projen/lib/github/dependency-review.js

CDK for software projects

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.DependencyReview = void 0;
const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
const actions_const_1 = require("./actions.const");
const workflow_steps_1 = require("./workflow-steps");
const workflows_model_1 = require("./workflows-model");
const component_1 = require("../component");
/**
 * Adds a GitHub workflow that runs the dependency-review-action on pull requests.
 *
 * This action scans pull requests for dependency changes and raises an error
 * if any vulnerabilities or invalid licenses are introduced.
 *
 * @see https://github.com/actions/dependency-review-action
 */
class DependencyReview extends component_1.Component {
    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen.github.DependencyReview", version: "0.103.12" };
    constructor(github, options = {}) {
        super(github.project);
        const commentSummary = options.commentSummaryInPr ?? "always";
        const workflow = github.addWorkflow("dependency-review");
        workflow.on({
            pullRequest: {},
            workflowDispatch: {},
        });
        workflow.addJobs({
            "dependency-review": {
                ...github.runsOnConfig(options),
                permissions: {
                    contents: workflows_model_1.JobPermission.READ,
                    ...(commentSummary !== "never"
                        ? { pullRequests: workflows_model_1.JobPermission.WRITE }
                        : {}),
                },
                steps: [
                    workflow_steps_1.WorkflowSteps.checkout(),
                    {
                        name: "Dependency Review",
                        uses: actions_const_1.GitHubActions.ACTIONS_DEPENDENCY_REVIEW_ACTION,
                        with: {
                            "fail-on-severity": options.failOnSeverity,
                            "allow-licenses": options.allowLicenses?.join(", "),
                            "vulnerability-check": options.vulnerabilityCheck,
                            "license-check": options.licenseCheck,
                            "fail-on-scopes": options.failOnScopes?.join(", "),
                            "config-file": options.configFile,
                            "allow-ghsas": options.allowGhsas?.join(", "),
                            "deny-packages": options.denyPackages?.join(", "),
                            "comment-summary-in-pr": commentSummary,
                            "warn-only": options.warnOnly,
                            "show-openssf-scorecard": options.showOpenSSFScorecard,
                            "warn-on-openssf-scorecard-level": options.warnOnOpenSSFScorecardLevel,
                        },
                    },
                ],
            },
        });
    }
}
exports.DependencyReview = DependencyReview;
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwZW5kZW5jeS1yZXZpZXcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZ2l0aHViL2RlcGVuZGVuY3ktcmV2aWV3LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7QUFBQSxtREFBZ0Q7QUFFaEQscURBQWlEO0FBQ2pELHVEQUFrRDtBQUNsRCw0Q0FBeUM7QUE0RnpDOzs7Ozs7O0dBT0c7QUFDSCxNQUFhLGdCQUFpQixTQUFRLHFCQUFTOztJQUM3QyxZQUFZLE1BQWMsRUFBRSxVQUFtQyxFQUFFO1FBQy9ELEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFdEIsTUFBTSxjQUFjLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixJQUFJLFFBQVEsQ0FBQztRQUU5RCxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDekQsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNWLFdBQVcsRUFBRSxFQUFFO1lBQ2YsZ0JBQWdCLEVBQUUsRUFBRTtTQUNyQixDQUFDLENBQUM7UUFFSCxRQUFRLENBQUMsT0FBTyxDQUFDO1lBQ2YsbUJBQW1CLEVBQUU7Z0JBQ25CLEdBQUcsTUFBTSxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUM7Z0JBQy9CLFdBQVcsRUFBRTtvQkFDWCxRQUFRLEVBQUUsK0JBQWEsQ0FBQyxJQUFJO29CQUM1QixHQUFHLENBQUMsY0FBYyxLQUFLLE9BQU87d0JBQzVCLENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSwrQkFBYSxDQUFDLEtBQUssRUFBRTt3QkFDdkMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztpQkFDUjtnQkFDRCxLQUFLLEVBQUU7b0JBQ0wsOEJBQWEsQ0FBQyxRQUFRLEVBQUU7b0JBQ3hCO3dCQUNFLElBQUksRUFBRSxtQkFBbUI7d0JBQ3pCLElBQUksRUFBRSw2QkFBYSxDQUFDLGdDQUFnQzt3QkFDcEQsSUFBSSxFQUFFOzRCQUNKLGtCQUFrQixFQUFFLE9BQU8sQ0FBQyxjQUFjOzRCQUMxQyxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsYUFBYSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUM7NEJBQ25ELHFCQUFxQixFQUFFLE9BQU8sQ0FBQyxrQkFBa0I7NEJBQ2pELGVBQWUsRUFBRSxPQUFPLENBQUMsWUFBWTs0QkFDckMsZ0JBQWdCLEVBQUUsT0FBTyxDQUFDLFlBQVksRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDOzRCQUNsRCxhQUFhLEVBQUUsT0FBTyxDQUFDLFVBQVU7NEJBQ2pDLGFBQWEsRUFBRSxPQUFPLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUM7NEJBQzdDLGVBQWUsRUFBRSxPQUFPLENBQUMsWUFBWSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUM7NEJBQ2pELHVCQUF1QixFQUFFLGNBQWM7NEJBQ3ZDLFdBQVcsRUFBRSxPQUFPLENBQUMsUUFBUTs0QkFDN0Isd0JBQXdCLEVBQUUsT0FBTyxDQUFDLG9CQUFvQjs0QkFDdEQsaUNBQWlDLEVBQy9CLE9BQU8sQ0FBQywyQkFBMkI7eUJBQ3RDO3FCQUNGO2lCQUNGO2FBQ0Y7U0FDRixDQUFDLENBQUM7SUFDTCxDQUFDOztBQTdDSCw0Q0E4Q0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBHaXRIdWJBY3Rpb25zIH0gZnJvbSBcIi4vYWN0aW9ucy5jb25zdFwiO1xuaW1wb3J0IHR5cGUgeyBHaXRIdWIgfSBmcm9tIFwiLi9naXRodWJcIjtcbmltcG9ydCB7IFdvcmtmbG93U3RlcHMgfSBmcm9tIFwiLi93b3JrZmxvdy1zdGVwc1wiO1xuaW1wb3J0IHsgSm9iUGVybWlzc2lvbiB9IGZyb20gXCIuL3dvcmtmbG93cy1tb2RlbFwiO1xuaW1wb3J0IHsgQ29tcG9uZW50IH0gZnJvbSBcIi4uL2NvbXBvbmVudFwiO1xuaW1wb3J0IHR5cGUgeyBSdW5zT25PcHRpb25zIH0gZnJvbSBcIi4uL3J1bm5lci1vcHRpb25zXCI7XG5cbi8qKlxuICogT3B0aW9ucyBmb3IgdGhlIERlcGVuZGVuY3lSZXZpZXcgY29tcG9uZW50LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIERlcGVuZGVuY3lSZXZpZXdPcHRpb25zIGV4dGVuZHMgUnVuc09uT3B0aW9ucyB7XG4gIC8qKlxuICAgKiBUaGUgc2V2ZXJpdHkgbGV2ZWwgYXQgd2hpY2ggdGhlIGFjdGlvbiB3aWxsIGZhaWwuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gbm8gbWluaW11bSBzZXZlcml0eSAoYWN0aW9uIGRlZmF1bHQgaXMgXCJsb3dcIilcbiAgICovXG4gIHJlYWRvbmx5IGZhaWxPblNldmVyaXR5PzogXCJsb3dcIiB8IFwibW9kZXJhdGVcIiB8IFwiaGlnaFwiIHwgXCJjcml0aWNhbFwiO1xuXG4gIC8qKlxuICAgKiBMaXN0IG9mIGFsbG93ZWQgU1BEWCBsaWNlbnNlIGlkZW50aWZpZXJzLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIG5vIGxpY2Vuc2UgYWxsb3ctbGlzdFxuICAgKi9cbiAgcmVhZG9ubHkgYWxsb3dMaWNlbnNlcz86IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBFbmFibGUgb3IgZGlzYWJsZSB0aGUgdnVsbmVyYWJpbGl0eSBjaGVjay5cbiAgICpcbiAgICogQGRlZmF1bHQgdHJ1ZVxuICAgKi9cbiAgcmVhZG9ubHkgdnVsbmVyYWJpbGl0eUNoZWNrPzogYm9vbGVhbjtcblxuICAvKipcbiAgICogRW5hYmxlIG9yIGRpc2FibGUgdGhlIGxpY2Vuc2UgY2hlY2suXG4gICAqXG4gICAqIEBkZWZhdWx0IHRydWVcbiAgICovXG4gIHJlYWRvbmx5IGxpY2Vuc2VDaGVjaz86IGJvb2xlYW47XG5cbiAgLyoqXG4gICAqIFNjb3BlcyBvZiBkZXBlbmRlbmNpZXMgdG8gZmFpbCBvbi5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBubyBzY29wZXMgZmlsdGVyIChhY3Rpb24gZGVmYXVsdCBpcyBcInJ1bnRpbWVcIilcbiAgICovXG4gIHJlYWRvbmx5IGZhaWxPblNjb3Blcz86IEFycmF5PFwicnVudGltZVwiIHwgXCJkZXZlbG9wbWVudFwiIHwgXCJ1bmtub3duXCI+O1xuXG4gIC8qKlxuICAgKiBQYXRoIHRvIGFuIGV4dGVybmFsIGNvbmZpZ3VyYXRpb24gZmlsZS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBubyBleHRlcm5hbCBjb25maWdcbiAgICovXG4gIHJlYWRvbmx5IGNvbmZpZ0ZpbGU/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIEdpdEh1YiBBZHZpc29yeSBEYXRhYmFzZSBJRHMgdGhhdCBjYW4gYmUgc2tpcHBlZCBkdXJpbmcgZGV0ZWN0aW9uLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIG5vIGFkdmlzb3JpZXMgYXJlIHNraXBwZWRcbiAgICovXG4gIHJlYWRvbmx5IGFsbG93R2hzYXM/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogUGFja2FnZXMgdG8gYmxvY2sgaW4gYSBQUiAoaW4gcHVybCBmb3JtYXQpLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIG5vIHBhY2thZ2VzIGFyZSBkZW5pZWRcbiAgICovXG4gIHJlYWRvbmx5IGRlbnlQYWNrYWdlcz86IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBXaGV0aGVyIHRvIHBvc3QgYSBjb21tZW50IHN1bW1hcnkgb24gdGhlIFBSLlxuICAgKlxuICAgKiBAZGVmYXVsdCBcImFsd2F5c1wiXG4gICAqL1xuICByZWFkb25seSBjb21tZW50U3VtbWFyeUluUHI/OiBcImFsd2F5c1wiIHwgXCJvbi1mYWlsdXJlXCIgfCBcIm5ldmVyXCI7XG5cbiAgLyoqXG4gICAqIFdoZW4gdHJ1ZSwgdGhlIGFjdGlvbiB3aWxsIG9ubHkgd2FybiBhbmQgbm90IGZhaWwuXG4gICAqXG4gICAqIEBkZWZhdWx0IGZhbHNlXG4gICAqL1xuICByZWFkb25seSB3YXJuT25seT86IGJvb2xlYW47XG5cbiAgLyoqXG4gICAqIFNob3cgT3BlblNTRiBTY29yZWNhcmQgc2NvcmVzIGZvciBkZXBlbmRlbmNpZXMuXG4gICAqXG4gICAqIEBkZWZhdWx0IHRydWVcbiAgICovXG4gIHJlYWRvbmx5IHNob3dPcGVuU1NGU2NvcmVjYXJkPzogYm9vbGVhbjtcblxuICAvKipcbiAgICogU2NvcmUgdGhyZXNob2xkIGZvciBPcGVuU1NGIFNjb3JlY2FyZCB3YXJuaW5ncy5cbiAgICpcbiAgICogQGRlZmF1bHQgM1xuICAgKi9cbiAgcmVhZG9ubHkgd2Fybk9uT3BlblNTRlNjb3JlY2FyZExldmVsPzogbnVtYmVyO1xufVxuXG4vKipcbiAqIEFkZHMgYSBHaXRIdWIgd29ya2Zsb3cgdGhhdCBydW5zIHRoZSBkZXBlbmRlbmN5LXJldmlldy1hY3Rpb24gb24gcHVsbCByZXF1ZXN0cy5cbiAqXG4gKiBUaGlzIGFjdGlvbiBzY2FucyBwdWxsIHJlcXVlc3RzIGZvciBkZXBlbmRlbmN5IGNoYW5nZXMgYW5kIHJhaXNlcyBhbiBlcnJvclxuICogaWYgYW55IHZ1bG5lcmFiaWxpdGllcyBvciBpbnZhbGlkIGxpY2Vuc2VzIGFyZSBpbnRyb2R1Y2VkLlxuICpcbiAqIEBzZWUgaHR0cHM6Ly9naXRodWIuY29tL2FjdGlvbnMvZGVwZW5kZW5jeS1yZXZpZXctYWN0aW9uXG4gKi9cbmV4cG9ydCBjbGFzcyBEZXBlbmRlbmN5UmV2aWV3IGV4dGVuZHMgQ29tcG9uZW50IHtcbiAgY29uc3RydWN0b3IoZ2l0aHViOiBHaXRIdWIsIG9wdGlvbnM6IERlcGVuZGVuY3lSZXZpZXdPcHRpb25zID0ge30pIHtcbiAgICBzdXBlcihnaXRodWIucHJvamVjdCk7XG5cbiAgICBjb25zdCBjb21tZW50U3VtbWFyeSA9IG9wdGlvbnMuY29tbWVudFN1bW1hcnlJblByID8/IFwiYWx3YXlzXCI7XG5cbiAgICBjb25zdCB3b3JrZmxvdyA9IGdpdGh1Yi5hZGRXb3JrZmxvdyhcImRlcGVuZGVuY3ktcmV2aWV3XCIpO1xuICAgIHdvcmtmbG93Lm9uKHtcbiAgICAgIHB1bGxSZXF1ZXN0OiB7fSxcbiAgICAgIHdvcmtmbG93RGlzcGF0Y2g6IHt9LFxuICAgIH0pO1xuXG4gICAgd29ya2Zsb3cuYWRkSm9icyh7XG4gICAgICBcImRlcGVuZGVuY3ktcmV2aWV3XCI6IHtcbiAgICAgICAgLi4uZ2l0aHViLnJ1bnNPbkNvbmZpZyhvcHRpb25zKSxcbiAgICAgICAgcGVybWlzc2lvbnM6IHtcbiAgICAgICAgICBjb250ZW50czogSm9iUGVybWlzc2lvbi5SRUFELFxuICAgICAgICAgIC4uLihjb21tZW50U3VtbWFyeSAhPT0gXCJuZXZlclwiXG4gICAgICAgICAgICA/IHsgcHVsbFJlcXVlc3RzOiBKb2JQZXJtaXNzaW9uLldSSVRFIH1cbiAgICAgICAgICAgIDoge30pLFxuICAgICAgICB9LFxuICAgICAgICBzdGVwczogW1xuICAgICAgICAgIFdvcmtmbG93U3RlcHMuY2hlY2tvdXQoKSxcbiAgICAgICAgICB7XG4gICAgICAgICAgICBuYW1lOiBcIkRlcGVuZGVuY3kgUmV2aWV3XCIsXG4gICAgICAgICAgICB1c2VzOiBHaXRIdWJBY3Rpb25zLkFDVElPTlNfREVQRU5ERU5DWV9SRVZJRVdfQUNUSU9OLFxuICAgICAgICAgICAgd2l0aDoge1xuICAgICAgICAgICAgICBcImZhaWwtb24tc2V2ZXJpdHlcIjogb3B0aW9ucy5mYWlsT25TZXZlcml0eSxcbiAgICAgICAgICAgICAgXCJhbGxvdy1saWNlbnNlc1wiOiBvcHRpb25zLmFsbG93TGljZW5zZXM/LmpvaW4oXCIsIFwiKSxcbiAgICAgICAgICAgICAgXCJ2dWxuZXJhYmlsaXR5LWNoZWNrXCI6IG9wdGlvbnMudnVsbmVyYWJpbGl0eUNoZWNrLFxuICAgICAgICAgICAgICBcImxpY2Vuc2UtY2hlY2tcIjogb3B0aW9ucy5saWNlbnNlQ2hlY2ssXG4gICAgICAgICAgICAgIFwiZmFpbC1vbi1zY29wZXNcIjogb3B0aW9ucy5mYWlsT25TY29wZXM/LmpvaW4oXCIsIFwiKSxcbiAgICAgICAgICAgICAgXCJjb25maWctZmlsZVwiOiBvcHRpb25zLmNvbmZpZ0ZpbGUsXG4gICAgICAgICAgICAgIFwiYWxsb3ctZ2hzYXNcIjogb3B0aW9ucy5hbGxvd0doc2FzPy5qb2luKFwiLCBcIiksXG4gICAgICAgICAgICAgIFwiZGVueS1wYWNrYWdlc1wiOiBvcHRpb25zLmRlbnlQYWNrYWdlcz8uam9pbihcIiwgXCIpLFxuICAgICAgICAgICAgICBcImNvbW1lbnQtc3VtbWFyeS1pbi1wclwiOiBjb21tZW50U3VtbWFyeSxcbiAgICAgICAgICAgICAgXCJ3YXJuLW9ubHlcIjogb3B0aW9ucy53YXJuT25seSxcbiAgICAgICAgICAgICAgXCJzaG93LW9wZW5zc2Ytc2NvcmVjYXJkXCI6IG9wdGlvbnMuc2hvd09wZW5TU0ZTY29yZWNhcmQsXG4gICAgICAgICAgICAgIFwid2Fybi1vbi1vcGVuc3NmLXNjb3JlY2FyZC1sZXZlbFwiOlxuICAgICAgICAgICAgICAgIG9wdGlvbnMud2Fybk9uT3BlblNTRlNjb3JlY2FyZExldmVsLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICBdLFxuICAgICAgfSxcbiAgICB9KTtcbiAgfVxufVxuIl19