Merge branch 'main' into deps-dev-v3

src/deny.ts

@@ -1,38 +1,40 @@
-import {Change} from './schemas'
 import * as core from '@actions/core'
+import {Change} from './schemas'
+import {PackageURL} from 'packageurl-js'
 
 export async function getDeniedChanges(
   changes: Change[],
-  deniedPackages: string[],
-  deniedGroups: string[]
+  deniedPackages: PackageURL[] = [],
+  deniedGroups: PackageURL[] = []
 ): Promise<Change[]> {
   const changesDenied: Change[] = []
 
-  let failed = false
+  let hasDeniedPackage = false
   for (const change of changes) {
-    change.name = change.name.toLowerCase()
-    const packageUrl = change.package_url.toLowerCase().split('@')[0]
+    const changedPackage = PackageURL.fromString(change.package_url)
 
-    if (deniedPackages) {
-      for (const denied of deniedPackages) {
-        if (packageUrl === denied.split('@')[0].toLowerCase()) {
-          changesDenied.push(change)
-          failed = true
-        }
+    for (const denied of deniedPackages) {
+      if (
+        (!denied.version || changedPackage.version === denied.version) &&
+        changedPackage.name === denied.name
+      ) {
+        changesDenied.push(change)
+        hasDeniedPackage = true
       }
     }
 
-    if (deniedGroups) {
-      for (const denied of deniedGroups) {
-        if (packageUrl.startsWith(denied.toLowerCase())) {
-          changesDenied.push(change)
-          failed = true
-        }
+    for (const denied of deniedGroups) {
+      if (
+        changedPackage.namespace &&
+        changedPackage.namespace === denied.namespace
+      ) {
+        changesDenied.push(change)
+        hasDeniedPackage = true
       }
     }
   }
 
-  if (failed) {
+  if (hasDeniedPackage) {
     core.setFailed('Dependency review detected denied packages.')
   } else {
     core.info('Dependency review did not detect any denied packages')

src/schemas.ts

@@ -1,10 +1,15 @@
 import * as z from 'zod'
+import {parsePURL} from './utils'
 
 export const SEVERITIES = ['critical', 'high', 'moderate', 'low'] as const
 export const SCOPES = ['unknown', 'runtime', 'development'] as const
 
 export const SeveritySchema = z.enum(SEVERITIES).default('low')
 
+const PackageURL = z.string().transform(purlString => {
+  return parsePURL(purlString)
+})
+
 export const ChangeSchema = z.object({
   change_type: z.enum(['added', 'removed']),
   manifest: z.string(),
@@ -42,8 +47,8 @@ export const ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).optional(),
     allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
-    deny_packages: z.array(z.string()).default([]),
-    deny_groups: z.array(z.string()).default([]),
+    deny_packages: z.array(PackageURL).default([]),
+    deny_groups: z.array(PackageURL).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),
     config_file: z.string().optional(),

src/summary.ts

@@ -69,7 +69,7 @@ export function addSummaryToSummary(
         : []),
       ...(deniedChanges.length > 0
         ? [
-            `${checkOrWarnIcon(deniedChanges.length)} ${
+            `${checkOrFailIcon(deniedChanges.length)} ${
               deniedChanges.length
             } package(s) denied.`
           ]
@@ -304,7 +304,7 @@ export function addScorecardToSummary(
 
     //Add a row for the dependency
     core.summary.addRaw(
-      `<tr><td>${dependency.change.source_repository_url ? `<a href="https://${dependency.change.source_repository_url}">` : ''} ${dependency.change.ecosystem}/${dependency.change.name} ${dependency.change.source_repository_url ? `</a>` : ''}</td><td>${dependency.change.version}</td>
+      `<tr><td>${dependency.change.source_repository_url ? `<a href="${dependency.change.source_repository_url}">` : ''} ${dependency.change.ecosystem}/${dependency.change.name} ${dependency.change.source_repository_url ? `</a>` : ''}</td><td>${dependency.change.version}</td>
       <td>${overallIcon} ${dependency.scorecard?.score === undefined || dependency.scorecard?.score === null ? 'Unknown' : dependency.scorecard?.score}</td>`,
       false
     )

src/utils.ts

@@ -1,6 +1,7 @@
 import * as core from '@actions/core'
 import {Octokit} from 'octokit'
 import spdxParse from 'spdx-expression-parse'
+import {PackageURL} from 'packageurl-js'
 import {Changes} from './schemas'
 
 export function groupDependenciesByManifest(
@@ -68,3 +69,21 @@ export function octokitClient(token = 'repo-token', required = true): Octokit {
 
   return new Octokit(opts)
 }
+
+export const parsePURL = (purlString: string): PackageURL => {
+  try {
+    return PackageURL.fromString(purlString)
+  } catch (error) {
+    if (
+      (error as Error).message ===
+      `purl is missing the required "name" component.`
+    ) {
+      //packageurl-js does not support empty names, so will manually override it for deny-groups
+      //https://github.com/package-url/packageurl-js/blob/master/src/package-url.js#L216
+      const purl = PackageURL.fromString(`${purlString}TEMP_NAME`)
+      purl.name = ''
+      return purl
+    }
+    throw error
+  }
+}