feat: Github fallback for empty PURL for license exclusion #848
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The action uses the change's
package_url
(as returned from the dependency graph API) to match against the exclusions passed viaallow-dependencies-licenses
. However, some changes do not includepackage_url
, but they can still result in the action failing a license check as the check itself doesn't rely onpackage_url
. Currently there's no mechanism in place to exclude a dependency from the license check if the package_url is empty.This adds a fallback mechanism that parses
source_repository_url
to attempt to match based on the repository name. Soallow-dependencies-licenses
could include, for example,pkg:github/owner/repo
and that would match a change withsource_repository_url: "https://github.com/owner/repo"
.This doesn't cover all cases; if
source_repository_url
is empty or doesn't point to a github-hosted repository then it will still fail to match.