Merge pull request #280 from actions/format-bugs

Fix display issues with versions and GHSAs

__tests__/filter.test.ts

@@ -3,7 +3,7 @@ import {Change, Changes} from '../src/schemas'
 import {
   filterChangesBySeverity,
   filterChangesByScopes,
-  filterOutAllowedAdvisories
+  filterAllowedAdvisories
 } from '../src/filter'
 
 let npmChange: Change = {
@@ -90,28 +90,34 @@ test('it properly filters changes by scope', async () => {
   expect(result).toEqual([npmChange, rubyChange])
 })
 
+test('it properly handles undefined advisory IDs', async () => {
+  const changes = [npmChange, rubyChange, noVulnNpmChange]
+  let result = filterAllowedAdvisories(undefined, changes)
+  expect(result).toEqual([npmChange, rubyChange, noVulnNpmChange])
+})
+
 test('it properly filters changes with allowed vulnerabilities', async () => {
   const changes = [npmChange, rubyChange, noVulnNpmChange]
 
-  let result = filterOutAllowedAdvisories(['notrealGHSAID'], changes)
+  let result = filterAllowedAdvisories(['notrealGHSAID'], changes)
   expect(result).toEqual([npmChange, rubyChange, noVulnNpmChange])
 
-  result = filterOutAllowedAdvisories(['first-random_string'], changes)
+  result = filterAllowedAdvisories(['first-random_string'], changes)
   expect(result).toEqual([rubyChange, noVulnNpmChange])
 
-  result = filterOutAllowedAdvisories(
+  result = filterAllowedAdvisories(
     ['second-random_string', 'third-random_string'],
     changes
   )
   expect(result).toEqual([npmChange, noVulnNpmChange])
 
-  result = filterOutAllowedAdvisories(
+  result = filterAllowedAdvisories(
     ['first-random_string', 'second-random_string', 'third-random_string'],
     changes
   )
   expect(result).toEqual([noVulnNpmChange])
 
   // if we have a change with multiple vulnerabilities but only one is allowed, we still should not filter out that change
-  result = filterOutAllowedAdvisories(['second-random_string'], changes)
+  result = filterAllowedAdvisories(['second-random_string'], changes)
   expect(result).toEqual([npmChange, rubyChange, noVulnNpmChange])
 })

dist/index.js

@@ -217,7 +217,7 @@ function run() {
             });
             const minSeverity = config.fail_on_severity;
             const scopedChanges = (0, filter_1.filterChangesByScopes)(config.fail_on_scopes, changes);
-            const filteredChanges = (0, filter_1.filterOutAllowedAdvisories)(config.allow_ghsas, scopedChanges);
+            const filteredChanges = (0, filter_1.filterAllowedAdvisories)(config.allow_ghsas, scopedChanges);
             const addedChanges = (0, filter_1.filterChangesBySeverity)(minSeverity, filteredChanges).filter(change => change.change_type === 'added' &&
                 change.vulnerabilities !== undefined &&
                 change.vulnerabilities.length > 0);
@@ -326,7 +326,7 @@ function renderScannedDependency(change) {
         added: '+',
         removed: '-'
     }[changeType];
-    return `${ansi_styles_1.default.color[color].open}${icon} ${change.manifest}@${change.version}${ansi_styles_1.default.color[color].close}`;
+    return `${ansi_styles_1.default.color[color].open}${icon} ${change.name}@${change.version}${ansi_styles_1.default.color[color].close}`;
 }
 function printScannedDependencies(changes) {
     core.group('Dependency Changes', () => __awaiter(this, void 0, void 0, function* () {
@@ -15118,7 +15118,7 @@ exports.readConfigFile = readConfigFile;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.filterOutAllowedAdvisories = exports.filterChangesByScopes = exports.filterChangesBySeverity = void 0;
+exports.filterAllowedAdvisories = exports.filterChangesByScopes = exports.filterChangesBySeverity = void 0;
 const schemas_1 = __nccwpck_require__(1129);
 function filterChangesBySeverity(severity, changes) {
     const severityIdx = schemas_1.SEVERITIES.indexOf(severity);
@@ -15154,9 +15154,17 @@ function filterChangesByScopes(scopes, changes) {
     return filteredChanges;
 }
 exports.filterChangesByScopes = filterChangesByScopes;
-function filterOutAllowedAdvisories(ghsas, changes) {
+/**
+ * Filter out changes that are allowed by the allow_ghsas config
+ * option. We want to remove these changes before we do any
+ * processing.
+ * @param ghsas - list of GHSA IDs to allow
+ * @param changes - list of changes to filter
+ * @returns a list of changes with the allowed GHSAs removed
+ */
+function filterAllowedAdvisories(ghsas, changes) {
     if (ghsas === undefined) {
-        return [];
+        return changes;
     }
     const filteredChanges = changes.filter(change => {
         const noAdvisories = change.vulnerabilities === undefined ||
@@ -15177,7 +15185,7 @@ function filterOutAllowedAdvisories(ghsas, changes) {
     });
     return filteredChanges;
 }
-exports.filterOutAllowedAdvisories = filterOutAllowedAdvisories;
+exports.filterAllowedAdvisories = filterAllowedAdvisories;
 
 
 /***/ }),

src/filter.ts

@@ -51,12 +51,20 @@ export function filterChangesByScopes(
   return filteredChanges
 }
 
-export function filterOutAllowedAdvisories(
+/**
+ * Filter out changes that are allowed by the allow_ghsas config
+ * option. We want to remove these changes before we do any
+ * processing.
+ * @param ghsas - list of GHSA IDs to allow
+ * @param changes - list of changes to filter
+ * @returns a list of changes with the allowed GHSAs removed
+ */
+export function filterAllowedAdvisories(
   ghsas: string[] | undefined,
   changes: Changes
 ): Changes {
   if (ghsas === undefined) {
-    return []
+    return changes
   }
 
   const filteredChanges = changes.filter(change => {

src/main.ts

@@ -8,7 +8,7 @@ import {readConfig} from '../src/config'
 import {
   filterChangesBySeverity,
   filterChangesByScopes,
-  filterOutAllowedAdvisories
+  filterAllowedAdvisories
 } from '../src/filter'
 import {getDeniedLicenseChanges} from './licenses'
 import * as summary from './summary'
@@ -30,7 +30,7 @@ async function run(): Promise<void> {
 
     const minSeverity = config.fail_on_severity as Severity
     const scopedChanges = filterChangesByScopes(config.fail_on_scopes, changes)
-    const filteredChanges = filterOutAllowedAdvisories(
+    const filteredChanges = filterAllowedAdvisories(
       config.allow_ghsas,
       scopedChanges
     )
@@ -192,7 +192,7 @@ function renderScannedDependency(change: Change): string {
     } as const
   )[changeType]
 
-  return `${styles.color[color].open}${icon} ${change.manifest}@${change.version}${styles.color[color].close}`
+  return `${styles.color[color].open}${icon} ${change.name}@${change.version}${styles.color[color].close}`
 }
 
 function printScannedDependencies(changes: Changes): void {