actions/dependency-review-action
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
NaN Commits 1 Branch 0 Tags
5a5d4df8ad0dd154e61910cad81fb3bfe8f692ae
Commit Graph

144 Commits

Author SHA1 Message Date
Jacques-Etienne Beaudet
4eb8182aba Support SPDX expressions in allow/deny lists 
This change updates license validation to support full SPDX expressions
(such as 'EPL-1.0 AND LGPL-2.1') in both allow-lists and deny-lists. This
enables the action to correctly validate packages that declare multiple
licenses using SPDX conjunctions like AND/OR, which are common in complex
open-source projects.

Previously, only simple license identifiers were supported, which caused
multi-licensed packages to be improperly flagged as invalid even when
they matched the intent of the allow-list.

The new logic uses `spdx.satisfies()` to evaluate whether a package’s
declared license satisfies any expression in the allow/deny list, and
comprehensive tests have been added to verify behavior for various SPDX
combinations.

This improves compatibility with projects using compound SPDX license
expressions and ensures more accurate license policy enforcement.
 2025-04-09 12:19:46 -04:00
Nathan Ellenfield
5e7a6ffc7d fix: Allow removal denied packages 2025-01-27 16:00:09 -05:00
ahmed3lmallah
03e585eea7 fixing minor typo 2024-10-27 23:34:29 -07:00
ahmed3lmallah
304a544dca updating tests 2024-10-27 23:11:58 -07:00
Henri Maurer
83c7cc6aa7 Do not list changes dependencies in summary 2024-09-16 11:29:47 -07:00
Louis Bompart
45dc50cabe fix: getRefs function to handle merge_group events 2024-07-12 14:22:20 +02:00
Justin Holguín
b4ae47ca2c Properly display test failures using jest 2024-06-10 23:07:07 +00:00
Eli Reisman
ed624dba72 more SPDX unit tests to illustrate matching behavior 2024-06-10 09:51:01 -07:00
Eli Reisman
bbed6f340a update licenses pkg and tests 2024-06-10 09:51:01 -07:00
Eli Reisman
2e4eaa490e complete test suite conversions; simplify fn name 2024-06-10 09:51:00 -07:00
Eli Reisman
ecd706f525 register spdx lib as ES Module, start converting call sites to use new spdx pkg - TODO: update tests 2024-06-10 09:51:00 -07:00
Eli Reisman
3c42649204 fix ws for linter 2024-06-04 12:33:48 -07:00
Eli Reisman
1b3d2772d0 post-review: add PR comment full summary test case 2024-06-04 12:30:05 -07:00
Eli Reisman
97c6dd59c3 run prettier to clear linter warnings 2024-06-04 11:50:21 -07:00
Eli Reisman
0bec1ca5b4 clean up list formatting for PR comment 2024-06-04 11:21:15 -07:00
Eli Reisman
5460632ba9 WIP: summary test 2024-06-04 11:21:15 -07:00
Justin Holguín
432d8e7efe Allow slashes in purl package names 2024-05-02 19:11:08 +00:00
Justin Holguín
49fbbe0acb Fix package-url parsing for allow-dependencies-licenses 2024-04-29 23:24:15 +00:00
Justin Holguín
5f0808ffb1 Validate that deny-packages purls are complete 2024-04-29 16:46:21 +00:00
Justin Holguín
fcc66c23b3 Refine purl parsing and tests 2024-04-28 20:33:37 +00:00
Justin Holguín
1dd418bcb3 Basic tests for PURL validation in config 2024-04-27 22:16:46 +00:00
Justin Holguín
640617990f Replace packageurl-js with our own implementation 2024-04-27 21:26:06 +00:00
Brandon Teng
c32a0148b3 throwing parsing error up instead of swallowing it 2024-04-16 16:25:28 -05:00
Brandon Teng
67d0214607 simplifying tests 2024-04-16 16:04:25 -05:00
Brandon Teng
3ca15314ff transforming package URLs during zod parsing 2024-04-16 16:04:11 -05:00
Brandon Teng
a318e62c6c using packageurl-js to parse packages and groups from config 2024-04-16 12:44:51 -05:00
Brandon Teng
a323510dae more refactoring for getDeniedChanges 2024-04-04 15:18:51 -05:00
Brandon Teng
411e5ec44f updating deny-packages config option to deny exact version or wildcard 2024-04-04 13:25:54 -05:00
Federico Builes
0e665bf3ac Adding a failing test. 
Co-authored-by: Brandon Teng <bteng22@github.com>
 2024-03-27 15:05:17 +01:00
Justin Hutchings
d684d038b2 Add trailing slash to tests 2024-03-22 21:21:52 +00:00
Justin Hutchings
d9209374af Fix repositoryUrl issues around GitHub Actions 2024-03-22 21:00:38 +00:00
Justin Hutchings
72666694f0 Fix broken tests, clean up dead code 2024-03-12 21:32:27 +00:00
Justin Hutchings
ac600387ca Add tests 2024-03-12 17:55:10 +00:00
Justin Hutchings
250250e73d Refactor schema, add line numbers to warnings 2024-03-08 02:31:11 +00:00
Justin Hutchings
f8ebb4b946 Add formatting around warning for low scorecard levels 2024-03-04 19:34:29 +00:00
Justin Hutchings
2bc3ecb19b Fix type issues 2024-03-03 06:50:11 +00:00
tgrall
8f3df4d674 fix ci failure on format-check 2024-02-02 06:09:20 +01:00
tgrall
fc49851780 merge from main and fix code review comment from @juxtin 2024-01-28 10:16:07 +01:00
Federico Builes
b39e17ba5e Replace pip -> pypi in PURL examples 2023-12-11 17:23:19 +01:00
Federico Builes
a93fa86c77 Fixing test name. 2023-11-28 08:08:29 +01:00
Federico Builes
4366dbae42 Advisory filters should not drop entire dependencies. 2023-11-24 14:40:18 +01:00
Federico Builes
ded987cb3b Downgrade usage of retries. 
This commit reverts:

f7363549ac
76b050a607
8dc52cdbed
 2023-11-08 08:35:44 +01:00
Federico Builes
8dc52cdbed update tests 2023-10-09 11:23:53 +02:00
Justin Holguín
e81e6e582f Default retry-on-snapshot-warnings to false 
Keeping this true by default means wasting actions minutes for
the vast majority of DR users
 2023-09-06 18:04:16 +00:00
Justin Holguín
ada103783f Merge remote-tracking branch 'origin/retry-on-snapshot-warnings' into juxtin/dr-snaps-pre-launch 2023-08-31 16:31:44 +00:00
Sean Murphy
31afeba06d Add unit tests 2023-08-09 21:10:48 -04:00
Sean Murphy
7ef37f3853 Merge branch 'main' into comment-on-failure 2023-08-09 17:31:16 -04:00
Adrien Pessu
1db9156f85 change from name of the package to the package url to avoid conflict between 2 dependencies with the same name but for different ecosystems 2023-08-08 16:34:23 +02:00
Adrien Pessu
00f1f5b642 add tests and docs 2023-08-07 14:07:46 +02:00
Adrien Pessu
6862f6f65f add groups 2023-08-07 14:07:26 +02:00