Merge branch 'main' into external-config

# Conflicts:
#	README.md
#	__tests__/config.test.ts
#	dist/index.js.map
#	src/config.ts
#	src/schemas.ts

src/config.ts

@@ -6,7 +6,8 @@ import * as z from 'zod'
 import {
   ConfigurationOptions,
   ConfigurationOptionsSchema,
-  SeveritySchema
+  SeveritySchema,
+  SCOPES
 } from './schemas'
 
 function getOptionalInput(name: string): string | undefined {
@@ -14,6 +15,14 @@ function getOptionalInput(name: string): string | undefined {
   return value.length > 0 ? value : undefined
 }
 
+function parseList(list: string | undefined): string[] | undefined {
+  if (list === undefined) {
+    return list
+  } else {
+    return list.split(',').map(x => x.trim())
+  }
+}
+
 export function readConfig(): ConfigurationOptions {
   const externalConfig = getOptionalInput('config-file')
   if (externalConfig !== undefined) {
@@ -29,6 +38,12 @@ export function readInlineConfig(): ConfigurationOptions {
   const fail_on_severity = SeveritySchema.parse(
     getOptionalInput('fail-on-severity')
   )
+
+  const fail_on_scopes = z
+    .array(z.enum(SCOPES))
+    .default(['runtime'])
+    .parse(parseList(getOptionalInput('fail-on-scopes')))
+
   const allow_licenses = getOptionalInput('allow-licenses')
   const deny_licenses = getOptionalInput('deny-licenses')
 
@@ -41,8 +56,9 @@ export function readInlineConfig(): ConfigurationOptions {
 
   return {
     fail_on_severity,
-    allow_licenses: allow_licenses?.split(',').map(x => x.trim()),
-    deny_licenses: deny_licenses?.split(',').map(x => x.trim()),
+    fail_on_scopes,
+    allow_licenses: parseList(allow_licenses),
+    deny_licenses: parseList(deny_licenses),
     base_ref,
     head_ref
   }

src/filter.ts

@@ -1,4 +1,4 @@
-import {Changes, Severity, SEVERITIES} from './schemas'
+import {Changes, Severity, SEVERITIES, Scope} from './schemas'
 
 export function filterChangesBySeverity(
   severity: Severity,
@@ -33,3 +33,16 @@ export function filterChangesBySeverity(
   )
   return filteredChanges
 }
+
+export function filterChangesByScopes(
+  scopes: Scope[],
+  changes: Changes
+): Changes {
+  const filteredChanges = changes.filter(change => {
+    // if there is no scope on the change (Enterprise Server API for now), we will assume it is a runtime scope
+    const scope = change.scope || 'runtime'
+    return scopes.includes(scope)
+  })
+
+  return filteredChanges
+}

src/main.ts

@@ -3,9 +3,9 @@ import * as dependencyGraph from './dependency-graph'
 import * as github from '@actions/github'
 import styles from 'ansi-styles'
 import {RequestError} from '@octokit/request-error'
-import {Change, Severity} from './schemas'
+import {Change, Severity, Scope} from './schemas'
 import {readConfig} from '../src/config'
-import {filterChangesBySeverity} from '../src/filter'
+import {filterChangesBySeverity, filterChangesByScopes} from '../src/filter'
 import {getDeniedLicenseChanges} from './licenses'
 import * as summary from './summary'
 import {getRefs} from './git-refs'
@@ -30,9 +30,13 @@ async function run(): Promise<void> {
       deny: config.deny_licenses
     }
 
+    const scopes = config.fail_on_scopes
+
+    const scopedChanges = filterChangesByScopes(scopes as Scope[], changes)
+
     const addedChanges = filterChangesBySeverity(
       minSeverity as Severity,
-      changes
+      scopedChanges
     ).filter(
       change =>
         change.change_type === 'added' &&
@@ -41,7 +45,7 @@ async function run(): Promise<void> {
     )
 
     const [licenseErrors, unknownLicenses] = getDeniedLicenseChanges(
-      changes,
+      scopedChanges,
       licenses
     )
 

src/schemas.ts

@@ -1,6 +1,8 @@
 import * as z from 'zod'
 
 export const SEVERITIES = ['critical', 'high', 'moderate', 'low'] as const
+export const SCOPES = ['unknown', 'runtime', 'development'] as const
+
 export const SeveritySchema = z.enum(SEVERITIES).default('low')
 
 export const ChangeSchema = z.object({
@@ -12,6 +14,7 @@ export const ChangeSchema = z.object({
   package_url: z.string(),
   license: z.string().nullable(),
   source_repository_url: z.string().nullable(),
+  scope: z.enum(SCOPES).optional(),
   vulnerabilities: z
     .array(
       z.object({
@@ -34,6 +37,7 @@ export const PullRequestSchema = z.object({
 export const ConfigurationOptionsSchema = z
   .object({
     fail_on_severity: SeveritySchema,
+    fail_on_scopes: z.array(z.enum(SCOPES)).default(['runtime']),
     allow_licenses: z.array(z.string()).default([]),
     deny_licenses: z.array(z.string()).default([]),
     config_file: z.string().optional().default('false'),
@@ -51,4 +55,5 @@ export const ChangesSchema = z.array(ChangeSchema)
 export type Change = z.infer<typeof ChangeSchema>
 export type Changes = z.infer<typeof ChangesSchema>
 export type ConfigurationOptions = z.infer<typeof ConfigurationOptionsSchema>
-export type Severity = typeof SEVERITIES[number]
+export type Severity = z.infer<typeof SeveritySchema>
+export type Scope = typeof SCOPES[number]