Repository navigation
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
OSV severity handling can miss blocking vulnerabilities, alongside reliability issues in output sizing and comment ownership.
Review effort: Balanced
Findings: 2
Open (8)
What changed in this PR
Adds a Node/npm dependency-review action that compares lockfiles and enforces vulnerability, license, and package policies.
Changes:
- Parses and diffs npm lockfiles across revisions.
- Integrates OSV and npm registry license checks.
- Produces annotations, summaries, comments, and JSON outputs.
| File | Description |
|---|---|
src/dependency-review/types.ts |
Defines review data models. |
src/dependency-review/spdx-expression-parse.d.ts |
Adds SPDX parser typings. |
src/dependency-review/report.ts |
Renders reports and outputs. |
src/dependency-review/policy.ts |
Applies vulnerability and package policies. |
src/dependency-review/policy.spec.ts |
Tests policy behavior. |
src/dependency-review/osv.ts |
Implements OSV scanning. |
src/dependency-review/osv.spec.ts |
Tests OSV integration. |
src/dependency-review/lockfile.ts |
Parses npm lockfiles. |
src/dependency-review/lockfile.spec.ts |
Tests parsing and diffing. |
src/dependency-review/licenses.ts |
Enforces SPDX license policy. |
src/dependency-review/index.ts |
Provides the action entry point. |
src/dependency-review/github.ts |
Reads revisions and manages comments. |
src/dependency-review/github.spec.ts |
Tests repository API handling. |
src/dependency-review/diff.ts |
Calculates dependency changes. |
src/dependency-review/dependency-review.ts |
Orchestrates the review workflow. |
src/dependency-review/config.ts |
Parses action configuration. |
src/dependency-review/config-report.spec.ts |
Tests configuration and reporting. |
README.md |
Documents usage and limitations. |
package.json |
Adds the SPDX parser dependency. |
package-lock.json |
Locks the new dependency tree. |
dependency-review/action.yml |
Defines action inputs, outputs, and runtime. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| const { labels, vectors } = extractSeverityValues(vulnerability, dependency); | ||
| for (const label of labels) { | ||
| const severity = severityFromLabel(label); | ||
| if (severity !== undefined) return severity; |
Comment on lines
+396
to
+398
| const advisory = canonicalAdvisory(vulnerability); | ||
| if (seenAdvisories.has(advisory)) continue; | ||
| seenAdvisories.add(advisory); |
Comment on lines
+132
to
+138
| let visited = 0; | ||
|
|
||
| while (queue.length > 0) { | ||
| const current = queue.shift(); | ||
| if (current === undefined) { | ||
| break; | ||
| } |
| entry.path !== undefined && | ||
| (entry.path === 'package-lock.json' || | ||
| entry.path.endsWith('/package-lock.json')) && | ||
| !entry.path.includes('/node_modules/'), |
Comment on lines
+285
to
+287
| const previous = comments.find( | ||
| (comment) => comment.body?.includes(marker) === true, | ||
| ); |
Comment on lines
+229
to
+231
| let registryLicense: string | undefined; | ||
| try { | ||
| registryLicense = await fetchRegistryLicense(dependency); |
Comment on lines
+147
to
+148
| value.id !== expectedId | ||
| ) { |
Comment on lines
+156
to
+160
| export function safeJsonOutput(value: unknown[], outputName: string): string { | ||
| let items = value; | ||
| let encoded = JSON.stringify(items); | ||
| while (Buffer.byteLength(encoded) > MAX_OUTPUT_BYTES && items.length > 0) { | ||
| items = items.slice(0, Math.floor(items.length / 2)); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.