feat: Adjusts the formatting and content for the status header

__tests__/fixtures/mock-change.ts

@@ -0,0 +1,35 @@
+import {Change} from '../../src/schemas'
+
+const defaultChange: Change = {
+  change_type: 'added',
+  manifest: 'package.json',
+  ecosystem: 'npm',
+  name: 'lodash',
+  version: '4.17.20',
+  package_url: 'pkg:npm/lodash@4.17.20',
+  license: 'MIT',
+  source_repository_url: 'https://github.com/lodash/lodash',
+  scope: 'runtime',
+  vulnerabilities: [
+    {
+      severity: 'high',
+      advisory_ghsa_id: 'GHSA-35jh-r3h4-6jhm',
+      advisory_summary: 'Command Injection in lodash',
+      advisory_url: 'https://github.com/advisories/GHSA-35jh-r3h4-6jhm'
+    },
+    {
+      severity: 'moderate',
+      advisory_ghsa_id: 'GHSA-29mw-wpgm-hmr9',
+      advisory_summary:
+        'Regular Expression Denial of Service (ReDoS) in lodash',
+      advisory_url: 'https://github.com/advisories/GHSA-29mw-wpgm-hmr9'
+    }
+  ]
+}
+
+const createTestChange = (overwrites: Partial<Change> = {}): Change => ({
+  ...defaultChange,
+  ...overwrites
+})
+
+export {createTestChange}

__tests__/summary.test.ts

@@ -0,0 +1,110 @@
+import {expect, jest, test} from '@jest/globals'
+import {Change, Changes, ConfigurationOptions} from '../src/schemas'
+import * as summary from '../src/summary';
+import * as core from '@actions/core';
+import { createTestChange } from './fixtures/mock-change';
+
+
+afterEach(() => {
+  jest.clearAllMocks();
+  core.summary.emptyBuffer();
+});
+
+const emptyChanges: Changes = [];
+const emptyInvalidLicenseChanges = {
+  forbidden: [],
+  unresolved: [],
+  unlicensed: []
+};
+const defaultConfig: ConfigurationOptions = {
+  vulnerability_check: true,
+  license_check: true,
+  fail_on_severity: 'high',
+  fail_on_scopes: ['runtime'],
+  allow_ghsas: [],
+  allow_licenses: [],
+  deny_licenses: [],
+  comment_summary_in_pr: true,
+}
+
+test('prints headline as h2', () => {
+  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, defaultConfig);
+  const text = core.summary.stringify();
+  
+  expect(text).toContain('<h2>Dependency Review</h2>');
+});
+
+test('only includes "No vulnerabilities or license issues found"-message if both are configured and nothing was found', () => {
+  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, defaultConfig);
+  const text = core.summary.stringify();
+  
+  expect(text).toContain('✅ No vulnerabilities or license issues found.');
+});
+
+test('only includes "No vulnerabilities found"-message if "license_check" is set to false and nothing was found', () => {
+  const config = {...defaultConfig, license_check: false};
+  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, config);
+  const text = core.summary.stringify();
+  
+  expect(text).toContain('✅ No vulnerabilities found.');
+});
+
+test('only includes "No license issues found"-message if "vulnerability_check" is set to false and nothing was found', () => {
+  const config = {...defaultConfig, vulnerability_check: false};
+  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, config);
+  const text = core.summary.stringify();
+  
+  expect(text).toContain('✅ No license issues found.');
+});
+
+test('does not include status section if nothing was found', () => {
+  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, defaultConfig);
+  const text = core.summary.stringify();
+  
+  expect(text).not.toContain('The following issues were found:');
+});
+
+
+test('includes count and status icons for all findings', () => {
+  const vulnerabilities = [
+    createTestChange({ name: 'lodash'}),
+    createTestChange({ name: 'underscore', package_url: 'test-url'}),
+  ];
+  const licenseIssues = {
+    forbidden: [createTestChange()],
+    unresolved: [createTestChange(), createTestChange()],
+    unlicensed: [createTestChange(), createTestChange(), createTestChange()],
+  };
+  
+  summary.addSummaryToSummary(vulnerabilities, licenseIssues, defaultConfig);
+  
+  const text = core.summary.stringify();
+  expect(text).toContain('❌ 2 vulnerable package(s)');
+  expect(text).toContain('❌ 2 package(s) with invalid SPDX license definitions');
+  expect(text).toContain('❌ 1 package(s) with incompatible licenses');
+  expect(text).toContain('⚠️ 3 package(s) with unknown licenses');
+});
+
+test('uses checkmarks for license issues if only vulnerabilities were found', () => {
+  const vulnerabilities = [ createTestChange() ];
+  
+  summary.addSummaryToSummary(vulnerabilities, emptyInvalidLicenseChanges, defaultConfig);
+  
+  const text = core.summary.stringify();
+  expect(text).toContain('❌ 1 vulnerable package(s)');
+  expect(text).toContain('✅ 0 package(s) with invalid SPDX license definitions');
+  expect(text).toContain('✅ 0 package(s) with incompatible licenses');
+  expect(text).toContain('✅ 0 package(s) with unknown licenses');
+});
+
+test('uses checkmarks for vulnerabilities if only license issues were found.', () => {
+  const licenseIssues = { forbidden: [createTestChange()], unresolved: [], unlicensed: [] };
+  
+  summary.addSummaryToSummary(emptyChanges, licenseIssues, defaultConfig);
+  
+  const text = core.summary.stringify();
+  expect(text).toContain('✅ 0 vulnerable package(s)');
+  expect(text).toContain('✅ 0 package(s) with invalid SPDX license definitions');
+  expect(text).toContain('❌ 1 package(s) with incompatible licenses');
+  expect(text).toContain('✅ 0 package(s) with unknown licenses');
+});