2 | allow_licenses: []
3 |
--------------------------------------------------------------------------------
/__tests__/fixtures/conflictive-config.yml:
--------------------------------------------------------------------------------
1 | allow_licenses: []
2 | deny_licenses: []
3 |
--------------------------------------------------------------------------------
/__tests__/fixtures/create-test-change.ts:
--------------------------------------------------------------------------------
1 | import {Change} from '../../src/schemas'
2 | import {createTestVulnerability} from './create-test-vulnerability'
3 | import {PackageURL, parsePURL} from '../../src/purl'
4 |
5 | const defaultNpmChange: Change = {
6 | change_type: 'added',
7 | manifest: 'package.json',
8 | ecosystem: 'npm',
9 | name: 'lodash',
10 | version: '4.17.20',
11 | package_url: 'pkg:npm/lodash@4.17.20',
12 | license: 'MIT',
13 | source_repository_url: 'https://github.com/lodash/lodash',
14 | scope: 'runtime',
15 | vulnerabilities: [
16 | createTestVulnerability({
17 | severity: 'high',
18 | advisory_ghsa_id: 'GHSA-35jh-r3h4-6jhm',
19 | advisory_summary: 'Command Injection in lodash',
20 | advisory_url: 'https://github.com/advisories/GHSA-35jh-r3h4-6jhm'
21 | }),
22 | createTestVulnerability({
23 | severity: 'moderate',
24 | advisory_ghsa_id: 'GHSA-29mw-wpgm-hmr9',
25 | advisory_summary:
26 | 'Regular Expression Denial of Service (ReDoS) in lodash',
27 | advisory_url: 'https://github.com/advisories/GHSA-29mw-wpgm-hmr9'
28 | })
29 | ]
30 | }
31 |
32 | const defaultRubyChange: Change = {
33 | change_type: 'added',
34 | manifest: 'Gemfile.lock',
35 | ecosystem: 'rubygems',
36 | name: 'actionsomething',
37 | version: '3.2.0',
38 | package_url: 'pkg:gem/actionsomething@3.2.0',
39 | license: 'BSD',
40 | source_repository_url: 'github.com/some-repo',
41 | scope: 'runtime',
42 | vulnerabilities: [
43 | {
44 | severity: 'moderate',
45 | advisory_ghsa_id: 'second-random_string',
46 | advisory_summary: 'not so dangerous',
47 | advisory_url: 'github.com/future-funk'
48 | },
49 | {
50 | severity: 'low',
51 | advisory_ghsa_id: 'third-random_string',
52 | advisory_summary: 'dont page me',
53 | advisory_url: 'github.com/future-funk'
54 | }
55 | ]
56 | }
57 |
58 | const defaultPipChange: Change = {
59 | change_type: 'added',
60 | manifest: 'requirements.txt',
61 | ecosystem: 'pip',
62 | name: 'package-1',
63 | version: '1.1.1',
64 | package_url: 'pkg:pypi/package-1@1.1.1',
65 | license: 'MIT',
66 | source_repository_url: 'github.com/some-repo',
67 | scope: 'runtime',
68 | vulnerabilities: [
69 | {
70 | severity: 'moderate',
71 | advisory_ghsa_id: 'second-random_string',
72 | advisory_summary: 'not so dangerous',
73 | advisory_url: 'github.com/future-funk'
74 | },
75 | {
76 | severity: 'low',
77 | advisory_ghsa_id: 'third-random_string',
78 | advisory_summary: 'dont page me',
79 | advisory_url: 'github.com/future-funk'
80 | }
81 | ]
82 | }
83 |
84 | const defaultMavenChange: Change = {
85 | change_type: 'added',
86 | manifest: 'pom.xml',
87 | ecosystem: 'maven',
88 | name: 'org.apache.logging.log4j:log4j-core',
89 | version: '2.15.0',
90 | package_url: 'pkg:maven/org.apache.logging.log4j/log4j-core@2.14.7',
91 | license: 'Apache-2.0',
92 | source_repository_url:
93 | 'https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core',
94 | scope: 'unknown',
95 | vulnerabilities: [
96 | {
97 | severity: 'critical',
98 | advisory_ghsa_id: 'second-random_string',
99 | advisory_summary: 'not so dangerous',
100 | advisory_url: 'github.com/future-funk'
101 | }
102 | ]
103 | }
104 |
105 | const ecosystemToDefaultChange: {[key: string]: Change} = {
106 | npm: defaultNpmChange,
107 | rubygems: defaultRubyChange,
108 | pip: defaultPipChange,
109 | maven: defaultMavenChange
110 | }
111 |
112 | const createTestChange = (overwrites: Partial
116 |
117 | 3. Click "Choose a tag" and then "Create new tag", where the tag name
118 | will be your version prefixed by a `v` (e.g. `v1.2.3`).
119 | 4. Use a version number for the release title (e.g. "1.2.3").
120 |
121 |
122 |
123 | 5. Add your release notes. If this is a major version make sure to
124 | include a small description of the biggest changes in the new version.
125 | 6. Click "Publish Release".
126 |
127 | You now have a tag and release using the semver version you used
128 | above. The last remaining thing to do is to move the dynamic version
129 | identifier to match the current SHA. This allows users to adopt a
130 | major version number (e.g. `v1`) in their workflows while
131 | automatically getting all the
132 | minor/patch updates.
133 |
134 | To do this just checkout `main`, force-create a new annotated tag, and push it:
135 |
136 | ```
137 | git tag -fa v4 -m "Updating v4 to 4.0.1"
138 | git push origin v4 --force
139 | ```
140 | Dependency Review
') 110 | }) 111 | 112 | test('returns minimal summary formatted for posting as a PR comment', () => { 113 | const OLD_ENV = process.env 114 | 115 | let changes: Changes = [ 116 | createTestChange({name: 'lodash', version: '1.2.3'}), 117 | createTestChange({name: 'colors', version: '2.3.4'}), 118 | createTestChange({name: '@foo/bar', version: '*'}) 119 | ] 120 | 121 | process.env.GITHUB_SERVER_URL = 'https://github.com' 122 | process.env.GITHUB_REPOSITORY = 'owner/repo' 123 | process.env.GITHUB_RUN_ID = 'abc-123-xyz' 124 | 125 | let minSummary: string = summary.addSummaryToSummary( 126 | changes, 127 | emptyInvalidLicenseChanges, 128 | emptyChanges, 129 | scorecard, 130 | defaultConfig 131 | ) 132 | 133 | process.env = OLD_ENV 134 | 135 | // note: no Actions context values in unit test env 136 | const expected = ` 137 | # Dependency Review 138 | The following issues were found: 139 | * ❌ 3 vulnerable package(s) 140 | * ✅ 0 package(s) with incompatible licenses 141 | * ✅ 0 package(s) with invalid SPDX license definitions 142 | * ✅ 0 package(s) with unknown licenses. 143 | 144 | [View full job summary](https://github.com/owner/repo/actions/runs/abc-123-xyz) 145 | `.trim() 146 | 147 | expect(minSummary).toEqual(expected) 148 | }) 149 | 150 | test('only includes "No vulnerabilities or license issues found"-message if both are configured and nothing was found', () => { 151 | summary.addSummaryToSummary( 152 | emptyChanges, 153 | emptyInvalidLicenseChanges, 154 | emptyChanges, 155 | emptyScorecard, 156 | defaultConfig 157 | ) 158 | const text = core.summary.stringify() 159 | 160 | expect(text).toContain('✅ No vulnerabilities or license issues found.') 161 | }) 162 | 163 | test('only includes "No vulnerabilities found"-message if "license_check" is set to false and nothing was found', () => { 164 | const config = {...defaultConfig, license_check: false} 165 | summary.addSummaryToSummary( 166 | emptyChanges, 167 | emptyInvalidLicenseChanges, 168 | emptyChanges, 169 | emptyScorecard, 170 | config 171 | ) 172 | const text = core.summary.stringify() 173 | 174 | expect(text).toContain('✅ No vulnerabilities found.') 175 | }) 176 | 177 | test('only includes "No license issues found"-message if "vulnerability_check" is set to false and nothing was found', () => { 178 | const config = {...defaultConfig, vulnerability_check: false} 179 | summary.addSummaryToSummary( 180 | emptyChanges, 181 | emptyInvalidLicenseChanges, 182 | emptyChanges, 183 | emptyScorecard, 184 | config 185 | ) 186 | const text = core.summary.stringify() 187 | 188 | expect(text).toContain('✅ No license issues found.') 189 | }) 190 | 191 | test('groups dependencies with empty manifest paths together', () => { 192 | summary.addSummaryToSummary( 193 | changesWithEmptyManifests, 194 | emptyInvalidLicenseChanges, 195 | emptyChanges, 196 | emptyScorecard, 197 | defaultConfig 198 | ) 199 | summary.addScannedFiles(changesWithEmptyManifests) 200 | const text = core.summary.stringify() 201 | expect(text).toContain('Unnamed Manifest') 202 | expect(text).toContain('python/dist-info/METADATA') 203 | }) 204 | 205 | test('does not include status section if nothing was found', () => { 206 | summary.addSummaryToSummary( 207 | emptyChanges, 208 | emptyInvalidLicenseChanges, 209 | emptyChanges, 210 | emptyScorecard, 211 | defaultConfig 212 | ) 213 | const text = core.summary.stringify() 214 | 215 | expect(text).not.toContain('The following issues were found:') 216 | }) 217 | 218 | test('includes count and status icons for all findings', () => { 219 | const vulnerabilities = [ 220 | createTestChange({name: 'lodash'}), 221 | createTestChange({name: 'underscore', package_url: 'test-url'}) 222 | ] 223 | const licenseIssues = { 224 | forbidden: [createTestChange()], 225 | unresolved: [createTestChange(), createTestChange()], 226 | unlicensed: [createTestChange(), createTestChange(), createTestChange()] 227 | } 228 | 229 | summary.addSummaryToSummary( 230 | vulnerabilities, 231 | licenseIssues, 232 | emptyChanges, 233 | emptyScorecard, 234 | defaultConfig 235 | ) 236 | 237 | const text = core.summary.stringify() 238 | expect(text).toContain('❌ 2 vulnerable package(s)') 239 | expect(text).toContain( 240 | '❌ 2 package(s) with invalid SPDX license definitions' 241 | ) 242 | expect(text).toContain('❌ 1 package(s) with incompatible licenses') 243 | expect(text).toContain('⚠️ 3 package(s) with unknown licenses') 244 | }) 245 | 246 | test('uses checkmarks for license issues if only vulnerabilities were found', () => { 247 | const vulnerabilities = [createTestChange()] 248 | 249 | summary.addSummaryToSummary( 250 | vulnerabilities, 251 | emptyInvalidLicenseChanges, 252 | emptyChanges, 253 | emptyScorecard, 254 | defaultConfig 255 | ) 256 | 257 | const text = core.summary.stringify() 258 | expect(text).toContain('❌ 1 vulnerable package(s)') 259 | expect(text).toContain( 260 | '✅ 0 package(s) with invalid SPDX license definitions' 261 | ) 262 | expect(text).toContain('✅ 0 package(s) with incompatible licenses') 263 | expect(text).toContain('✅ 0 package(s) with unknown licenses') 264 | }) 265 | 266 | test('uses checkmarks for vulnerabilities if only license issues were found', () => { 267 | const licenseIssues = { 268 | forbidden: [createTestChange()], 269 | unresolved: [], 270 | unlicensed: [] 271 | } 272 | 273 | summary.addSummaryToSummary( 274 | emptyChanges, 275 | licenseIssues, 276 | emptyChanges, 277 | emptyScorecard, 278 | defaultConfig 279 | ) 280 | 281 | const text = core.summary.stringify() 282 | expect(text).toContain('✅ 0 vulnerable package(s)') 283 | expect(text).toContain( 284 | '✅ 0 package(s) with invalid SPDX license definitions' 285 | ) 286 | expect(text).toContain('❌ 1 package(s) with incompatible licenses') 287 | expect(text).toContain('✅ 0 package(s) with unknown licenses') 288 | }) 289 | 290 | test('addChangeVulnerabilitiesToSummary() - only includes section if any vulnerabilites found', () => { 291 | summary.addChangeVulnerabilitiesToSummary(emptyChanges, 'low') 292 | const text = core.summary.stringify() 293 | expect(text).toEqual('') 294 | }) 295 | 296 | test('addChangeVulnerabilitiesToSummary() - includes all vulnerabilities', () => { 297 | const changes = [ 298 | createTestChange({name: 'lodash'}), 299 | createTestChange({name: 'underscore', package_url: 'test-url'}) 300 | ] 301 | 302 | summary.addChangeVulnerabilitiesToSummary(changes, 'low') 303 | 304 | const text = core.summary.stringify() 305 | expect(text).toContain('Vulnerabilities
') 306 | expect(text).toContain('lodash') 307 | expect(text).toContain('underscore') 308 | }) 309 | 310 | test('addChangeVulnerabilitiesToSummary() - includes advisory url if available', () => { 311 | const changes = [ 312 | createTestChange({ 313 | name: 'underscore', 314 | vulnerabilities: [ 315 | createTestVulnerability({ 316 | advisory_summary: 'test-summary', 317 | advisory_url: 'test-url' 318 | }) 319 | ] 320 | }) 321 | ] 322 | 323 | summary.addChangeVulnerabilitiesToSummary(changes, 'low') 324 | 325 | const text = core.summary.stringify() 326 | expect(text).toContain('lodash') 327 | expect(text).toContain('test-summary') 328 | }) 329 | 330 | test('addChangeVulnerabilitiesToSummary() - groups vulnerabilities of a single package', () => { 331 | const changes = [ 332 | createTestChange({ 333 | name: 'package-with-multiple-vulnerabilities', 334 | vulnerabilities: [ 335 | createTestVulnerability({advisory_summary: 'test-summary-1'}), 336 | createTestVulnerability({advisory_summary: 'test-summary-2'}) 337 | ] 338 | }) 339 | ] 340 | 341 | summary.addChangeVulnerabilitiesToSummary(changes, 'low') 342 | 343 | const text = core.summary.stringify() 344 | expect(text.match('package-with-multiple-vulnerabilities')).toHaveLength(1) 345 | expect(text).toContain('test-summary-1') 346 | expect(text).toContain('test-summary-2') 347 | }) 348 | 349 | test('addChangeVulnerabilitiesToSummary() - prints severity statement if above low', () => { 350 | const changes = [createTestChange()] 351 | 352 | summary.addChangeVulnerabilitiesToSummary(changes, 'medium') 353 | 354 | const text = core.summary.stringify() 355 | expect(text).toContain( 356 | 'Only included vulnerabilities with severity medium or higher.' 357 | ) 358 | }) 359 | 360 | test('addChangeVulnerabilitiesToSummary() - does not print severity statment if it is set to "low"', () => { 361 | const changes = [createTestChange()] 362 | 363 | summary.addChangeVulnerabilitiesToSummary(changes, 'low') 364 | 365 | const text = core.summary.stringify() 366 | expect(text).not.toContain('Only included vulnerabilities') 367 | }) 368 | 369 | test('addLicensesToSummary() - does not include entire section if no license issues found', () => { 370 | summary.addLicensesToSummary(emptyInvalidLicenseChanges, defaultConfig) 371 | const text = core.summary.stringify() 372 | expect(text).toEqual('') 373 | }) 374 | 375 | test('addLicensesToSummary() - includes all license issues in table', () => { 376 | const licenseIssues = { 377 | forbidden: [createTestChange()], 378 | unresolved: [createTestChange(), createTestChange()], 379 | unlicensed: [createTestChange(), createTestChange(), createTestChange()] 380 | } 381 | 382 | summary.addLicensesToSummary(licenseIssues, defaultConfig) 383 | 384 | const text = core.summary.stringify() 385 | expect(text).toContain('License Issues
') 386 | expect(text).toContain('package.json
') 406 | expect(text).toContain('.github/workflows/test.yml
') 407 | }) 408 | 409 | test('addLicensesToSummary() - does not include specific license type sub-section if nothing is found', () => { 410 | const licenseIssues = { 411 | forbidden: [], 412 | unlicensed: [], 413 | unresolved: [createTestChange()] 414 | } 415 | 416 | summary.addLicensesToSummary(licenseIssues, defaultConfig) 417 | 418 | const text = core.summary.stringify() 419 | expect(text).not.toContain('Scorecard details
`, true) 330 | } 331 | core.summary.addRaw( 332 | `| Package | Version | Score | Details | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ${dependency.change.source_repository_url ? `` : ''} ${dependency.change.ecosystem}/${dependency.change.name} ${dependency.change.source_repository_url ? `` : ''} | ${dependency.change.version} | 351 |${overallIcon} ${dependency.scorecard?.score === undefined || dependency.scorecard?.score === null ? 'Unknown' : dependency.scorecard?.score} | `, 352 | false 353 | ) 354 | 355 | //Add details table in the last column 356 | if (dependency.scorecard?.checks !== undefined) { 357 | let detailsTable = 358 | '
| Check | Score | Reason |
|---|---|---|
| ${check.name} | ${icon} ${check.score} | ${check.reason} |