Add an option to deny packages or groups of packages by adrienpessu · Pull Request #544 · actions/dependency-review-action

adrienpessu · 2023-08-07T12:22:14Z

TL;DR;

The goal is to check if someone is adding specific packages or group of packages in the codebase that isn't supposed to be added.

Context

GitHub customers want to deny access to certain dependencies base on a wide range of criteria other than vulnerabilities and licences.
Some examples of criteria :

The project isn't maintained any more
We don't want to depend on our competitor's open source libraries
We don't want any dependencies of a particular ecosystem because it has a bad reputation (security wise), it depends on an entity based in a country we need to avoid for legal reasons, ...

Since those criteria are wide, the simplest way is to deny based on the name or the group of the packages.

Actions

Add option for a list of denied packages
Add option for a list of denied groups of packages
Add a specific message into the summary
check the denied lists and failed if found
Add tests
Edit Readme

Bumps [prettier](https://github.com/prettier/prettier) from 2.8.8 to 3.0.0. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@2.8.8...3.0.0) --- updated-dependencies: - dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 5.60.1 to 6.2.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v6.2.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

febuiles · 2023-08-07T13:30:22Z

@adrienpessu would you mind adding a bit more context to the PR description? What motivates this change and why was it solved this way?

adrienpessu · 2023-08-07T14:15:08Z

@febuiles Context updated in the description 👍

febuiles · 2023-08-07T15:17:39Z

@adrienpessu thank you for the additional information! From a code POV this looks fine, some things that would be appreciated before merging and releasing a new version:

Add an example configuration to: https://github.com/actions/dependency-review-action/blob/main/docs/examples.md and then link to it from the README changes. This helps us educate users and create release notes.
Create a public repository that uses this action and link to a public run of the Action pointing to your branch (i.e. link to a run of your changes). Example: https://github.com/future-funk/expert-octo-garbanzo/actions/runs/5397412934/job/14612005965?pr=2. This helps us make sure that the code has been tested end to end.

Once these two are done I'll cut the new release.

adrienpessu · 2023-08-08T08:29:55Z

@febuiles I have added the example and I prepared the testing repo : https://github.com/adrienpessu/sample-dependency-review-deny-packages/actions/runs/5794591201?pr=1, I can link it as is, but it uses my forked action. Once merge, I will be able to change it to the real action.
Second question, where do I put the link to the run so people can find it, I didn't see other links in the current repo

febuiles · 2023-08-08T10:18:47Z

@adrienpessu Sorry for the confusion, the test run is for us devs to leave a record here of a successful run of the changes since we don't have proper E2E tests in Actions. We don't need to share it as part of the documentation.

Thanks for the new examples, they point out a change we need to make: We should use PURLs instead of package names. It avoids conflicts for multiple dependencies with the same name but different ecosystems (think of a library called json that exists in both your Gemfile and your package.json). Apologies for not calling out this earlier, I thought we were already using PURLs.

…between 2 dependencies with the same name but for different ecosystems

adrienpessu · 2023-08-08T15:26:21Z

@febuiles while I like the flexibility of not having to specify the build system, I understand the need to avoid confusion.
I made the change and here is an example : https://github.com/adrienpessu/sample-dependency-review-deny-packages/actions/runs/5798862598?pr=1

febuiles · 2023-08-09T13:26:03Z

@adrienpessu I've merged the changes with some tweaks to the docs. I expect to do a release later today/tomorrow. Thank you very much!

adrienpessu · 2023-08-09T13:29:09Z

Great thank you

febuiles · 2023-08-09T13:30:01Z

By merging I forgot that the README changes would be public instantly, so I decided to cut the new release now. Changes are available starting with 3.0.7. Thanks again!

dependabot Bot and others added 8 commits August 7, 2023 14:07

dependbot updates

6af6659

update more dependencies

0e6dece

initial commit

309d082

add deny_list as paramter

2f38ecd

add groups

6862f6f

add tests and docs

00f1f5b

adrienpessu requested a review from a team as a code owner August 7, 2023 12:22

Merge remote-tracking branch 'upstream/main'

eab0754

add changes on js.map file

0796abb

add example

c462e2e

adrienpessu added 5 commits August 8, 2023 16:34

change from name of the package to the package url to avoid conflict …

1db9156

…between 2 dependencies with the same name but for different ecosystems

debug

c280c30

debug

98aae18

improve example

eacc032

improve example

ce14e1f

febuiles approved these changes Aug 9, 2023

View reviewed changes

Comment thread README.md Outdated

Comment thread action.yml Outdated

Comment thread action.yml Outdated

Comment thread docs/examples.md Outdated

Comment thread docs/examples.md Outdated

Apply suggestions from code review

fe2a482

febuiles merged commit 02aa4b6 into actions:main Aug 9, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add an option to deny packages or groups of packages#544

Add an option to deny packages or groups of packages#544
febuiles merged 17 commits intoactions:mainfrom
adrienpessu:main

adrienpessu commented Aug 7, 2023 •

edited by febuiles

Loading

Uh oh!

febuiles commented Aug 7, 2023

Uh oh!

adrienpessu commented Aug 7, 2023

Uh oh!

febuiles commented Aug 7, 2023

Uh oh!

adrienpessu commented Aug 8, 2023

Uh oh!

febuiles commented Aug 8, 2023

Uh oh!

adrienpessu commented Aug 8, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

febuiles commented Aug 9, 2023

Uh oh!

adrienpessu commented Aug 9, 2023

Uh oh!

febuiles commented Aug 9, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

adrienpessu commented Aug 7, 2023 • edited by febuiles Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TL;DR;

Context

Actions

Uh oh!

febuiles commented Aug 7, 2023

Uh oh!

adrienpessu commented Aug 7, 2023

Uh oh!

febuiles commented Aug 7, 2023

Uh oh!

adrienpessu commented Aug 8, 2023

Uh oh!

febuiles commented Aug 8, 2023

Uh oh!

adrienpessu commented Aug 8, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

febuiles commented Aug 9, 2023

Uh oh!

adrienpessu commented Aug 9, 2023

Uh oh!

febuiles commented Aug 9, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

adrienpessu commented Aug 7, 2023 •

edited by febuiles

Loading