Skip to content

Commit d8073c4

Browse files
claire153claire153
authored
Merge pull request #958 from actions/claire153/deprecate-deny-lists
Deprecate deny lists
2 parents 89c7383 + 77184c6 commit d8073c4

File tree

6 files changed

+69
-25
lines changed

6 files changed

+69
-25
lines changed

‎README.md

Lines changed: 19 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ The action is available for:
2424
When the action runs, you can see the results on:
2525

2626
- The **job logs** page.
27-
2827
1. Go to the **Actions** tab for the repository and select the relevant workflow run.
2928
1. Then under "Jobs", click **dependency review**.
3029

@@ -102,25 +101,25 @@ There are various configuration options you can use to specify settings for the
102101

103102
All configuration options are optional.
104103

105-
| Option | Usage | Possible values | Default value |
106-
| -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ------------- |
107-
| `fail-on-severity` | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. | `low`, `moderate`, `high`, `critical` | `low` |
108-
| `allow-licenses`\* | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
109-
| `deny-licenses`\* | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
110-
| `fail-on-scopes` | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown` | `runtime` |
111-
| `allow-ghsas` | Contains a list of GitHub Advisory Database IDs that can be skipped during detection. | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none |
112-
| `license-check` | Enable or disable the license check performed by the action. | `true`, `false` | `true` |
113-
| `vulnerability-check` | Enable or disable the vulnerability check performed by the action. | `true`, `false` | `true` |
114-
| `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks. | Any package(s) in [purl](https://github.com/package-url/purl-spec) format | none |
115-
| `base-ref`/`head-ref` | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`. | Any valid git ref(s) in your project | none |
116-
| `comment-summary-in-pr` | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job the `pull-requests: write` permission. With each execution, a new comment will overwrite the existing one. | `always`, `on-failure`, `never` | `never` |
117-
| `deny-packages` | Any number of packages to block in a PR. This option will match on the exact version provided. If no version is provided, the option will treat the specified package as a wildcard and deny all versions. | Package(s) in [purl](https://github.com/package-url/purl-spec) format | empty |
118-
| `deny-groups` | Any number of groups (namespaces) to block in a PR. | Namespace(s) in [purl](https://github.com/package-url/purl-spec) format (no package name, no version number) | empty |
119-
| `retry-on-snapshot-warnings`\* | Enable or disable retrying the action every 10 seconds while waiting for dependency submission actions to complete. | `true`, `false` | `false` |
120-
| `retry-on-snapshot-warnings-timeout`\* | Maximum amount of time (in seconds) to retry the action while waiting for dependency submission actions to complete. | Any positive integer | 120 |
121-
| `warn-only`+ | When set to `true`, the action will log all vulnerabilities as warnings regardless of the severity, and the action will complete with a `success` status. This overrides the `fail-on-severity` option. | `true`, `false` | `false` |
122-
| `show-openssf-scorecard` | When set to `true`, the action will output information about all the known OpenSSF Scorecard scores for the dependencies changed in this pull request. | `true`, `false` | `true` |
123-
| `warn-on-openssf-scorecard-level` | When `show-openssf-scorecard-levels` is set to `true`, this option lets you configure the threshold for when a score is considered too low and gets a :warning: warning in the CI. | Any positive integer | 3 |
104+
| Option | Usage | Possible values | Default value |
105+
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------ | ------------- |
106+
| `fail-on-severity` | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. | `low`, `moderate`, `high`, `critical` | `low` |
107+
| `allow-licenses`\* | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
108+
| `deny-licenses`\* | ⚠️ This option is deprecated for possible removal in the next major release. See [Deprecate the deny-licenses option #938](https://github.com/actions/dependency-review-action/issues/938) for more information. <br> Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
109+
| `fail-on-scopes` | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown` | `runtime` |
110+
| `allow-ghsas` | Contains a list of GitHub Advisory Database IDs that can be skipped during detection. | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none |
111+
| `license-check` | Enable or disable the license check performed by the action. | `true`, `false` | `true` |
112+
| `vulnerability-check` | Enable or disable the vulnerability check performed by the action. | `true`, `false` | `true` |
113+
| `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks. | Any package(s) in [purl](https://github.com/package-url/purl-spec) format | none |
114+
| `base-ref`/`head-ref` | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`. | Any valid git ref(s) in your project | none |
115+
| `comment-summary-in-pr` | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job the `pull-requests: write` permission. With each execution, a new comment will overwrite the existing one. | `always`, `on-failure`, `never` | `never` |
116+
| `deny-packages` | Any number of packages to block in a PR. This option will match on the exact version provided. If no version is provided, the option will treat the specified package as a wildcard and deny all versions. | Package(s) in [purl](https://github.com/package-url/purl-spec) format | empty |
117+
| `deny-groups` | Any number of groups (namespaces) to block in a PR. | Namespace(s) in [purl](https://github.com/package-url/purl-spec) format (no package name, no version number) | empty |
118+
| `retry-on-snapshot-warnings`\* | Enable or disable retrying the action every 10 seconds while waiting for dependency submission actions to complete. | `true`, `false` | `false` |
119+
| `retry-on-snapshot-warnings-timeout`\* | Maximum amount of time (in seconds) to retry the action while waiting for dependency submission actions to complete. | Any positive integer | 120 |
120+
| `warn-only`+ | When set to `true`, the action will log all vulnerabilities as warnings regardless of the severity, and the action will complete with a `success` status. This overrides the `fail-on-severity` option. | `true`, `false` | `false` |
121+
| `show-openssf-scorecard` | When set to `true`, the action will output information about all the known OpenSSF Scorecard scores for the dependencies changed in this pull request. | `true`, `false` | `true` |
122+
| `warn-on-openssf-scorecard-level` | When `show-openssf-scorecard-levels` is set to `true`, this option lets you configure the threshold for when a score is considered too low and gets a :warning: warning in the CI. | Any positive integer | 3 |
124123

125124
> [!NOTE]
126125
>

‎__tests__/summary.test.ts

Lines changed: 31 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import {expect, jest, test} from '@jest/globals'
2-
import {Change, Changes, ConfigurationOptions, Scorecard} from '../src/schemas'
2+
import {Changes, ConfigurationOptions, Scorecard} from '../src/schemas'
33
import * as summary from '../src/summary'
44
import * as core from '@actions/core'
55
import {createTestChange} from './fixtures/create-test-change'
@@ -109,10 +109,38 @@ test('prints headline as h1', () => {
109109
expect(text).toContain('<h1>Dependency Review</h1>')
110110
})
111111

112+
test('does not add deprecation warning for deny-licenses option if not set', () => {
113+
summary.addSummaryToSummary(
114+
emptyChanges,
115+
emptyInvalidLicenseChanges,
116+
emptyChanges,
117+
scorecard,
118+
defaultConfig
119+
)
120+
const text = core.summary.stringify()
121+
122+
expect(text).not.toContain('deny-licenses')
123+
})
124+
125+
test('adds deprecation warning for deny-licenses option if set', () => {
126+
const config = {...defaultConfig, deny_licenses: ['MIT']}
127+
128+
summary.addSummaryToSummary(
129+
emptyChanges,
130+
emptyInvalidLicenseChanges,
131+
emptyChanges,
132+
scorecard,
133+
config
134+
)
135+
const text = core.summary.stringify()
136+
137+
expect(text).toContain('deny-licenses')
138+
})
139+
112140
test('returns minimal summary formatted for posting as a PR comment', () => {
113141
const OLD_ENV = process.env
114142

115-
let changes: Changes = [
143+
const changes: Changes = [
116144
createTestChange({name: 'lodash', version: '1.2.3'}),
117145
createTestChange({name: 'colors', version: '2.3.4'}),
118146
createTestChange({name: '@foo/bar', version: '*'})
@@ -122,7 +150,7 @@ test('returns minimal summary formatted for posting as a PR comment', () => {
122150
process.env.GITHUB_REPOSITORY = 'owner/repo'
123151
process.env.GITHUB_RUN_ID = 'abc-123-xyz'
124152

125-
let minSummary: string = summary.addSummaryToSummary(
153+
const minSummary: string = summary.addSummaryToSummary(
126154
changes,
127155
emptyInvalidLicenseChanges,
128156
emptyChanges,

0 commit comments

Comments
 (0)