Merge branch 'main' into fix/comment-warn-only

src/git-refs.ts

@@ -1,22 +1,34 @@
-import {PullRequestSchema, ConfigurationOptions} from './schemas'
+import {
+  PullRequestSchema,
+  ConfigurationOptions,
+  MergeGroupSchema
+} from './schemas'
 
 export function getRefs(
   config: ConfigurationOptions,
-  context: {payload: {pull_request?: unknown}; eventName: string}
+  context: {
+    payload: {pull_request?: unknown; merge_group?: unknown}
+    eventName: string
+  }
 ): {base: string; head: string} {
   let base_ref = config.base_ref
   let head_ref = config.head_ref
 
   // If possible, source default base & head refs from the GitHub event.
   // The base/head ref from the config take priority, if provided.
-  if (
-    context.eventName === 'pull_request' ||
-    context.eventName === 'pull_request_target' ||
-    context.eventName === 'merge_group'
-  ) {
-    const pull_request = PullRequestSchema.parse(context.payload.pull_request)
-    base_ref = base_ref || pull_request.base.sha
-    head_ref = head_ref || pull_request.head.sha
+  if (!base_ref && !head_ref) {
+    if (
+      context.eventName === 'pull_request' ||
+      context.eventName === 'pull_request_target'
+    ) {
+      const pull_request = PullRequestSchema.parse(context.payload.pull_request)
+      base_ref = base_ref || pull_request.base.sha
+      head_ref = head_ref || pull_request.head.sha
+    } else if (context.eventName === 'merge_group') {
+      const merge_group = MergeGroupSchema.parse(context.payload.merge_group)
+      base_ref = base_ref || merge_group.base_sha
+      head_ref = head_ref || merge_group.head_sha
+    }
   }
 
   if (!base_ref && !head_ref) {

src/main.ts

@@ -168,7 +168,7 @@ async function run(): Promise<void> {
     }
 
     core.setOutput('dependency-changes', JSON.stringify(changes))
-    summary.addScannedDependencies(changes)
+    summary.addScannedFiles(changes)
     printScannedDependencies(changes)
 
     // include full summary in output; Actions will truncate if oversized

src/schemas.ts

@@ -91,6 +91,11 @@ export const PullRequestSchema = z.object({
   head: z.object({sha: z.string()})
 })
 
+export const MergeGroupSchema = z.object({
+  base_sha: z.string(),
+  head_sha: z.string()
+})
+
 export const ConfigurationOptionsSchema = z
   .object({
     fail_on_severity: SeveritySchema,

src/summary.ts

@@ -1,7 +1,7 @@
 import * as core from '@actions/core'
-import {ConfigurationOptions, Changes, Change, Scorecard} from './schemas'
 import {SummaryTableRow} from '@actions/core/lib/summary'
 import {InvalidLicenseChanges, InvalidLicenseChangeTypes} from './licenses'
+import {Change, Changes, ConfigurationOptions, Scorecard} from './schemas'
 import {groupDependenciesByManifest, getManifestsSet, renderUrl} from './utils'
 
 const icons = {
@@ -10,6 +10,8 @@ const icons = {
   warning: '⚠️'
 }
 
+const MAX_SCANNED_FILES_BYTES = 1048576
+
 // generates the DR report summmary and caches it to the Action's core.summary.
 // returns the DR summary string, ready to be posted as a PR comment if the
 // final DR report is too large
@@ -263,21 +265,33 @@ function formatLicense(license: string | null): string {
   return license
 }
 
-export function addScannedDependencies(changes: Changes): void {
-  const dependencies = groupDependenciesByManifest(changes)
-  const manifests = dependencies.keys()
+export function addScannedFiles(changes: Changes): void {
+  const manifests = Array.from(
+    groupDependenciesByManifest(changes).keys()
+  ).sort()
 
-  const summary = core.summary.addHeading('Scanned Manifest Files', 2)
+  let sf_size = 0
+  let trunc_at = -1
 
-  for (const manifest of manifests) {
-    const deps = dependencies.get(manifest)
-    if (deps) {
-      const dependencyNames = deps.map(
-        dependency => `<li>${dependency.name}@${dependency.version}</li>`
-      )
-      summary.addDetails(manifest, `<ul>${dependencyNames.join('')}</ul>`)
+  for (const [index, entry] of manifests.entries()) {
+    if (sf_size + entry.length >= MAX_SCANNED_FILES_BYTES) {
+      trunc_at = index
+      break
+    }
+    sf_size += entry.length
+  }
+
+  if (trunc_at >= 0) {
+    // truncate the manifests list if it will overflow the summary output
+    manifests.slice(0, trunc_at)
+    // if there's room between cutoff size and list size, add a warning
+    const size_diff = MAX_SCANNED_FILES_BYTES - sf_size
+    if (size_diff < 12) {
+      manifests.push('(truncated)')
     }
   }
+
+  core.summary.addHeading('Scanned Files', 2).addList(manifests)
 }
 
 function snapshotWarningRecommendation(