feat: Allow to ignore specific dependencies #196

rndev15 · 2024-12-05T14:01:27Z

Hey there, in this PR I try to resolve #195

rndev15 · 2024-12-09T08:29:20Z

Good day @kunalnagar , could you please take a look into this PR?

rndev15 · 2024-12-13T08:31:33Z

Hey @kunalnagar any chance to take a look into?

kunalnagar · 2024-12-17T19:01:58Z

@rndev15 - I do like this idea of being able to mute/ignore certain dependencies that one does not care about. Have you looked at if the dependabot API allows passing in a list of packages to ignore instead of manually doing a .filter() on the alerts?

rndev15 · 2024-12-18T09:21:57Z

hey @kunalnagar I took a look into docs for listAlertsForRepo and there is no ability to filter dependencies on api side. So I decided to filter response itself.

kunalnagar

Thanks for the contribution! Couple of things:

Could you make sure that the CI passes with your changes?
Can you post a few screenshots of how the action behaves with this ignore_packages field? Null, empty values etc and let's test this out thoroughly

kunalnagar · 2024-12-18T18:16:00Z

.github/workflows/ci.yml

@@ -34,6 +34,7 @@ jobs:
          # slack_webhook: ${{ secrets.SLACK_WEBHOOK }}
          # severity: low,medium
          # ecosystem: npm,rubygems
+          # ignore_dependencies: lodash,devise


Let's call it ignore_packages since GitHub calls them packages instead of dependencies

kunalnagar · 2024-12-18T18:16:16Z

action.yml

@@ -43,6 +43,8 @@ inputs:
    description: 'Comma separated list of severities. E.g. low,medium,high,critical (NO SPACES BETWEEN COMMA AND SEVERITY)'
  ecosystem:
    description: 'A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.'
+  ignore_dependencies:


Suggested change

ignore_dependencies:

ignore_packages:

kunalnagar · 2024-12-18T18:17:09Z

action.yml

@@ -43,6 +43,8 @@ inputs:
    description: 'Comma separated list of severities. E.g. low,medium,high,critical (NO SPACES BETWEEN COMMA AND SEVERITY)'
  ecosystem:
    description: 'A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.'
+  ignore_dependencies:
+    description: 'A comma-separated list of dependencies to ignore. If specified, these dependencies will not be alerted.'


Suggested change

description: 'A comma-separated list of dependencies to ignore. If specified, these dependencies will not be alerted.'

description: 'A comma-separated list of package names. If specified, alerts for these packages will be ignored.'

kunalnagar · 2024-12-18T18:17:33Z

src/fetch-alerts.ts

@@ -13,6 +13,7 @@ export const fetchRepositoryAlerts = async (
  repositoryOwner: string,
  severity: string,
  ecosystem: string,
+  ignoreDependencies: string[],


Suggested change

ignoreDependencies: string[],

ignorePackages: string[],

kunalnagar · 2024-12-18T18:19:05Z

src/fetch-alerts.ts

+  const alerts: Alert[] = response
+                            .data
+                            .filter((dependabotAlert) =>
+                              !ignoreDependencies.includes(dependabotAlert.security_vulnerability.package.name)
+                            )
+                            .map((dependabotAlert) =>
+                              toRepositoryAlert(dependabotAlert, repositoryName, repositoryOwner),
+                            )


Do you mind running the lint task and see if it passes? I feel like your editor may not be set up correctly to format the code automatically.

We only need to filter the alerts if the ignorePackages field contains a value. We should check for that, and only filter if required.

kunalnagar · 2024-12-18T18:19:36Z

src/fetch-alerts.ts

+  const alerts: Alert[] = response
+                            .data
+                            .filter((dependabotOrgAlert) =>
+                              !ignoreDependencies.includes(dependabotOrgAlert.security_vulnerability.package.name)
+                            )
+                            .map((dependabotOrgAlert) =>
+                              toOrgAlert(dependabotOrgAlert),
+                            )


Same comment as above

kunalnagar · 2024-12-18T18:19:46Z

src/fetch-alerts.ts

@@ -66,6 +78,7 @@ export const fetchEnterpriseAlerts = async (
  enterprise: string,
  severity: string,
  ecosystem: string,
+  ignoreDependencies: string[],


Suggested change

ignoreDependencies: string[],

ignorePackages: string[],

kunalnagar · 2024-12-18T18:20:46Z

src/fetch-alerts.ts

+  const alerts: Alert[] = response
+                            .data
+                            .filter((dependabotEnterpriseAlert) =>
+                              !ignoreDependencies.includes(dependabotEnterpriseAlert.security_vulnerability.package.name)
+                            )
+                            .map((dependabotEnterpriseAlert) =>
+                              toEnterpriseAlert(dependabotEnterpriseAlert),
+                            )


Same comment as above

kunalnagar · 2024-12-18T18:21:29Z

src/main.ts

@@ -39,16 +39,20 @@ async function run(): Promise<void> {
    const count = parseInt(getInput('count'))
    const severity = getInput('severity')
    const ecosystem = getInput('ecosystem')
+    const ignoreDependencies = (


Suggested change

const ignoreDependencies = (

const ignorePackages = (

kunalnagar · 2024-12-18T18:23:35Z

src/main.ts

+      getInput('ignore_dependencies') || ''
+    ).split(',').map((str: string) => str.trim())


Let's pass the value here directly using getInput and do the transform inside the logic where we check if this field has values. We don't need to do this transform if no values exist.

rndev15 · 2025-01-21T13:30:01Z

Good day, @kunalnagar

With the help of my colleague we made some changes to original PR:

Splitted fetch*Alerts to different files
Allow to specify not only package but CVE to ignore (see example in action.yml)

Here is the example of how feature works (I blurred repo & org name). On first slack message we can see how code works with ignore_packages equals to ''. Second message: I set ignore_packages to jquery-ui-rails#CVE-2022-31160,bootstrap-sass

rndev15 · 2025-01-31T08:24:47Z

Good day, @kunalnagar
any chance to take a look, please?

rndev15 requested a review from kunalnagar as a code owner December 5, 2024 14:01

kunalnagar reviewed Dec 18, 2024

View reviewed changes

rndev15 force-pushed the allow-ignore-deps branch 10 times, most recently from 4ea676e to 811c916 Compare January 21, 2025 13:24

rndev15 requested a review from kunalnagar January 27, 2025 09:09

feat: Allow to ignore specific dependencies

46c0ef5

rndev15 force-pushed the allow-ignore-deps branch from 811c916 to 46c0ef5 Compare January 27, 2025 09:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Allow to ignore specific dependencies #196

feat: Allow to ignore specific dependencies #196

rndev15 commented Dec 5, 2024

rndev15 commented Dec 9, 2024

rndev15 commented Dec 13, 2024

kunalnagar commented Dec 17, 2024

rndev15 commented Dec 18, 2024

kunalnagar left a comment

kunalnagar Dec 18, 2024

kunalnagar Dec 18, 2024

kunalnagar Dec 18, 2024

kunalnagar Dec 18, 2024

kunalnagar Dec 18, 2024

kunalnagar Dec 18, 2024

kunalnagar Dec 18, 2024

kunalnagar Dec 18, 2024

kunalnagar Dec 18, 2024

kunalnagar Dec 18, 2024

rndev15 commented Jan 21, 2025

rndev15 commented Jan 31, 2025

	description: 'A comma-separated list of dependencies to ignore. If specified, these dependencies will not be alerted.'
	description: 'A comma-separated list of package names. If specified, alerts for these packages will be ignored.'

		getInput('ignore_dependencies') \|\| ''
		).split(',').map((str: string) => str.trim())

feat: Allow to ignore specific dependencies #196

Are you sure you want to change the base?

feat: Allow to ignore specific dependencies #196

Conversation

rndev15 commented Dec 5, 2024

rndev15 commented Dec 9, 2024

rndev15 commented Dec 13, 2024

kunalnagar commented Dec 17, 2024

rndev15 commented Dec 18, 2024

kunalnagar left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rndev15 commented Jan 21, 2025

rndev15 commented Jan 31, 2025