transforming package URLs during zod parsing

__tests__/fixtures/create-test-change.ts

@@ -1,7 +1,7 @@
 import {PackageURL} from 'packageurl-js'
 import {Change} from '../../src/schemas'
 import {createTestVulnerability} from './create-test-vulnerability'
-import {parseGroupPURL} from '../../src/utils'
+import {parsePURL} from '../../src/utils'
 
 const defaultNpmChange: Change = {
   change_type: 'added',
@@ -127,7 +127,7 @@ const createTestPackagePURLs = (list: string[]): PackageURL[] => {
 const createTestGroupPURLs = (list: string[]): PackageURL[] => {
   return list
     .map(purl => {
-      return parseGroupPURL(purl)
+      return parsePURL(purl)
     })
     .filter((purl): purl is PackageURL => purl !== undefined)
 }

src/config.ts

@@ -4,7 +4,7 @@ import YAML from 'yaml'
 import * as core from '@actions/core'
 import * as z from 'zod'
 import {ConfigurationOptions, ConfigurationOptionsSchema} from './schemas'
-import {isSPDXValid, octokitClient, parseGroupPURL} from './utils'
+import {isSPDXValid, octokitClient} from './utils'
 import {PackageURL} from 'packageurl-js'
 
 type ConfigurationOptionsPartial = Partial<ConfigurationOptions>
@@ -33,8 +33,8 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   const allow_dependencies_licenses = parseList(
     getOptionalInput('allow-dependencies-licenses')
   )
-  const deny_packages = getPackagePURLs(getOptionalInput('deny-packages'))
-  const deny_groups = getGroupPURLs(getOptionalInput('deny-groups'))
+  const deny_packages = parseList(getOptionalInput('deny-packages'))
+  const deny_groups = parseList(getOptionalInput('deny-groups'))
   const allow_ghsas = parseList(getOptionalInput('allow-ghsas'))
   const license_check = getOptionalBoolean('license-check')
   const vulnerability_check = getOptionalBoolean('vulnerability-check')
@@ -107,23 +107,6 @@ function parseList(list: string | undefined): string[] | undefined {
   }
 }
 
-function getPackagePURLs(list: string | undefined): PackageURL[] | undefined {
-  if (list) {
-    return list
-      .split(',')
-      .map(packageString => PackageURL.fromString(packageString.trim()))
-  }
-}
-
-function getGroupPURLs(list: string | undefined): PackageURL[] | undefined {
-  if (list) {
-    return list
-      .split(',')
-      .map(packageString => parseGroupPURL(packageString.trim()))
-      .filter((purl): purl is PackageURL => purl !== undefined)
-  }
-}
-
 function validateLicenses(
   key: 'allow-licenses' | 'deny-licenses',
   licenses: string[] | undefined

src/schemas.ts

@@ -1,17 +1,13 @@
 import * as z from 'zod'
+import {parsePURL} from './utils'
 
 export const SEVERITIES = ['critical', 'high', 'moderate', 'low'] as const
 export const SCOPES = ['unknown', 'runtime', 'development'] as const
 
 export const SeveritySchema = z.enum(SEVERITIES).default('low')
 
-export const PackageURLSchema = z.object({
-  type: z.string(),
-  namespace: z.string(),
-  name: z.string(),
-  version: z.string(),
-  qualifiers: z.record(z.string()).nullable(),
-  subpath: z.string().nullable()
+const PackageURL = z.string().transform(purlString => {
+  return parsePURL(purlString)
 })
 
 export const ChangeSchema = z.object({
@@ -51,8 +47,8 @@ export const ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).optional(),
     allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
-    deny_packages: z.array(PackageURLSchema).default([]),
-    deny_groups: z.array(PackageURLSchema).default([]),
+    deny_packages: z.array(PackageURL).default([]),
+    deny_groups: z.array(PackageURL).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),
     config_file: z.string().optional(),

src/utils.ts

@@ -70,7 +70,7 @@ export function octokitClient(token = 'repo-token', required = true): Octokit {
   return new Octokit(opts)
 }
 
-export const parseGroupPURL = (purlString: string): PackageURL | undefined => {
+export const parsePURL = (purlString: string): PackageURL | undefined => {
   try {
     return PackageURL.fromString(purlString)
   } catch (error) {