actions/dependency-review-action
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixing circular reference, adding prettier.

Browse Source
This commit is contained in:
Federico Builes
2022-06-01 12:09:11 +02:00
parent db9f724163
commit f9a13e70f4
8 changed files with 153 additions and 206 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
__tests__/config.test.ts
View File

@@ -1,22 +1,22 @@
import { expect, test } from '@jest/globals'
import { readConfigFile } from '../src/config'
import {expect, test} from '@jest/globals'
import {readConfigFile} from '../src/config'
test('reads the config file', async () => {
let options = readConfigFile("./__tests__/fixtures/config-allow-sample.yml")
expect(options.fail_on_severity).toEqual('critical')
expect(options.allow_licenses).toEqual(['BSD', 'GPL 2'])
let options = readConfigFile('./__tests__/fixtures/config-allow-sample.yml')
expect(options.fail_on_severity).toEqual('critical')
expect(options.allow_licenses).toEqual(['BSD', 'GPL 2'])
})
test('has a default config filepath', async () => {
expect(true).toEqual(true)
expect(true).toEqual(true)
})
test('the default config path handles .yml and .yaml', async () => {
expect(true).toEqual(true)
expect(true).toEqual(true)
})
test('returns a default config when the config file was not found', async () => {
let options = readConfigFile("fixtures/i-dont-exist")
expect(options.fail_on_severity).toEqual('low')
expect(options.allow_licenses).toEqual([])
let options = readConfigFile('fixtures/i-dont-exist')
expect(options.fail_on_severity).toEqual('low')
expect(options.allow_licenses).toEqual([])
})

90
__tests__/filter.test.ts
View File

@@ -1,54 +1,54 @@
import { expect, test } from '@jest/globals'
import { Change, Changes } from '../src/schemas'
import { filterChangesBySeverity } from '../src/filter'
import {expect, test} from '@jest/globals'
import {Change, Changes} from '../src/schemas'
import {filterChangesBySeverity} from '../src/filter'
let npmChange: Change = {
manifest: "package.json",
change_type: "added",
ecosystem: "npm",
name: "Reeuhq",
version: "1.0.2",
package_url: "somepurl",
license: "MIT",
source_repository_url: "github.com/some-repo",
vulnerabilities: [
{
severity: "critical",
advisory_ghsa_id: "first-random_string",
advisory_summary: "very dangerouns",
advisory_url: "github.com/future-funk"
}
]
manifest: 'package.json',
change_type: 'added',
ecosystem: 'npm',
name: 'Reeuhq',
version: '1.0.2',
package_url: 'somepurl',
license: 'MIT',
source_repository_url: 'github.com/some-repo',
vulnerabilities: [
{
severity: 'critical',
advisory_ghsa_id: 'first-random_string',
advisory_summary: 'very dangerouns',
advisory_url: 'github.com/future-funk'
}
]
}
let rubyChange: Change = {
change_type: "added",
manifest: "Gemfile.lock",
ecosystem: "rubygems",
name: "actionsomething",
version: "3.2.0",
package_url: "somerubypurl",
license: "BSD",
source_repository_url: "github.com/some-repo",
vulnerabilities: [
{
severity: "moderate",
advisory_ghsa_id: "second-random_string",
advisory_summary: "not so dangerouns",
advisory_url: "github.com/future-funk"
},
{
severity: "low",
advisory_ghsa_id: "third-random_string",
advisory_summary: "dont page me",
advisory_url: "github.com/future-funk"
},
]
change_type: 'added',
manifest: 'Gemfile.lock',
ecosystem: 'rubygems',
name: 'actionsomething',
version: '3.2.0',
package_url: 'somerubypurl',
license: 'BSD',
source_repository_url: 'github.com/some-repo',
vulnerabilities: [
{
severity: 'moderate',
advisory_ghsa_id: 'second-random_string',
advisory_summary: 'not so dangerouns',
advisory_url: 'github.com/future-funk'
},
{
severity: 'low',
advisory_ghsa_id: 'third-random_string',
advisory_summary: 'dont page me',
advisory_url: 'github.com/future-funk'
}
]
}
test('it properly filters changes by severity', async () => {
let changes = [npmChange, rubyChange]
const expectedChanges = [npmChange]
changes = filterChangesBySeverity('high', changes)
expect(changes).toEqual(expectedChanges)
let changes = [npmChange, rubyChange]
const expectedChanges = [npmChange]
changes = filterChangesBySeverity('high', changes)
expect(changes).toEqual(expectedChanges)
})

111
dist/index.js generated vendored
View File

@@ -1,74 +1,6 @@
require('./sourcemap-register.js');/******/ (() => { // webpackBootstrap
/******/ var __webpack_modules__ = ({
/***/ 88:
/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
__setModuleDefault(result, mod);
return result;
};
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.readConfigFile = exports.CONFIG_FILEPATH = exports.SEVERITIES = void 0;
const fs = __importStar(__nccwpck_require__(7147));
const yaml_1 = __importDefault(__nccwpck_require__(4083));
const schemas_1 = __nccwpck_require__(8774);
const path_1 = __importDefault(__nccwpck_require__(1017));
exports.SEVERITIES = ["critical", "high", "moderate", "low"];
exports.CONFIG_FILEPATH = "./.github/dep-review.yml";
function readConfigFile(filePath = exports.CONFIG_FILEPATH) {
// By default we want to fail on all severities and allow all licenses.
const defaultOptions = {
fail_on_severity: 'low',
allow_licenses: []
};
let data;
try {
data = fs.readFileSync(path_1.default.resolve(filePath), "utf-8");
}
catch (error) {
if (error.code && error.code === 'ENOENT') {
return defaultOptions;
}
else {
throw error;
}
}
// This is a copy of line 34, not sure why this is failing!
schemas_1.ConfigurationOptionsSchema.parse({ fail_on_severity: 'critical', allow_licenses: ['BSD', 'GPL 2'] });
const values = yaml_1.default.parse(data);
const parsed = schemas_1.ConfigurationOptionsSchema.parse(values);
return parsed;
}
exports.readConfigFile = readConfigFile;
/***/ }),
/***/ 4966:
/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
@@ -277,9 +209,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
return result;
};
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = void 0;
exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SEVERITIES = void 0;
const z = __importStar(__nccwpck_require__(3301));
const config_1 = __nccwpck_require__(88);
exports.SEVERITIES = ['critical', 'high', 'moderate', 'low'];
exports.ChangeSchema = z.object({
change_type: z.enum(['added', 'removed']),
manifest: z.string(),
@@ -304,11 +236,13 @@ exports.PullRequestSchema = z.object({
base: z.object({ sha: z.string() }),
head: z.object({ sha: z.string() })
});
exports.ConfigurationOptionsSchema = z.object({
fail_on_severity: z.enum(config_1.SEVERITIES).default("low"),
exports.ConfigurationOptionsSchema = z
.object({
fail_on_severity: z.enum(exports.SEVERITIES).default('low'),
allow_licenses: z.array(z.string()).default([]),
deny_licenses: z.array(z.string()).default([])
}).partial()
})
.partial()
.refine(obj => !(obj.allow_licenses && obj.deny_licenses), "Can't specify both allow_licenses and deny_licenses");
exports.ChangesSchema = z.array(exports.ChangeSchema);
@@ -13694,13 +13628,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.readConfigFile = exports.CONFIG_FILEPATH = exports.SEVERITIES = void 0;
exports.readConfigFile = exports.CONFIG_FILEPATH = void 0;
const fs = __importStar(__nccwpck_require__(7147));
const yaml_1 = __importDefault(__nccwpck_require__(4083));
const schemas_1 = __nccwpck_require__(1129);
const path_1 = __importDefault(__nccwpck_require__(1017));
exports.SEVERITIES = ["critical", "high", "moderate", "low"];
exports.CONFIG_FILEPATH = "./.github/dep-review.yml";
exports.CONFIG_FILEPATH = './.github/dep-review.yml';
function readConfigFile(filePath = exports.CONFIG_FILEPATH) {
// By default we want to fail on all severities and allow all licenses.
const defaultOptions = {
@@ -13709,7 +13642,7 @@ function readConfigFile(filePath = exports.CONFIG_FILEPATH) {
};
let data;
try {
data = fs.readFileSync(path_1.default.resolve(filePath), "utf-8");
data = fs.readFileSync(path_1.default.resolve(filePath), 'utf-8');
}
catch (error) {
if (error.code && error.code === 'ENOENT') {
@@ -13719,8 +13652,6 @@ function readConfigFile(filePath = exports.CONFIG_FILEPATH) {
throw error;
}
}
// This is a copy of line 34, not sure why this is failing!
schemas_1.ConfigurationOptionsSchema.parse({ fail_on_severity: 'critical', allow_licenses: ['BSD', 'GPL 2'] });
const values = yaml_1.default.parse(data);
const parsed = schemas_1.ConfigurationOptionsSchema.parse(values);
return parsed;
@@ -13737,24 +13668,24 @@ exports.readConfigFile = readConfigFile;
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.filterChangesBySeverity = void 0;
const config_1 = __nccwpck_require__(6373);
const schemas_1 = __nccwpck_require__(1129);
function filterChangesBySeverity(severity, changes) {
const severityIdx = config_1.SEVERITIES.indexOf(severity);
const severityIdx = schemas_1.SEVERITIES.indexOf(severity);
for (let change of changes) {
if (change === undefined ||
change.vulnerabilities === undefined ||
change.vulnerabilities.length === 0) {
continue;
}
change.vulnerabilities = change.vulnerabilities.filter((vuln) => {
const vulnIdx = config_1.SEVERITIES.indexOf(vuln.severity);
change.vulnerabilities = change.vulnerabilities.filter(vuln => {
const vulnIdx = schemas_1.SEVERITIES.indexOf(vuln.severity);
if (vulnIdx <= severityIdx) {
return true;
}
});
}
// don't want to deal with changes with no vulnerabilities
let filteredChanges = changes.filter((change) => change.vulnerabilities.length > 0);
let filteredChanges = changes.filter(change => change.vulnerabilities.length > 0);
return filteredChanges;
}
exports.filterChangesBySeverity = filterChangesBySeverity;
@@ -13791,9 +13722,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
return result;
};
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = void 0;
exports.ChangesSchema = exports.ConfigurationOptionsSchema = exports.PullRequestSchema = exports.ChangeSchema = exports.SEVERITIES = void 0;
const z = __importStar(__nccwpck_require__(3301));
const config_1 = __nccwpck_require__(6373);
exports.SEVERITIES = ['critical', 'high', 'moderate', 'low'];
exports.ChangeSchema = z.object({
change_type: z.enum(['added', 'removed']),
manifest: z.string(),
@@ -13818,11 +13749,13 @@ exports.PullRequestSchema = z.object({
base: z.object({ sha: z.string() }),
head: z.object({ sha: z.string() })
});
exports.ConfigurationOptionsSchema = z.object({
fail_on_severity: z.enum(config_1.SEVERITIES).default("low"),
exports.ConfigurationOptionsSchema = z
.object({
fail_on_severity: z.enum(exports.SEVERITIES).default('low'),
allow_licenses: z.array(z.string()).default([]),
deny_licenses: z.array(z.string()).default([])
}).partial()
})
.partial()
.refine(obj => !(obj.allow_licenses && obj.deny_licenses), "Can't specify both allow_licenses and deny_licenses");
exports.ChangesSchema = z.array(exports.ChangeSchema);

2
dist/index.js.map generated vendored
View File

File diff suppressed because one or more lines are too long

50
src/config.ts
View File

@@ -1,37 +1,33 @@
import * as fs from 'fs'
import YAML from 'yaml'
import { ConfigurationOptions, ConfigurationOptionsSchema } from './schemas'
import {ConfigurationOptions, ConfigurationOptionsSchema} from './schemas'
import path from 'path'
export type Severity = "critical" | "high" | "moderate" | "low"
export const CONFIG_FILEPATH = './.github/dep-review.yml'
export const SEVERITIES = ["critical", "high", "moderate", "low"] as const
export const CONFIG_FILEPATH = "./.github/dep-review.yml"
export function readConfigFile(
filePath: string = CONFIG_FILEPATH
): ConfigurationOptions {
// By default we want to fail on all severities and allow all licenses.
const defaultOptions: ConfigurationOptions = {
fail_on_severity: 'low',
allow_licenses: []
}
export function readConfigFile(filePath: string = CONFIG_FILEPATH): ConfigurationOptions {
// By default we want to fail on all severities and allow all licenses.
const defaultOptions: ConfigurationOptions = {
fail_on_severity: 'low',
allow_licenses: []
let data
try {
data = fs.readFileSync(path.resolve(filePath), 'utf-8')
} catch (error: any) {
if (error.code && error.code === 'ENOENT') {
return defaultOptions
} else {
throw error
}
}
let data
const values = YAML.parse(data)
const parsed = ConfigurationOptionsSchema.parse(values)
try {
data = fs.readFileSync(path.resolve(filePath), "utf-8");
} catch (error: any) {
if (error.code && error.code === 'ENOENT') {
return defaultOptions
} else {
throw error
}
}
// This is a copy of line 34, not sure why this is failing!
ConfigurationOptionsSchema.parse({ fail_on_severity: 'critical', allow_licenses: ['BSD', 'GPL 2'] })
const values = YAML.parse(data)
const parsed = ConfigurationOptionsSchema.parse(values)
return parsed;
return parsed
}

45
src/filter.ts
View File

@@ -1,24 +1,31 @@
import { Changes } from './schemas'
import { Severity, SEVERITIES } from './config'
import {Changes} from './schemas'
import {Severity, SEVERITIES} from './schemas'
export function filterChangesBySeverity(severity: Severity, changes: Changes): Changes {
const severityIdx = SEVERITIES.indexOf(severity)
export function filterChangesBySeverity(
severity: Severity,
changes: Changes
): Changes {
const severityIdx = SEVERITIES.indexOf(severity)
for (let change of changes) {
if (change === undefined ||
change.vulnerabilities === undefined ||
change.vulnerabilities.length === 0) {
continue
}
change.vulnerabilities = change.vulnerabilities.filter((vuln: any) => {
const vulnIdx = SEVERITIES.indexOf(vuln.severity)
if (vulnIdx <= severityIdx) {
return true
}
})
for (let change of changes) {
if (
change === undefined ||
change.vulnerabilities === undefined ||
change.vulnerabilities.length === 0
) {
continue
}
change.vulnerabilities = change.vulnerabilities.filter(vuln => {
const vulnIdx = SEVERITIES.indexOf(vuln.severity)
if (vulnIdx <= severityIdx) {
return true
}
})
}
// don't want to deal with changes with no vulnerabilities
let filteredChanges = changes.filter((change: any) => change.vulnerabilities.length > 0)
return filteredChanges
// don't want to deal with changes with no vulnerabilities
let filteredChanges = changes.filter(
change => change.vulnerabilities.length > 0
)
return filteredChanges
}

16
src/main.ts
View File

@@ -2,10 +2,10 @@ import * as core from '@actions/core'
import * as dependencyGraph from './dependency-graph'
import * as github from '@actions/github'
import styles from 'ansi-styles'
import { RequestError } from '@octokit/request-error'
import { Change, PullRequestSchema } from './schemas'
import { Severity, readConfigFile } from '../src/config'
import { filterChangesBySeverity } from '../src/filter'
import {RequestError} from '@octokit/request-error'
import {Change, PullRequestSchema, Severity} from './schemas'
import {readConfigFile} from '../src/config'
import {filterChangesBySeverity} from '../src/filter'
async function run(): Promise<void> {
try {
@@ -30,7 +30,10 @@ async function run(): Promise<void> {
let minSeverity = config.fail_on_severity
let failed = false
let filteredChanges = filterChangesBySeverity(minSeverity as Severity, changes)
let filteredChanges = filterChangesBySeverity(
minSeverity as Severity,
changes
)
for (const change of filteredChanges) {
if (
@@ -70,7 +73,8 @@ async function run(): Promise<void> {
function printChangeVulnerabilities(change: Change) {
for (const vuln of change.vulnerabilities) {
core.info(
`${styles.bold.open}${change.manifest} » ${change.name}@${change.version
`${styles.bold.open}${change.manifest} » ${change.name}@${
change.version
}${styles.bold.close} – ${vuln.advisory_summary} ${renderSeverity(
vuln.severity
)}`

25
src/schemas.ts
View File

@@ -1,5 +1,6 @@
import * as z from 'zod'
import { SEVERITIES } from './config'
export const SEVERITIES = ['critical', 'high', 'moderate', 'low'] as const
export const ChangeSchema = z.object({
change_type: z.enum(['added', 'removed']),
@@ -25,19 +26,25 @@ export const ChangeSchema = z.object({
export const PullRequestSchema = z.object({
number: z.number(),
base: z.object({ sha: z.string() }),
head: z.object({ sha: z.string() })
base: z.object({sha: z.string()}),
head: z.object({sha: z.string()})
})
export const ConfigurationOptionsSchema = z.object({
fail_on_severity: z.enum(SEVERITIES).default("low"),
allow_licenses: z.array(z.string()).default([]),
deny_licenses: z.array(z.string()).default([])
}).partial()
.refine(obj => !(obj.allow_licenses && obj.deny_licenses), "Can't specify both allow_licenses and deny_licenses")
export const ConfigurationOptionsSchema = z
.object({
fail_on_severity: z.enum(SEVERITIES).default('low'),
allow_licenses: z.array(z.string()).default([]),
deny_licenses: z.array(z.string()).default([])
})
.partial()
.refine(
obj => !(obj.allow_licenses && obj.deny_licenses),
"Can't specify both allow_licenses and deny_licenses"
)
export const ChangesSchema = z.array(ChangeSchema)
export type Change = z.infer<typeof ChangeSchema>
export type Changes = z.infer<typeof ChangesSchema>
export type ConfigurationOptions = z.infer<typeof ConfigurationOptionsSchema>
export type Severity = typeof SEVERITIES[number]