Jacques-Etienne Beaudet
4eb8182aba
Support SPDX expressions in allow/deny lists
...
This change updates license validation to support full SPDX expressions
(such as 'EPL-1.0 AND LGPL-2.1') in both allow-lists and deny-lists. This
enables the action to correctly validate packages that declare multiple
licenses using SPDX conjunctions like AND/OR, which are common in complex
open-source projects.
Previously, only simple license identifiers were supported, which caused
multi-licensed packages to be improperly flagged as invalid even when
they matched the intent of the allow-list.
The new logic uses `spdx.satisfies()` to evaluate whether a package’s
declared license satisfies any expression in the allow/deny list, and
comprehensive tests have been added to verify behavior for various SPDX
combinations.
This improves compatibility with projects using compound SPDX license
expressions and ensures more accurate license policy enforcement.
2025-04-09 12:19:46 -04:00
Barry Gordon
479b69732e
Prepare 4.6.0
2025-04-01 12:22:08 +01:00
Barry Gordon
51699b6461
Merge pull request #855 from ailox/ailox/fix/invalid-new-licenses
...
Update transitive dependency spdx-license-ids
2025-04-01 11:33:12 +01:00
Roman Iakovlev
d630451aa0
Pin @octokit/types version for compatibility
2025-03-13 14:34:23 +00:00
Roman Iakovlev
c8dafca32b
Add dist for @octokit/plugin-paginate-rest version bump
2025-03-12 16:55:30 +00:00
Roman Iakovlev
cdee0bc8c3
Bump octokit and related dependencies
2025-03-12 10:57:15 +00:00
Nathan Ellenfield
dfe560420d
fix formatting and dist
2025-02-05 15:50:50 -05:00
Nathan Ellenfield
e4033dcc29
Merge remote-tracking branch 'origin/main' into allow-deny-package-removal
2025-02-04 13:33:03 -05:00
Ashely Tenesaca
bf9bc3f2a6
generate dist code
2025-02-03 17:25:46 +00:00
Nathan Ellenfield
c80eb9894b
fixit
2025-01-27 16:01:10 -05:00
Nathan Ellenfield
5e7a6ffc7d
fix: Allow removal denied packages
2025-01-27 16:00:09 -05:00
Ahmed ElMallah
8992b0e1c7
updating dist code
2025-01-24 20:01:21 +00:00
Ahmed ElMallah
5f24a51147
Updating dist folder
2025-01-23 21:07:48 +00:00
Paul Scheunemann
67fc6dd646
Update compiled assets
2025-01-09 15:15:28 +01:00
Ahmed ElMallah
d6807b6643
updating generated code
2024-11-20 21:42:05 +00:00
Eric Bickle
fb86db2043
fix: resolve race conditions in async core.group calls
2024-11-19 14:17:06 -08:00
Eric Bickle
fc499fc13a
Merge branch 'main' into fix/comment-warn-only
2024-11-19 12:51:47 -08:00
Ahmed ElMallah
612e96e757
updating dist code
2024-11-18 22:36:35 +00:00
ahmed3lmallah
08b4117924
updating dist code
2024-10-27 23:30:45 -07:00
ahmed3lmallah
9c3441f7ee
updating dist code
2024-10-27 23:12:50 -07:00
ahmed3lmallah
d92f08b3ff
Bump eslint-plugin-jest and ts-jest
2024-10-21 15:16:32 -07:00
Eli Reisman
05042db2b6
update dist packaging
2024-09-16 12:42:52 -07:00
Henri Maurer
83c7cc6aa7
Do not list changes dependencies in summary
2024-09-16 11:29:47 -07:00
Eric Bickle
ac1d2d7d35
fix: add summary comment on failure when warn-only: true
2024-09-06 12:24:42 -07:00
Louis Bompart
45dc50cabe
fix: getRefs function to handle merge_group events
2024-07-12 14:22:20 +02:00
Justin Holguín
0085d30a6f
Update dist
2024-07-10 17:47:42 +00:00
Eli Reisman
f60d59372e
npm run package
2024-06-10 09:52:17 -07:00
Eli Reisman
1e5b2e69a2
npm run package
2024-06-07 10:00:47 -07:00
Eli Reisman
2224c7c05a
npm run package to update dist
2024-06-07 09:35:26 -07:00
Eli Reisman
8e6ea8d29b
update packaging
2024-06-04 12:30:34 -07:00
Eli Reisman
087d0f81a5
repackage to update dist
2024-06-04 11:50:22 -07:00
Justin Hutchings
1e26117d02
Fix extra whitespace in list
2024-06-04 11:20:27 -07:00
Justin Hutchings
b1e704b9d6
Fix bug where I replaced the comment in the wrong spot
2024-06-04 11:20:19 -07:00
Justin Hutchings
48fae2e703
Add min-comment to fix max-comment length issue
2024-06-04 11:20:10 -07:00
Josie Anugerah
40cd879447
npm install && npm run build && npm run package
2024-05-07 08:11:58 +10:00
Josie Anugerah
d11eeb39d8
Merge branch 'main' into deps-dev-v3
2024-05-06 17:26:48 +10:00
Justin Holguín
432d8e7efe
Allow slashes in purl package names
2024-05-02 19:11:08 +00:00
Justin Holguín
49fbbe0acb
Fix package-url parsing for allow-dependencies-licenses
2024-04-29 23:24:15 +00:00
Justin Holguín
5f0808ffb1
Validate that deny-packages purls are complete
2024-04-29 16:46:21 +00:00
Justin Holguín
fcc66c23b3
Refine purl parsing and tests
2024-04-28 20:33:37 +00:00
Justin Holguín
1dd418bcb3
Basic tests for PURL validation in config
2024-04-27 22:16:46 +00:00
Justin Holguín
640617990f
Replace packageurl-js with our own implementation
2024-04-27 21:26:06 +00:00
Justin Holguín
2034babb6b
Bypass purls (mostly) for deny checks
2024-04-26 23:17:11 +00:00
Justin Holguín
7e773b1e98
Log offending purl
2024-04-26 21:50:12 +00:00
Justin Holguín
a3460920cc
Parse purls cautiously in getDeniedChanges
2024-04-26 21:28:24 +00:00
Josie Anugerah
2a28e93881
Merge branch 'main' into deps-dev-v3
2024-04-26 14:10:34 +10:00
Brandon Teng
7d44c7c392
building package with latest typescript version
2024-04-24 20:36:47 -05:00
Brandon Teng
ce31ee8325
Merge branch 'main' into deny-list-version
2024-04-24 18:16:35 -05:00
Justin Holguín
7e2c3c347b
Show denied packages with red X
2024-04-24 22:11:24 +00:00
Justin Holguín
ff97293707
Update dist
2024-04-24 21:55:26 +00:00
