using packageurl-js to parse packages and groups from config

src/config.ts

@@ -4,7 +4,7 @@ import YAML from 'yaml'
 import * as core from '@actions/core'
 import * as z from 'zod'
 import {ConfigurationOptions, ConfigurationOptionsSchema} from './schemas'
-import {isSPDXValid, octokitClient} from './utils'
+import {isSPDXValid, octokitClient, parseGroupPURL} from './utils'
 import {PackageURL} from 'packageurl-js'
 
 type ConfigurationOptionsPartial = Partial<ConfigurationOptions>
@@ -33,8 +33,8 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   const allow_dependencies_licenses = parseList(
     getOptionalInput('allow-dependencies-licenses')
   )
-  const deny_packages = parseList(getOptionalInput('deny-packages'))
-  const deny_groups = parseList(getOptionalInput('deny-groups'))
+  const deny_packages = getPackagePURLs(getOptionalInput('deny-packages'))
+  const deny_groups = getGroupPURLs(getOptionalInput('deny-groups'))
   const allow_ghsas = parseList(getOptionalInput('allow-ghsas'))
   const license_check = getOptionalBoolean('license-check')
   const vulnerability_check = getOptionalBoolean('vulnerability-check')
@@ -107,6 +107,23 @@ function parseList(list: string | undefined): string[] | undefined {
   }
 }
 
+function getPackagePURLs(list: string | undefined): PackageURL[] | undefined {
+  if (list) {
+    return list
+      .split(',')
+      .map(packageString => PackageURL.fromString(packageString.trim()))
+  }
+}
+
+function getGroupPURLs(list: string | undefined): PackageURL[] | undefined {
+  if (list) {
+    return list
+      .split(',')
+      .map(packageString => parseGroupPURL(packageString.trim()))
+      .filter((purl): purl is PackageURL => purl !== undefined)
+  }
+}
+
 function validateLicenses(
   key: 'allow-licenses' | 'deny-licenses',
   licenses: string[] | undefined

src/deny.ts

@@ -1,24 +1,22 @@
-import {Change} from './schemas'
 import * as core from '@actions/core'
+import {Change} from './schemas'
+import {PackageURL} from 'packageurl-js'
 
 export async function getDeniedChanges(
   changes: Change[],
-  deniedPackages: string[] = [],
-  deniedGroups: string[] = []
+  deniedPackages: PackageURL[] = [],
+  deniedGroups: PackageURL[] = []
 ): Promise<Change[]> {
   const changesDenied: Change[] = []
 
   let hasDeniedPackage = false
   for (const change of changes) {
-    const [packageName, packageVersion] = change.package_url
-      .toLowerCase()
-      .split('@')
+    const changedPackage = PackageURL.fromString(change.package_url)
 
     for (const denied of deniedPackages) {
-      const [deniedName, deniedVersion] = denied.toLowerCase().split('@')
       if (
-        (!deniedVersion || packageVersion === deniedVersion) &&
-        packageName === deniedName
+        (!denied.version || changedPackage.version === denied.version) &&
+        changedPackage.name === denied.name
       ) {
         changesDenied.push(change)
         hasDeniedPackage = true
@@ -26,7 +24,10 @@ export async function getDeniedChanges(
     }
 
     for (const denied of deniedGroups) {
-      if (packageName.startsWith(denied.toLowerCase())) {
+      if (
+        changedPackage.namespace &&
+        changedPackage.namespace === denied.namespace
+      ) {
         changesDenied.push(change)
         hasDeniedPackage = true
       }

src/schemas.ts

@@ -5,6 +5,15 @@ export const SCOPES = ['unknown', 'runtime', 'development'] as const
 
 export const SeveritySchema = z.enum(SEVERITIES).default('low')
 
+export const PackageURLSchema = z.object({
+  type: z.string(),
+  namespace: z.string(),
+  name: z.string(),
+  version: z.string(),
+  qualifiers: z.record(z.string()).nullable(),
+  subpath: z.string().nullable()
+})
+
 export const ChangeSchema = z.object({
   change_type: z.enum(['added', 'removed']),
   manifest: z.string(),
@@ -42,8 +51,8 @@ export const ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).optional(),
     allow_dependencies_licenses: z.array(z.string()).optional(),
     allow_ghsas: z.array(z.string()).default([]),
-    deny_packages: z.array(z.string()).default([]),
-    deny_groups: z.array(z.string()).default([]),
+    deny_packages: z.array(PackageURLSchema).default([]),
+    deny_groups: z.array(PackageURLSchema).default([]),
     license_check: z.boolean().default(true),
     vulnerability_check: z.boolean().default(true),
     config_file: z.string().optional(),

src/utils.ts

@@ -1,6 +1,7 @@
 import * as core from '@actions/core'
 import {Octokit} from 'octokit'
 import spdxParse from 'spdx-expression-parse'
+import {PackageURL} from 'packageurl-js'
 import {Changes} from './schemas'
 
 export function groupDependenciesByManifest(
@@ -68,3 +69,21 @@ export function octokitClient(token = 'repo-token', required = true): Octokit {
 
   return new Octokit(opts)
 }
+
+export const parseGroupPURL = (purlString: string): PackageURL | undefined => {
+  try {
+    return PackageURL.fromString(purlString)
+  } catch (error) {
+    if (
+      (error as Error).message ===
+      `purl is missing the required "name" component.`
+    ) {
+      //package-url-js does not support empty names, so will manually override it for deny-groups
+      //https://github.com/package-url/packageurl-js/blob/master/src/package-url.js#L216
+      const purl = PackageURL.fromString(`${purlString}TEMP_NAME`)
+      purl.name = ''
+      return purl
+    }
+  }
+  return undefined
+}