Skip to content

Commit 1db9156

Browse files
adrienpessuadrienpessu
committed
change from name of the package to the package url to avoid conflict between 2 dependencies with the same name but for different ecosystems
1 parent c462e2e commit 1db9156

File tree

6 files changed

+34
-30
lines changed

6 files changed

+34
-30
lines changed

‎README.md

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -66,20 +66,20 @@ jobs:
6666

6767
Configure this action by either inlining these options in your workflow file, or by using an external configuration file. All configuration options are optional.
6868

69-
| Option | Usage | Possible values | Default value |
70-
|---------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------|---------------|
71-
| `fail-on-severity` | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. | `low`, `moderate`, `high`, `critical` | `low` |
72-
| `allow-licenses`\* | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
73-
| `deny-licenses`\* | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
74-
| `fail-on-scopes`† | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown` | `runtime` |
75-
| `allow-ghsas` | Contains a list of GitHub Advisory Database IDs that can be skipped during detection. | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none |
76-
| `license-check` | Enable or disable the license check performed by the action. | `true`, `false` | `true` |
77-
| `vulnerability-check` | Enable or disable the vulnerability check performed by the action. | `true`, `false` | `true` |
78-
| `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks. | Any package(s) in [purl](https://github.com/package-url/purl-spec) format | none |
79-
| `base-ref`/`head-ref` | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`. | Any valid git ref(s) in your project | none |
80-
| `comment-summary-in-pr` | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`. | `true`, `false` | `false` |
81-
| `deny-packages` | Contains a list of denied package's name. | Any packages complete names | empty |
82-
| `deny-groups` | Contains a list of denied groups package's name. | Any packages's group names | empty |
69+
| Option | Usage | Possible values | Default value |
70+
|---------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------|---------------|
71+
| `fail-on-severity` | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. | `low`, `moderate`, `high`, `critical` | `low` |
72+
| `allow-licenses`\* | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
73+
| `deny-licenses`\* | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
74+
| `fail-on-scopes`† | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown` | `runtime` |
75+
| `allow-ghsas` | Contains a list of GitHub Advisory Database IDs that can be skipped during detection. | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none |
76+
| `license-check` | Enable or disable the license check performed by the action. | `true`, `false` | `true` |
77+
| `vulnerability-check` | Enable or disable the vulnerability check performed by the action. | `true`, `false` | `true` |
78+
| `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks. | Any package(s) in [purl](https://github.com/package-url/purl-spec) format | none |
79+
| `base-ref`/`head-ref` | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`. | Any valid git ref(s) in your project | none |
80+
| `comment-summary-in-pr` | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`. | `true`, `false` | `false` |
81+
| `deny-packages` | Contains a list of denied package's URL. | Any packages [purl](https://github.com/package-url/purl-spec) without the version | empty |
82+
| `deny-groups` | Contains a list of denied groups package's name. | Any packages [purl](https://github.com/package-url/purl-spec) without the version and the name | empty |
8383

8484
\*not supported for use with GitHub Enterprise Server
8585

‎__tests__/deny.test.ts

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ const mvnChange: Change = {
8181
ecosystem: 'maven',
8282
name: 'org.apache.logging.log4j:log4j-core',
8383
version: '2.15.0',
84-
package_url: 'pkg:org.apache.logging.log4j:log4j-core@1.1.1',
84+
package_url: 'pkg:maven/org.apache.logging.log4j/log4j-core@2.14.7',
8585
license: 'Apache-2.0',
8686
source_repository_url:
8787
'https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core',
@@ -132,7 +132,11 @@ beforeEach(async () => {
132132

133133
test('it adds packages in the deny packages list', async () => {
134134
const changes: Changes = [npmChange, rubyChange]
135-
const deniedChanges = await getDeniedChanges(changes, ['actionsomething'], [])
135+
const deniedChanges = await getDeniedChanges(
136+
changes,
137+
['pkg:gem/actionsomething'],
138+
[]
139+
)
136140

137141
expect(deniedChanges[0]).toBe(rubyChange)
138142
expect(deniedChanges.length).toEqual(1)
@@ -143,7 +147,7 @@ test('it adds packages in the deny group list', async () => {
143147
const deniedChanges = await getDeniedChanges(
144148
changes,
145149
[],
146-
['org.apache.logging.log4j']
150+
['pkg:maven/org.apache.logging.log4j']
147151
)
148152

149153
expect(deniedChanges[0]).toBe(mvnChange)
@@ -154,8 +158,8 @@ test('it adds packages outside of the deny lists', async () => {
154158
const changes: Changes = [npmChange, pipChange]
155159
const deniedChanges = await getDeniedChanges(
156160
changes,
157-
['actionsomething'],
158-
['org.apache.logging.log4j']
161+
['pkg:gem/actionsomething'],
162+
['pkg:maven:org.apache.logging.log4j']
159163
)
160164

161165
expect(deniedChanges.length).toEqual(0)

‎dist/index.js

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/index.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/examples.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -233,8 +233,8 @@ jobs:
233233

234234
## Exclude dependencies from their name or groups
235235

236-
Using the `deny-packages` you can exclude dependencies by their full name. You can add multiple values separated by a comma.
237-
Using the `deny-groups` you can exclude dependencies by their group name. You can add multiple values separated by a comma.
236+
Using the `deny-packages` you can exclude dependencies by their full package name. You can add multiple values separated by a comma.
237+
Using the `deny-groups` you can exclude dependencies by their package group name. You can add multiple values separated by a comma.
238238

239239
In this example, we are excluding `log4j-api` and `log4j-code` from `maven` and `requests` from `pip` dependencies from the license check
240240

@@ -255,6 +255,6 @@ jobs:
255255
- name: 'Dependency Review'
256256
uses: actions/dependency-review-action@v3
257257
with:
258-
deny-packages: 'org.apache.logging.log4j:log4j-api,org.apache.logging.log4j:log4j-core'
259-
deny-groups: 'com.bazaarvoice.maven'
258+
deny-packages: 'pkg:maven/org.apache.logging.log4j:log4j-api,pkg:maven/org.apache.logging.log4j:log4j-core'
259+
deny-groups: 'pkg:maven/com.bazaarvoice.maven'
260260
```

‎src/deny.ts

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@ export async function getDeniedChanges(
1111
let failed = false
1212
for (const change of changes) {
1313
change.name = change.name.toLowerCase()
14-
change.package_url = change.package_url.toLowerCase()
14+
const packageUrl = change.package_url.toLowerCase().split('@')[0]
1515

1616
if (deniedPackages) {
1717
for (const denied of deniedPackages) {
18-
if (change.name === denied.toLowerCase()) {
18+
if (packageUrl === denied.split('@')[0].toLowerCase()) {
1919
changesDenied.push(change)
2020
failed = true
2121
}
@@ -24,7 +24,7 @@ export async function getDeniedChanges(
2424

2525
if (deniedGroups) {
2626
for (const denied of deniedGroups) {
27-
if (change.name.startsWith(denied.toLowerCase())) {
27+
if (packageUrl.startsWith(denied.toLowerCase())) {
2828
changesDenied.push(change)
2929
failed = true
3030
}

0 commit comments

Comments
 (0)