Skip to content

Commit 554aaf5

Browse files
author
Federico Builes
authored
Merge pull request #423 from theztefan/allow-list-dependencies
Exclude dependencies from license checks
2 parents 1f7c838 + c6e94c1 commit 554aaf5

File tree

15 files changed

+794
-6944
lines changed

15 files changed

+794
-6944
lines changed

‎README.md

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -66,19 +66,20 @@ jobs:
6666

6767
Configure this action by either inlining these options in your workflow file, or by using an external configuration file. All configuration options are optional.
6868

69-
| Option | Usage | Possible values | Default value |
70-
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------- |
71-
| `fail-on-severity` | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. | `low`, `moderate`, `high`, `critical` | `low` |
72-
| `allow-licenses`* | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
73-
| `deny-licenses`* | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
74-
| `fail-on-scopes`† | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown` | `runtime` |
75-
| `allow-ghsas` | Contains a list of GitHub Advisory Database IDs that can be skipped during detection. | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none |
76-
| `license-check` | Enable or disable the license check performed by the action. | `true`, `false` | `true` |
77-
| `vulnerability-check` | Enable or disable the vulnerability check performed by the action. | `true`, `false` | `true` |
78-
| `base-ref`/`head-ref` | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`. | Any valid git ref(s) in your project | none |
79-
| `comment-summary-in-pr` | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`. | `true`, `false` | `false` |
80-
81-
*not supported for use with GitHub Enterprise Server
69+
| Option | Usage | Possible values | Default value |
70+
| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------- |
71+
| `fail-on-severity` | Defines the threshold for the level of severity. The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. | `low`, `moderate`, `high`, `critical` | `low` |
72+
| `allow-licenses`\* | Contains a list of allowed licenses. The action will fail on pull requests that introduce dependencies with licenses that do not match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
73+
| `deny-licenses`\* | Contains a list of prohibited licenses. The action will fail on pull requests that introduce dependencies with licenses that match the list. | Any [SPDX-compliant identifier(s)](https://spdx.org/licenses/) | none |
74+
| `fail-on-scopes`† | Contains a list of strings of the build environments you want to support. The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list. | `runtime`, `development`, `unknown` | `runtime` |
75+
| `allow-ghsas` | Contains a list of GitHub Advisory Database IDs that can be skipped during detection. | Any GHSAs from the [GitHub Advisory Database](https://github.com/advisories) | none |
76+
| `license-check` | Enable or disable the license check performed by the action. | `true`, `false` | `true` |
77+
| `vulnerability-check` | Enable or disable the vulnerability check performed by the action. | `true`, `false` | `true` |
78+
| `allow-dependencies-licenses`\* | Contains a list of packages that will be excluded from license checks. | Any package(s) in [purl](https://github.com/package-url/purl-spec) format | none |
79+
| `base-ref`/`head-ref` | Provide custom git references for the git base/head when performing the comparison check. This is only used for event types other than `pull_request` and `pull_request_target`. | Any valid git ref(s) in your project | none |
80+
| `comment-summary-in-pr` | Enable or disable reporting the review summary as a comment in the pull request. If enabled, you must give the workflow or job permission `pull-requests: write`. | `true`, `false` | `false` |
81+
82+
\*not supported for use with GitHub Enterprise Server
8283

8384
†will be supported with GitHub Enterprise Server 3.8
8485

@@ -139,6 +140,8 @@ allow_licenses:
139140
- 'MIT'
140141
```
141142

143+
For more examples of how to use this action and its configuration options, see the [examples](docs/examples.md) page.
144+
142145
### Considerations
143146

144147
- Checking for licenses is not supported on Enterprise Server.

‎__tests__/licenses.test.ts

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,32 @@ const rubyChange: Change = {
4949
]
5050
}
5151

52+
const pipChange: Change = {
53+
change_type: 'added',
54+
manifest: 'requirements.txt',
55+
ecosystem: 'pip',
56+
name: 'package-1',
57+
version: '1.1.1',
58+
package_url: 'pkg:pip/[email protected]',
59+
license: 'MIT',
60+
source_repository_url: 'github.com/some-repo',
61+
scope: 'runtime',
62+
vulnerabilities: [
63+
{
64+
severity: 'moderate',
65+
advisory_ghsa_id: 'second-random_string',
66+
advisory_summary: 'not so dangerous',
67+
advisory_url: 'github.com/future-funk'
68+
},
69+
{
70+
severity: 'low',
71+
advisory_ghsa_id: 'third-random_string',
72+
advisory_summary: 'dont page me',
73+
advisory_url: 'github.com/future-funk'
74+
}
75+
]
76+
}
77+
5278
jest.mock('@actions/core')
5379

5480
const mockOctokit = {
@@ -153,6 +179,34 @@ test('it adds all licenses to unresolved if it is unable to determine the validi
153179
expect(invalidLicenses.unresolved.length).toEqual(2)
154180
})
155181

182+
test('it does not filter out changes that are on the exclusions list', async () => {
183+
const changes: Changes = [pipChange, npmChange, rubyChange]
184+
const licensesConfig = {
185+
allow: ['BSD'],
186+
licenseExclusions: ['pkg:pip/[email protected]', 'pkg:npm/[email protected]']
187+
}
188+
const invalidLicenses = await getInvalidLicenseChanges(
189+
changes,
190+
licensesConfig
191+
)
192+
expect(invalidLicenses.forbidden.length).toEqual(0)
193+
})
194+
195+
test('it does filters out changes if they are not on the exclusions list', async () => {
196+
const changes: Changes = [pipChange, npmChange, rubyChange]
197+
const licensesConfig = {
198+
allow: ['BSD'],
199+
licenseExclusions: ['pkg:pip/[email protected]', 'pkg:npm/[email protected]']
200+
}
201+
const invalidLicenses = await getInvalidLicenseChanges(
202+
changes,
203+
licensesConfig
204+
)
205+
expect(invalidLicenses.forbidden.length).toEqual(2)
206+
expect(invalidLicenses.forbidden[0]).toBe(pipChange)
207+
expect(invalidLicenses.forbidden[1]).toBe(npmChange)
208+
})
209+
156210
describe('GH License API fallback', () => {
157211
test('it calls licenses endpoint if atleast one of the changes has null license and valid source_repository_url', async () => {
158212
const nullLicenseChange = {

‎action.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ inputs:
2929
deny-licenses:
3030
description: Comma-separated list of forbidden licenses (e.g. "MIT, GPL 3.0, BSD 2 Clause")
3131
required: false
32+
allow-dependencies-licenses:
33+
description: Comma-separated list of dependencies in purl format (e.g. "pkg:npm/express, pkg:pip/pycrypto"). These dependencies will be permitted to use any license, no matter what license policy is enforced otherwise.
34+
required: false
3235
allow-ghsas:
3336
description: Comma-separated list of allowed GitHub Advisory IDs (e.g. "GHSA-abcd-1234-5679, GHSA-efgh-1234-5679")
3437
required: false

0 commit comments

Comments
 (0)