oke-py / npm-audit-action / 29322880965

94%

push

github

feat: add ignore_ghsas input to exclude advisories from the result (#379)

## Summary
- Closes #196: adds an `ignore_ghsas` input taking GHSA advisory IDs
(comma, space, or newline separated) that are excluded from the
pass/fail decision — for advisories that have no fix or do not apply to
how the dependency is used.

## Semantics
- **Every advisory ignored** → the action reports no vulnerabilities: CI
passes, no issue or PR comment is created, and `resolve_pr_comments`
treats the run as resolved.
- **Other advisories remain** → the report is created as usual, CI fails
per `fail_on_vulnerabilities`, and the report body notes which
advisories were ignored, so suppressions stay visible to reviewers.
- Ignoring an advisory also covers packages that are only vulnerable
through it (transitive chains reference their root advisory).
- The remaining advisories are re-evaluated against `audit_level`,
matching npm's own exit-code behavior.

## Implementation notes
- New `src/advisories.ts` evaluates the `npm audit --json` report
(`auditReportVersion` 2). When the report cannot be interpreted (v1
format, no GHSA IDs, parse failure), the action logs a warning and keeps
npm's exit-status-based decision — failing loud rather than going
silently green.
- With `report_format: text` and `json_flag: false`, the evaluation
triggers a second `npm audit --json` run; JSON-producing runs reuse the
existing output.
- GHSA IDs are validated at the input boundary (same pattern as
`audit_level` / `registry`); matching is case-insensitive.
- The ignored-advisories notice participates in the body length budget
(`reservedLength`), so truncated reports stay within GitHub's
65536-character limit.

## Testing
- New `__tests__/advisories.test.ts` covering: full/partial ignore,
transitive coverage, case-insensitivity, `audit_level` interplay,
v1/malformed reports, unknown severities.
- `main.test.ts` flow tests: clean result when everything is ignored,
resolve flow on all-ignored, noti... (continued)

227 of 248 branches covered (91.53%)

Branch coverage included in aggregate %.

78 of 83 new or added lines in 3 files covered. (93.98%)

322 of 335 relevant lines covered (96.12%)

202.13 hits per line