add groups

__tests__/denylist.test.ts

@@ -0,0 +1,118 @@
+import {expect, jest, test} from '@jest/globals'
+import {Change, Changes} from '../src/schemas'
+
+let getDeniedChanges: Function
+
+const npmChange: Change = {
+  manifest: 'package.json',
+  change_type: 'added',
+  ecosystem: 'npm',
+  name: 'Reeuhq',
+  version: '1.0.2',
+  package_url: 'pkg:npm/reeuhq@1.0.2',
+  license: 'MIT',
+  source_repository_url: 'github.com/some-repo',
+  scope: 'runtime',
+  vulnerabilities: [
+    {
+      severity: 'critical',
+      advisory_ghsa_id: 'first-random_string',
+      advisory_summary: 'very dangerous',
+      advisory_url: 'github.com/future-funk'
+    }
+  ]
+}
+
+const rubyChange: Change = {
+  change_type: 'added',
+  manifest: 'Gemfile.lock',
+  ecosystem: 'rubygems',
+  name: 'actionsomething',
+  version: '3.2.0',
+  package_url: 'pkg:gem/actionsomething@3.2.0',
+  license: 'BSD',
+  source_repository_url: 'github.com/some-repo',
+  scope: 'runtime',
+  vulnerabilities: [
+    {
+      severity: 'moderate',
+      advisory_ghsa_id: 'second-random_string',
+      advisory_summary: 'not so dangerous',
+      advisory_url: 'github.com/future-funk'
+    },
+    {
+      severity: 'low',
+      advisory_ghsa_id: 'third-random_string',
+      advisory_summary: 'dont page me',
+      advisory_url: 'github.com/future-funk'
+    }
+  ]
+}
+
+const pipChange: Change = {
+  change_type: 'added',
+  manifest: 'requirements.txt',
+  ecosystem: 'pip',
+  name: 'package-1',
+  version: '1.1.1',
+  package_url: 'pkg:pip/package-1@1.1.1',
+  license: 'MIT',
+  source_repository_url: 'github.com/some-repo',
+  scope: 'runtime',
+  vulnerabilities: [
+    {
+      severity: 'moderate',
+      advisory_ghsa_id: 'second-random_string',
+      advisory_summary: 'not so dangerous',
+      advisory_url: 'github.com/future-funk'
+    },
+    {
+      severity: 'low',
+      advisory_ghsa_id: 'third-random_string',
+      advisory_summary: 'dont page me',
+      advisory_url: 'github.com/future-funk'
+    }
+  ]
+}
+
+jest.mock('@actions/core')
+
+const mockOctokit = {
+  rest: {
+    licenses: {
+      getForRepo: jest
+        .fn()
+        .mockReturnValue({data: {license: {spdx_id: 'AGPL'}}})
+    }
+  }
+}
+
+jest.mock('octokit', () => {
+  return {
+    // eslint-disable-next-line @typescript-eslint/no-extraneous-class
+    Octokit: class {
+      constructor() {
+        return mockOctokit
+      }
+    }
+  }
+})
+
+beforeEach(async () => {
+  jest.resetModules()
+  jest.doMock('spdx-satisfies', () => {
+    // mock spdx-satisfies return value
+    // true for BSD, false for all others
+    return jest.fn((license: string, _: string): boolean => license === 'BSD')
+  })
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  ;({getDeniedChanges} = require('../src/denylist'))
+})
+
+test('it adds license outside the allow list to forbidden changes', async () => {
+  const changes: Changes = [npmChange, rubyChange]
+  const deniedChanges = await getDeniedChanges(changes, ['actionsomething'])
+
+  expect(deniedChanges[0]).toBe(rubyChange)
+  expect(deniedChanges.length).toEqual(1)
+})

__tests__/summary.test.ts

@@ -24,6 +24,7 @@ const defaultConfig: ConfigurationOptions = {
   allow_ghsas: [],
   allow_licenses: [],
   deny_licenses: [],
+  deny_list: [],
   comment_summary_in_pr: true
 }
 
@@ -70,6 +71,7 @@ test('prints headline as h1', () => {
   summary.addSummaryToSummary(
     emptyChanges,
     emptyInvalidLicenseChanges,
+    emptyChanges,
     defaultConfig
   )
   const text = core.summary.stringify()
@@ -81,6 +83,7 @@ test('only includes "No vulnerabilities or license issues found"-message if both
   summary.addSummaryToSummary(
     emptyChanges,
     emptyInvalidLicenseChanges,
+    emptyChanges,
     defaultConfig
   )
   const text = core.summary.stringify()
@@ -90,7 +93,12 @@ test('only includes "No vulnerabilities or license issues found"-message if both
 
 test('only includes "No vulnerabilities found"-message if "license_check" is set to false and nothing was found', () => {
   const config = {...defaultConfig, license_check: false}
-  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, config)
+  summary.addSummaryToSummary(
+    emptyChanges,
+    emptyInvalidLicenseChanges,
+    emptyChanges,
+    config
+  )
   const text = core.summary.stringify()
 
   expect(text).toContain('✅ No vulnerabilities found.')
@@ -98,7 +106,12 @@ test('only includes "No vulnerabilities found"-message if "license_check" is set
 
 test('only includes "No license issues found"-message if "vulnerability_check" is set to false and nothing was found', () => {
   const config = {...defaultConfig, vulnerability_check: false}
-  summary.addSummaryToSummary(emptyChanges, emptyInvalidLicenseChanges, config)
+  summary.addSummaryToSummary(
+    emptyChanges,
+    emptyInvalidLicenseChanges,
+    emptyChanges,
+    config
+  )
   const text = core.summary.stringify()
 
   expect(text).toContain('✅ No license issues found.')
@@ -108,6 +121,7 @@ test('groups dependencies with empty manifest paths together', () => {
   summary.addSummaryToSummary(
     changesWithEmptyManifests,
     emptyInvalidLicenseChanges,
+    emptyChanges,
     defaultConfig
   )
   summary.addScannedDependencies(changesWithEmptyManifests)
@@ -124,6 +138,7 @@ test('does not include status section if nothing was found', () => {
   summary.addSummaryToSummary(
     emptyChanges,
     emptyInvalidLicenseChanges,
+    emptyChanges,
     defaultConfig
   )
   const text = core.summary.stringify()
@@ -142,7 +157,12 @@ test('includes count and status icons for all findings', () => {
     unlicensed: [createTestChange(), createTestChange(), createTestChange()]
   }
 
-  summary.addSummaryToSummary(vulnerabilities, licenseIssues, defaultConfig)
+  summary.addSummaryToSummary(
+    vulnerabilities,
+    licenseIssues,
+    emptyChanges,
+    defaultConfig
+  )
 
   const text = core.summary.stringify()
   expect(text).toContain('❌ 2 vulnerable package(s)')
@@ -159,6 +179,7 @@ test('uses checkmarks for license issues if only vulnerabilities were found', ()
   summary.addSummaryToSummary(
     vulnerabilities,
     emptyInvalidLicenseChanges,
+    emptyChanges,
     defaultConfig
   )
 
@@ -178,7 +199,12 @@ test('uses checkmarks for vulnerabilities if only license issues were found', ()
     unlicensed: []
   }
 
-  summary.addSummaryToSummary(emptyChanges, licenseIssues, defaultConfig)
+  summary.addSummaryToSummary(
+    emptyChanges,
+    licenseIssues,
+    emptyChanges,
+    defaultConfig
+  )
 
   const text = core.summary.stringify()
   expect(text).toContain('✅ 0 vulnerable package(s)')

action.yml

@@ -47,7 +47,7 @@ inputs:
   comment-summary-in-pr:
     description: A boolean to determine if the report should be posted as a comment in the PR itself. Setting this to true requires you to give the workflow the write permissions for pull-requests
     required: false
-  deny_list:
+  deny-list:
     description: A comma-separated list of dependencies to deny (e.g. "pkg:npm/express, pkg:pip/pycrypto")
     required: false
 runs:

dist/index.js

@@ -135,6 +135,42 @@ function findCommentByMarker(commentBodyIncludes) {
 }
 
 
+/***/ }),
+
+/***/ 3491:
+/***/ (function(__unused_webpack_module, exports) {
+
+"use strict";
+
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getDeniedChanges = void 0;
+function getDeniedChanges(changes, deniedList) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const changesDenied = [];
+        for (const change of changes) {
+            change.name = change.name.toLowerCase();
+            change.package_url = change.package_url.toLowerCase();
+            for (const denied of deniedList) {
+                if (change.name.includes(denied)) {
+                    changesDenied.push(change);
+                }
+            }
+        }
+        return changesDenied;
+    });
+}
+exports.getDeniedChanges = getDeniedChanges;
+
+
 /***/ }),
 
 /***/ 4966:
@@ -485,6 +521,7 @@ const summary = __importStar(__nccwpck_require__(8608));
 const git_refs_1 = __nccwpck_require__(1086);
 const utils_1 = __nccwpck_require__(918);
 const comment_pr_1 = __nccwpck_require__(5842);
+const denylist_1 = __nccwpck_require__(3491);
 function run() {
     return __awaiter(this, void 0, void 0, function* () {
         try {
@@ -513,7 +550,11 @@ function run() {
                 deny: config.deny_licenses,
                 licenseExclusions: config.allow_dependencies_licenses
             });
-            summary.addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, config);
+            const deniedChanges = yield (0, denylist_1.getDeniedChanges)(filteredChanges, config.deny_list);
+            core.debug(`config: ${JSON.stringify(config)}`);
+            core.debug(`filteredChanges: ${JSON.stringify(filteredChanges)}`);
+            core.debug(`deniedChanges: ${JSON.stringify(deniedChanges)}`);
+            summary.addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, deniedChanges, config);
             if (snapshot_warnings) {
                 summary.addSnapshotWarnings(snapshot_warnings);
             }
@@ -525,6 +566,10 @@ function run() {
                 summary.addLicensesToSummary(invalidLicenseChanges, config);
                 printLicensesBlock(invalidLicenseChanges);
             }
+            if (config.deny_list) {
+                summary.addDeniedToSummary(deniedChanges);
+                printDeniedDependencies(deniedChanges, config);
+            }
             summary.addScannedDependencies(changes);
             printScannedDependencies(changes);
             if (config.comment_summary_in_pr) {
@@ -640,6 +685,17 @@ function printScannedDependencies(changes) {
         }
     }));
 }
+function printDeniedDependencies(changes, config) {
+    core.group('Denied', () => __awaiter(this, void 0, void 0, function* () {
+        for (const denied of config.deny_list) {
+            core.info(`Config: ${denied}`);
+        }
+        for (const change of changes) {
+            core.info(`Change: ${change.name}@${change.version} is denied`);
+            core.info(`Change: ${change.package_url} is denied`);
+        }
+    }));
+}
 run();
 
 
@@ -712,6 +768,7 @@ exports.ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).optional(),
     allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
+    deny_list: z.array(z.string()).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),
     config_file: z.string().optional(),
@@ -778,7 +835,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.addSnapshotWarnings = exports.addScannedDependencies = exports.addLicensesToSummary = exports.addChangeVulnerabilitiesToSummary = exports.addSummaryToSummary = void 0;
+exports.addDeniedToSummary = exports.addSnapshotWarnings = exports.addScannedDependencies = exports.addLicensesToSummary = exports.addChangeVulnerabilitiesToSummary = exports.addSummaryToSummary = void 0;
 const core = __importStar(__nccwpck_require__(2186));
 const utils_1 = __nccwpck_require__(918);
 const icons = {
@@ -786,10 +843,11 @@ const icons = {
     cross: '❌',
     warning: '⚠️'
 };
-function addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, config) {
+function addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, deniedChanges, config) {
     core.summary.addHeading('Dependency Review', 1);
     if (vulnerableChanges.length === 0 &&
-        countLicenseIssues(invalidLicenseChanges) === 0) {
+        countLicenseIssues(invalidLicenseChanges) === 0 &&
+        deniedChanges.length === 0) {
         if (!config.license_check) {
             core.summary.addRaw(`${icons.check} No vulnerabilities found.`);
         }
@@ -815,6 +873,11 @@ function addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, config) {
                 `${checkOrFailIcon(invalidLicenseChanges.unresolved.length)} ${invalidLicenseChanges.unresolved.length} package(s) with invalid SPDX license definitions`,
                 `${checkOrWarnIcon(invalidLicenseChanges.unlicensed.length)} ${invalidLicenseChanges.unlicensed.length} package(s) with unknown licenses.`
             ]
+            : []),
+        ...(deniedChanges.length > 0
+            ? [
+                `${checkOrWarnIcon(deniedChanges.length)} ${deniedChanges.length} package(s) denied.`
+            ]
             : [])
     ])
         .addRaw('See the Details below.');
@@ -956,6 +1019,24 @@ exports.addSnapshotWarnings = addSnapshotWarnings;
 function countLicenseIssues(invalidLicenseChanges) {
     return Object.values(invalidLicenseChanges).reduce((acc, val) => acc + val.length, 0);
 }
+function addDeniedToSummary(deniedChanges) {
+    if (deniedChanges.length === 0) {
+        return;
+    }
+    core.summary.addHeading('Denied dependencies', 2);
+    for (const change of deniedChanges) {
+        core.summary.addHeading(`<em>Denied dependencies</em>`, 4);
+        core.summary.addTable([
+            ['Package', 'Version', 'License'],
+            [
+                (0, utils_1.renderUrl)(change.source_repository_url, change.name),
+                change.version,
+                change.license || ''
+            ]
+        ]);
+    }
+}
+exports.addDeniedToSummary = addDeniedToSummary;
 function checkOrFailIcon(count) {
     return count === 0 ? icons.check : icons.cross;
 }
@@ -47821,6 +47902,7 @@ function readInlineConfig() {
     const allow_licenses = parseList(getOptionalInput('allow-licenses'));
     const deny_licenses = parseList(getOptionalInput('deny-licenses'));
     const allow_dependencies_licenses = parseList(getOptionalInput('allow-dependencies-licenses'));
+    const deny_list = parseList(getOptionalInput('deny-list'));
     const allow_ghsas = parseList(getOptionalInput('allow-ghsas'));
     const license_check = getOptionalBoolean('license-check');
     const vulnerability_check = getOptionalBoolean('vulnerability-check');
@@ -47835,6 +47917,7 @@ function readInlineConfig() {
         fail_on_scopes,
         allow_licenses,
         deny_licenses,
+        deny_list,
         allow_dependencies_licenses,
         allow_ghsas,
         license_check,
@@ -48119,6 +48202,7 @@ exports.ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).optional(),
     allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
+    deny_list: z.array(z.string()).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),
     config_file: z.string().optional(),

scripts/create_summary.ts

@@ -6,7 +6,7 @@
  * npx ts-node scripts/create_summary.ts
  */
 
-import {Changes, ConfigurationOptions} from '../src/schemas'
+import {Change, Changes, ConfigurationOptions} from '../src/schemas'
 import {createTestChange} from '../__tests__/fixtures/create-test-change'
 import {InvalidLicenseChanges} from '../src/licenses'
 import * as fs from 'fs'
@@ -22,6 +22,7 @@ const defaultConfig: ConfigurationOptions = {
   allow_ghsas: [],
   allow_licenses: ['MIT'],
   deny_licenses: [],
+  deny_list: [],
   allow_dependencies_licenses: [
     'pkg:npm/express@4.17.1',
     'pkg:pip/requests',
@@ -44,6 +45,7 @@ const createNonIssueSummary = async (): Promise<void> => {
   await createSummary(
     [],
     {forbidden: [], unresolved: [], unlicensed: []},
+    [],
     defaultConfig,
     'non-issue-summary.md'
   )
@@ -85,16 +87,17 @@ const createFullSummary = async (): Promise<void> => {
     ]
   }
 
-  await createSummary(changes, licenses, defaultConfig, 'full-summary.md')
+  await createSummary(changes, licenses, [], defaultConfig, 'full-summary.md')
 }
 
 async function createSummary(
   vulnerabilities: Changes,
   licenseIssues: InvalidLicenseChanges,
+  denied: Change[],
   config: ConfigurationOptions,
   fileName: string
 ): Promise<void> {
-  summary.addSummaryToSummary(vulnerabilities, licenseIssues, config)
+  summary.addSummaryToSummary(vulnerabilities, licenseIssues, denied, config)
   summary.addChangeVulnerabilitiesToSummary(
     vulnerabilities,
     config.fail_on_severity

src/config.ts

@@ -33,7 +33,7 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   const allow_dependencies_licenses = parseList(
     getOptionalInput('allow-dependencies-licenses')
   )
-  const deny_list = parseList(getOptionalInput('deny-dependencies'))
+  const deny_list = parseList(getOptionalInput('deny-list'))
   const allow_ghsas = parseList(getOptionalInput('allow-ghsas'))
   const license_check = getOptionalBoolean('license-check')
   const vulnerability_check = getOptionalBoolean('vulnerability-check')

src/denylist.ts

@@ -0,0 +1,30 @@
+import {Change} from './schemas'
+import * as core from '@actions/core'
+
+export async function getDeniedChanges(
+  changes: Change[],
+  deniedList: string[]
+): Promise<Change[]> {
+  const changesDenied: Change[] = []
+
+  let failed = false
+  for (const change of changes) {
+    change.name = change.name.toLowerCase()
+    change.package_url = change.package_url.toLowerCase()
+
+    for (const denied of deniedList) {
+      if (change.name.includes(denied)) {
+        changesDenied.push(change)
+        failed = true
+      }
+    }
+  }
+
+  if (failed) {
+    core.setFailed('Dependency review detected denied packages.')
+  } else {
+    core.info('Dependency review did not detect any denied packages')
+  }
+
+  return changesDenied
+}

src/main.ts

@@ -3,7 +3,7 @@ import * as dependencyGraph from './dependency-graph'
 import * as github from '@actions/github'
 import styles from 'ansi-styles'
 import {RequestError} from '@octokit/request-error'
-import {Change, Severity, Changes} from './schemas'
+import {Change, Severity, Changes, ConfigurationOptions} from './schemas'
 import {readConfig} from '../src/config'
 import {
   filterChangesBySeverity,
@@ -69,6 +69,10 @@ async function run(): Promise<void> {
       config.deny_list
     )
 
+    core.debug(`config: ${JSON.stringify(config)}`)
+    core.debug(`filteredChanges: ${JSON.stringify(filteredChanges)}`)
+    core.debug(`deniedChanges: ${JSON.stringify(deniedChanges)}`)
+
     summary.addSummaryToSummary(
       vulnerableChanges,
       invalidLicenseChanges,
@@ -88,6 +92,10 @@ async function run(): Promise<void> {
       summary.addLicensesToSummary(invalidLicenseChanges, config)
       printLicensesBlock(invalidLicenseChanges)
     }
+    if (config.deny_list) {
+      summary.addDeniedToSummary(deniedChanges)
+      printDeniedDependencies(deniedChanges, config)
+    }
 
     summary.addScannedDependencies(changes)
     printScannedDependencies(changes)
@@ -246,4 +254,20 @@ function printScannedDependencies(changes: Changes): void {
   })
 }
 
+function printDeniedDependencies(
+  changes: Change[],
+  config: ConfigurationOptions
+): void {
+  core.group('Denied', async () => {
+    for (const denied of config.deny_list) {
+      core.info(`Config: ${denied}`)
+    }
+
+    for (const change of changes) {
+      core.info(`Change: ${change.name}@${change.version} is denied`)
+      core.info(`Change: ${change.package_url} is denied`)
+    }
+  })
+}
+
 run()

src/summary.ts

@@ -1,5 +1,5 @@
 import * as core from '@actions/core'
-import {ConfigurationOptions, Changes} from './schemas'
+import {ConfigurationOptions, Changes, Change} from './schemas'
 import {SummaryTableRow} from '@actions/core/lib/summary'
 import {InvalidLicenseChanges, InvalidLicenseChangeTypes} from './licenses'
 import {groupDependenciesByManifest, getManifestsSet, renderUrl} from './utils'
@@ -20,7 +20,8 @@ export function addSummaryToSummary(
 
   if (
     vulnerableChanges.length === 0 &&
-    countLicenseIssues(invalidLicenseChanges) === 0
+    countLicenseIssues(invalidLicenseChanges) === 0 &&
+    deniedChanges.length === 0
   ) {
     if (!config.license_check) {
       core.summary.addRaw(`${icons.check} No vulnerabilities found.`)
@@ -35,8 +36,6 @@ export function addSummaryToSummary(
     return
   }
 
-  core.summary.addList(deniedChanges.map(change => `${change.name} is denied`))
-
   core.summary
     .addRaw('The following issues were found:')
     .addList([
@@ -59,6 +58,13 @@ export function addSummaryToSummary(
               invalidLicenseChanges.unlicensed.length
             } package(s) with unknown licenses.`
           ]
+        : []),
+      ...(deniedChanges.length > 0
+        ? [
+            `${checkOrWarnIcon(deniedChanges.length)} ${
+              deniedChanges.length
+            } package(s) denied.`
+          ]
         : [])
     ])
     .addRaw('See the Details below.')
@@ -251,6 +257,25 @@ function countLicenseIssues(
   )
 }
 
+export function addDeniedToSummary(deniedChanges: Change[]): void {
+  if (deniedChanges.length === 0) {
+    return
+  }
+
+  core.summary.addHeading('Denied dependencies', 2)
+  for (const change of deniedChanges) {
+    core.summary.addHeading(`<em>Denied dependencies</em>`, 4)
+    core.summary.addTable([
+      ['Package', 'Version', 'License'],
+      [
+        renderUrl(change.source_repository_url, change.name),
+        change.version,
+        change.license || ''
+      ]
+    ])
+  }
+}
+
 function checkOrFailIcon(count: number): string {
   return count === 0 ? icons.check : icons.cross
 }