projen/lib/github/dependency-review.js

CDK for software projects

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.DependencyReview = void 0;
const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
const actions_const_1 = require("./actions.const");
const workflow_steps_1 = require("./workflow-steps");
const workflows_model_1 = require("./workflows-model");
const component_1 = require("../component");
/**
 * Adds a GitHub workflow that runs the dependency-review-action on pull requests.
 *
 * This action scans pull requests for dependency changes and raises an error
 * if any vulnerabilities or invalid licenses are introduced.
 *
 * @see https://github.com/actions/dependency-review-action
 */
class DependencyReview extends component_1.Component {
    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen.github.DependencyReview", version: "0.104.8" };
    constructor(github, options = {}) {
        super(github.project);
        const commentSummary = options.commentSummaryInPr ?? "always";
        const workflow = github.addWorkflow("dependency-review");
        workflow.on({
            pullRequest: {},
            workflowDispatch: {},
            mergeGroup: {},
        });
        workflow.addJobs({
            "dependency-review": {
                if: "(github.event_name == 'pull_request' || github.event_name == 'pull_request_target')",
                ...github.runsOnConfig(options),
                permissions: {
                    contents: workflows_model_1.JobPermission.READ,
                    ...(commentSummary !== "never"
                        ? { pullRequests: workflows_model_1.JobPermission.WRITE }
                        : {}),
                },
                steps: [
                    workflow_steps_1.WorkflowSteps.checkout(),
                    {
                        name: "Dependency Review",
                        uses: actions_const_1.ActionRefs.ACTIONS_DEPENDENCY_REVIEW_ACTION,
                        with: {
                            "fail-on-severity": options.failOnSeverity,
                            "allow-licenses": options.allowLicenses?.join(", "),
                            "vulnerability-check": options.vulnerabilityCheck,
                            "license-check": options.licenseCheck,
                            "fail-on-scopes": options.failOnScopes?.join(", "),
                            "config-file": options.configFile,
                            "allow-ghsas": options.allowGhsas?.join(", "),
                            "deny-packages": options.denyPackages?.join(", "),
                            "comment-summary-in-pr": commentSummary,
                            "warn-only": options.warnOnly,
                            "show-openssf-scorecard": options.showOpenSSFScorecard,
                            "warn-on-openssf-scorecard-level": options.warnOnOpenSSFScorecardLevel,
                        },
                    },
                ],
            },
        });
    }
}
exports.DependencyReview = DependencyReview;
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwZW5kZW5jeS1yZXZpZXcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZ2l0aHViL2RlcGVuZGVuY3ktcmV2aWV3LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7QUFBQSxtREFBNkM7QUFFN0MscURBQWlEO0FBQ2pELHVEQUFrRDtBQUNsRCw0Q0FBeUM7QUE0RnpDOzs7Ozs7O0dBT0c7QUFDSCxNQUFhLGdCQUFpQixTQUFRLHFCQUFTOztJQUM3QyxZQUFZLE1BQWMsRUFBRSxVQUFtQyxFQUFFO1FBQy9ELEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFdEIsTUFBTSxjQUFjLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixJQUFJLFFBQVEsQ0FBQztRQUU5RCxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDekQsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNWLFdBQVcsRUFBRSxFQUFFO1lBQ2YsZ0JBQWdCLEVBQUUsRUFBRTtZQUNwQixVQUFVLEVBQUUsRUFBRTtTQUNmLENBQUMsQ0FBQztRQUVILFFBQVEsQ0FBQyxPQUFPLENBQUM7WUFDZixtQkFBbUIsRUFBRTtnQkFDbkIsRUFBRSxFQUFFLHFGQUFxRjtnQkFDekYsR0FBRyxNQUFNLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQztnQkFDL0IsV0FBVyxFQUFFO29CQUNYLFFBQVEsRUFBRSwrQkFBYSxDQUFDLElBQUk7b0JBQzVCLEdBQUcsQ0FBQyxjQUFjLEtBQUssT0FBTzt3QkFDNUIsQ0FBQyxDQUFDLEVBQUUsWUFBWSxFQUFFLCtCQUFhLENBQUMsS0FBSyxFQUFFO3dCQUN2QyxDQUFDLENBQUMsRUFBRSxDQUFDO2lCQUNSO2dCQUNELEtBQUssRUFBRTtvQkFDTCw4QkFBYSxDQUFDLFFBQVEsRUFBRTtvQkFDeEI7d0JBQ0UsSUFBSSxFQUFFLG1CQUFtQjt3QkFDekIsSUFBSSxFQUFFLDBCQUFVLENBQUMsZ0NBQWdDO3dCQUNqRCxJQUFJLEVBQUU7NEJBQ0osa0JBQWtCLEVBQUUsT0FBTyxDQUFDLGNBQWM7NEJBQzFDLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxhQUFhLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQzs0QkFDbkQscUJBQXFCLEVBQUUsT0FBTyxDQUFDLGtCQUFrQjs0QkFDakQsZUFBZSxFQUFFLE9BQU8sQ0FBQyxZQUFZOzRCQUNyQyxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsWUFBWSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUM7NEJBQ2xELGFBQWEsRUFBRSxPQUFPLENBQUMsVUFBVTs0QkFDakMsYUFBYSxFQUFFLE9BQU8sQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQzs0QkFDN0MsZUFBZSxFQUFFLE9BQU8sQ0FBQyxZQUFZLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQzs0QkFDakQsdUJBQXVCLEVBQUUsY0FBYzs0QkFDdkMsV0FBVyxFQUFFLE9BQU8sQ0FBQyxRQUFROzRCQUM3Qix3QkFBd0IsRUFBRSxPQUFPLENBQUMsb0JBQW9COzRCQUN0RCxpQ0FBaUMsRUFDL0IsT0FBTyxDQUFDLDJCQUEyQjt5QkFDdEM7cUJBQ0Y7aUJBQ0Y7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBL0NILDRDQWdEQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IEFjdGlvblJlZnMgfSBmcm9tIFwiLi9hY3Rpb25zLmNvbnN0XCI7XG5pbXBvcnQgdHlwZSB7IEdpdEh1YiB9IGZyb20gXCIuL2dpdGh1YlwiO1xuaW1wb3J0IHsgV29ya2Zsb3dTdGVwcyB9IGZyb20gXCIuL3dvcmtmbG93LXN0ZXBzXCI7XG5pbXBvcnQgeyBKb2JQZXJtaXNzaW9uIH0gZnJvbSBcIi4vd29ya2Zsb3dzLW1vZGVsXCI7XG5pbXBvcnQgeyBDb21wb25lbnQgfSBmcm9tIFwiLi4vY29tcG9uZW50XCI7XG5pbXBvcnQgdHlwZSB7IFJ1bnNPbk9wdGlvbnMgfSBmcm9tIFwiLi4vcnVubmVyLW9wdGlvbnNcIjtcblxuLyoqXG4gKiBPcHRpb25zIGZvciB0aGUgRGVwZW5kZW5jeVJldmlldyBjb21wb25lbnQuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgRGVwZW5kZW5jeVJldmlld09wdGlvbnMgZXh0ZW5kcyBSdW5zT25PcHRpb25zIHtcbiAgLyoqXG4gICAqIFRoZSBzZXZlcml0eSBsZXZlbCBhdCB3aGljaCB0aGUgYWN0aW9uIHdpbGwgZmFpbC5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBubyBtaW5pbXVtIHNldmVyaXR5IChhY3Rpb24gZGVmYXVsdCBpcyBcImxvd1wiKVxuICAgKi9cbiAgcmVhZG9ubHkgZmFpbE9uU2V2ZXJpdHk/OiBcImxvd1wiIHwgXCJtb2RlcmF0ZVwiIHwgXCJoaWdoXCIgfCBcImNyaXRpY2FsXCI7XG5cbiAgLyoqXG4gICAqIExpc3Qgb2YgYWxsb3dlZCBTUERYIGxpY2Vuc2UgaWRlbnRpZmllcnMuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gbm8gbGljZW5zZSBhbGxvdy1saXN0XG4gICAqL1xuICByZWFkb25seSBhbGxvd0xpY2Vuc2VzPzogc3RyaW5nW107XG5cbiAgLyoqXG4gICAqIEVuYWJsZSBvciBkaXNhYmxlIHRoZSB2dWxuZXJhYmlsaXR5IGNoZWNrLlxuICAgKlxuICAgKiBAZGVmYXVsdCB0cnVlXG4gICAqL1xuICByZWFkb25seSB2dWxuZXJhYmlsaXR5Q2hlY2s/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBFbmFibGUgb3IgZGlzYWJsZSB0aGUgbGljZW5zZSBjaGVjay5cbiAgICpcbiAgICogQGRlZmF1bHQgdHJ1ZVxuICAgKi9cbiAgcmVhZG9ubHkgbGljZW5zZUNoZWNrPzogYm9vbGVhbjtcblxuICAvKipcbiAgICogU2NvcGVzIG9mIGRlcGVuZGVuY2llcyB0byBmYWlsIG9uLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIG5vIHNjb3BlcyBmaWx0ZXIgKGFjdGlvbiBkZWZhdWx0IGlzIFwicnVudGltZVwiKVxuICAgKi9cbiAgcmVhZG9ubHkgZmFpbE9uU2NvcGVzPzogQXJyYXk8XCJydW50aW1lXCIgfCBcImRldmVsb3BtZW50XCIgfCBcInVua25vd25cIj47XG5cbiAgLyoqXG4gICAqIFBhdGggdG8gYW4gZXh0ZXJuYWwgY29uZmlndXJhdGlvbiBmaWxlLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIG5vIGV4dGVybmFsIGNvbmZpZ1xuICAgKi9cbiAgcmVhZG9ubHkgY29uZmlnRmlsZT86IHN0cmluZztcblxuICAvKipcbiAgICogR2l0SHViIEFkdmlzb3J5IERhdGFiYXNlIElEcyB0aGF0IGNhbiBiZSBza2lwcGVkIGR1cmluZyBkZXRlY3Rpb24uXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gbm8gYWR2aXNvcmllcyBhcmUgc2tpcHBlZFxuICAgKi9cbiAgcmVhZG9ubHkgYWxsb3dHaHNhcz86IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBQYWNrYWdlcyB0byBibG9jayBpbiBhIFBSIChpbiBwdXJsIGZvcm1hdCkuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gbm8gcGFja2FnZXMgYXJlIGRlbmllZFxuICAgKi9cbiAgcmVhZG9ubHkgZGVueVBhY2thZ2VzPzogc3RyaW5nW107XG5cbiAgLyoqXG4gICAqIFdoZXRoZXIgdG8gcG9zdCBhIGNvbW1lbnQgc3VtbWFyeSBvbiB0aGUgUFIuXG4gICAqXG4gICAqIEBkZWZhdWx0IFwiYWx3YXlzXCJcbiAgICovXG4gIHJlYWRvbmx5IGNvbW1lbnRTdW1tYXJ5SW5Qcj86IFwiYWx3YXlzXCIgfCBcIm9uLWZhaWx1cmVcIiB8IFwibmV2ZXJcIjtcblxuICAvKipcbiAgICogV2hlbiB0cnVlLCB0aGUgYWN0aW9uIHdpbGwgb25seSB3YXJuIGFuZCBub3QgZmFpbC5cbiAgICpcbiAgICogQGRlZmF1bHQgZmFsc2VcbiAgICovXG4gIHJlYWRvbmx5IHdhcm5Pbmx5PzogYm9vbGVhbjtcblxuICAvKipcbiAgICogU2hvdyBPcGVuU1NGIFNjb3JlY2FyZCBzY29yZXMgZm9yIGRlcGVuZGVuY2llcy5cbiAgICpcbiAgICogQGRlZmF1bHQgdHJ1ZVxuICAgKi9cbiAgcmVhZG9ubHkgc2hvd09wZW5TU0ZTY29yZWNhcmQ/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBTY29yZSB0aHJlc2hvbGQgZm9yIE9wZW5TU0YgU2NvcmVjYXJkIHdhcm5pbmdzLlxuICAgKlxuICAgKiBAZGVmYXVsdCAzXG4gICAqL1xuICByZWFkb25seSB3YXJuT25PcGVuU1NGU2NvcmVjYXJkTGV2ZWw/OiBudW1iZXI7XG59XG5cbi8qKlxuICogQWRkcyBhIEdpdEh1YiB3b3JrZmxvdyB0aGF0IHJ1bnMgdGhlIGRlcGVuZGVuY3ktcmV2aWV3LWFjdGlvbiBvbiBwdWxsIHJlcXVlc3RzLlxuICpcbiAqIFRoaXMgYWN0aW9uIHNjYW5zIHB1bGwgcmVxdWVzdHMgZm9yIGRlcGVuZGVuY3kgY2hhbmdlcyBhbmQgcmFpc2VzIGFuIGVycm9yXG4gKiBpZiBhbnkgdnVsbmVyYWJpbGl0aWVzIG9yIGludmFsaWQgbGljZW5zZXMgYXJlIGludHJvZHVjZWQuXG4gKlxuICogQHNlZSBodHRwczovL2dpdGh1Yi5jb20vYWN0aW9ucy9kZXBlbmRlbmN5LXJldmlldy1hY3Rpb25cbiAqL1xuZXhwb3J0IGNsYXNzIERlcGVuZGVuY3lSZXZpZXcgZXh0ZW5kcyBDb21wb25lbnQge1xuICBjb25zdHJ1Y3RvcihnaXRodWI6IEdpdEh1Yiwgb3B0aW9uczogRGVwZW5kZW5jeVJldmlld09wdGlvbnMgPSB7fSkge1xuICAgIHN1cGVyKGdpdGh1Yi5wcm9qZWN0KTtcblxuICAgIGNvbnN0IGNvbW1lbnRTdW1tYXJ5ID0gb3B0aW9ucy5jb21tZW50U3VtbWFyeUluUHIgPz8gXCJhbHdheXNcIjtcblxuICAgIGNvbnN0IHdvcmtmbG93ID0gZ2l0aHViLmFkZFdvcmtmbG93KFwiZGVwZW5kZW5jeS1yZXZpZXdcIik7XG4gICAgd29ya2Zsb3cub24oe1xuICAgICAgcHVsbFJlcXVlc3Q6IHt9LFxuICAgICAgd29ya2Zsb3dEaXNwYXRjaDoge30sXG4gICAgICBtZXJnZUdyb3VwOiB7fSxcbiAgICB9KTtcblxuICAgIHdvcmtmbG93LmFkZEpvYnMoe1xuICAgICAgXCJkZXBlbmRlbmN5LXJldmlld1wiOiB7XG4gICAgICAgIGlmOiBcIihnaXRodWIuZXZlbnRfbmFtZSA9PSAncHVsbF9yZXF1ZXN0JyB8fCBnaXRodWIuZXZlbnRfbmFtZSA9PSAncHVsbF9yZXF1ZXN0X3RhcmdldCcpXCIsXG4gICAgICAgIC4uLmdpdGh1Yi5ydW5zT25Db25maWcob3B0aW9ucyksXG4gICAgICAgIHBlcm1pc3Npb25zOiB7XG4gICAgICAgICAgY29udGVudHM6IEpvYlBlcm1pc3Npb24uUkVBRCxcbiAgICAgICAgICAuLi4oY29tbWVudFN1bW1hcnkgIT09IFwibmV2ZXJcIlxuICAgICAgICAgICAgPyB7IHB1bGxSZXF1ZXN0czogSm9iUGVybWlzc2lvbi5XUklURSB9XG4gICAgICAgICAgICA6IHt9KSxcbiAgICAgICAgfSxcbiAgICAgICAgc3RlcHM6IFtcbiAgICAgICAgICBXb3JrZmxvd1N0ZXBzLmNoZWNrb3V0KCksXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogXCJEZXBlbmRlbmN5IFJldmlld1wiLFxuICAgICAgICAgICAgdXNlczogQWN0aW9uUmVmcy5BQ1RJT05TX0RFUEVOREVOQ1lfUkVWSUVXX0FDVElPTixcbiAgICAgICAgICAgIHdpdGg6IHtcbiAgICAgICAgICAgICAgXCJmYWlsLW9uLXNldmVyaXR5XCI6IG9wdGlvbnMuZmFpbE9uU2V2ZXJpdHksXG4gICAgICAgICAgICAgIFwiYWxsb3ctbGljZW5zZXNcIjogb3B0aW9ucy5hbGxvd0xpY2Vuc2VzPy5qb2luKFwiLCBcIiksXG4gICAgICAgICAgICAgIFwidnVsbmVyYWJpbGl0eS1jaGVja1wiOiBvcHRpb25zLnZ1bG5lcmFiaWxpdHlDaGVjayxcbiAgICAgICAgICAgICAgXCJsaWNlbnNlLWNoZWNrXCI6IG9wdGlvbnMubGljZW5zZUNoZWNrLFxuICAgICAgICAgICAgICBcImZhaWwtb24tc2NvcGVzXCI6IG9wdGlvbnMuZmFpbE9uU2NvcGVzPy5qb2luKFwiLCBcIiksXG4gICAgICAgICAgICAgIFwiY29uZmlnLWZpbGVcIjogb3B0aW9ucy5jb25maWdGaWxlLFxuICAgICAgICAgICAgICBcImFsbG93LWdoc2FzXCI6IG9wdGlvbnMuYWxsb3dHaHNhcz8uam9pbihcIiwgXCIpLFxuICAgICAgICAgICAgICBcImRlbnktcGFja2FnZXNcIjogb3B0aW9ucy5kZW55UGFja2FnZXM/LmpvaW4oXCIsIFwiKSxcbiAgICAgICAgICAgICAgXCJjb21tZW50LXN1bW1hcnktaW4tcHJcIjogY29tbWVudFN1bW1hcnksXG4gICAgICAgICAgICAgIFwid2Fybi1vbmx5XCI6IG9wdGlvbnMud2Fybk9ubHksXG4gICAgICAgICAgICAgIFwic2hvdy1vcGVuc3NmLXNjb3JlY2FyZFwiOiBvcHRpb25zLnNob3dPcGVuU1NGU2NvcmVjYXJkLFxuICAgICAgICAgICAgICBcIndhcm4tb24tb3BlbnNzZi1zY29yZWNhcmQtbGV2ZWxcIjpcbiAgICAgICAgICAgICAgICBvcHRpb25zLndhcm5Pbk9wZW5TU0ZTY29yZWNhcmRMZXZlbCxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgXSxcbiAgICAgIH0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==