Skip to content

SP-3565: Update dependencies #140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Alex-1089 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

SP-3565: Update dependencies #140

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
96ef510
Updated dependencies
Alex-1089 May 18, 2026
7dcbaae
Upgraded actions/upload-artifact to 7. Added mock for @actions/core. …
Alex-1089 May 18, 2026
08cb65c
Moving to Node 24 as a minimum.
Alex-1089 May 18, 2026
1e6dafd
Updated README.md to use 'gha-code-scan' and actions/checkout to use …
Alex-1089 May 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/check-dist.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ jobs:
- if: ${{ failure() && steps.diff.outcome == 'failure' }}
name: Upload Artifact
id: upload
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: dist
path: dist/
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
steps:
- name: Checkout
id: checkout
uses: actions/checkout@v5
uses: actions/checkout@v6

- name: Setup Node.js
id: setup-node
Expand Down
2 changes: 1 addition & 1 deletion .node-version
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
20.6.0
24.15.0
13 changes: 13 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

## [1.6.3] - 2026-05-18
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add the missing 1.6.3 release reference link.

Line 10 introduces [1.6.3], but there’s no matching reference definition at the bottom of the file, so this entry won’t link like prior versions.

Suggested patch 
+[1.6.3]: https://github.com/scanoss/gha-code-scan/compare/v1.6.2...v1.6.3
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CHANGELOG.md` at line 10, Add a missing reference definition for the release
tag [1.6.3] used in the changelog: locate the other version reference links at
the bottom of the file (the pattern like [1.6.2]: https://...) and add a new
line defining [1.6.3] with the appropriate release URL or commit/tag link (e.g.,
[1.6.3]: <release/compare or tag URL>) so the in-text `[1.6.3]` entry resolves
correctly.

Copy link
Copy Markdown
Contributor

@agustingroh agustingroh May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add the reference version at the bottom of the file

### Changed
- Upgraded Node.js to 24
- Upgraded eslint-plugin jest to 29.15.2
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix package name typo in changelog text.

Line 13 says eslint-plugin jest; package name should be eslint-plugin-jest.

Suggested patch 
-- Upgraded eslint-plugin jest to 29.15.2
+- Upgraded eslint-plugin-jest to 29.15.2
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- Upgraded eslint-plugin jest to 29.15.2
- Upgraded eslint-plugin-jest to 29.15.2
🧰 Tools
🪛 LanguageTool

[grammar] ~13-~13: Use a hyphen to join words.
Context: ...d Node.js to 24 - Upgraded eslint-plugin jest to 29.15.2 - Upgraded @types/node t...

(QB_NEW_EN_HYPHEN)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CHANGELOG.md` at line 13, Fix the package name typo in the changelog by
replacing the string "eslint-plugin jest" with the correct package name
"eslint-plugin-jest" (update the entry that currently reads "Upgraded
eslint-plugin jest to 29.15.2" so it reads "Upgraded eslint-plugin-jest to
29.15.2").

Copy link
Copy Markdown
Contributor

@agustingroh agustingroh May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please fix typo. It should be eslint-plugin-jest

- Upgraded @types/node to 25.3.5
- Upgraded @actions/core to 3.0.0
- Upgraded globals to 17.4.0
- Upgraded actions/upload-artifact to 7
- Added __mocks__/@actions/core.ts to mock @actions/core for tests
- Updated actions/checkout to v6 in README.md
### Fixed
- Changed 'code-scan-action' to 'gha-code-scan' in README.md
Copy link
Copy Markdown
Contributor

@agustingroh agustingroh May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you also add a note to README.md recommending users migrate to scanoss/gha-code-scan? The rename redirect keeps old references working, but we should point users to the canonical name.


## [1.6.2] - 2026-05-11
### Changed
- Upgraded `scanoss.py` runtime container to v1.52.1
Expand Down
20 changes: 10 additions & 10 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# SCANOSS Code Scan Action

[![GitHub Super-Linter](https://github.com/scanoss/code-scan-action/actions/workflows/linter.yml/badge.svg)](https://github.com/super-linter/super-linter)
![CI](https://github.com/scanoss/code-scan-action/actions/workflows/ci.yml/badge.svg)
[![Check dist/](https://github.com/scanoss/code-scan-action/actions/workflows/check-dist.yml/badge.svg)](https://github.com/scanoss/scanoss-code-scan-step/actions/workflows/check-dist.yml)
[![CodeQL](https://github.com/scanoss/code-scan-action/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/scanoss/scanoss-code-scan-step/actions/workflows/codeql-analysis.yml)
[![GitHub Super-Linter](https://github.com/scanoss/gha-code-scan/actions/workflows/linter.yml/badge.svg)](https://github.com/super-linter/super-linter)
![CI](https://github.com/scanoss/gha-code-scan/actions/workflows/ci.yml/badge.svg)
[![Check dist/](https://github.com/scanoss/gha-code-scan/actions/workflows/check-dist.yml/badge.svg)](https://github.com/scanoss/scanoss-code-scan-step/actions/workflows/check-dist.yml)
[![CodeQL](https://github.com/scanoss/gha-code-scan/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/scanoss/scanoss-code-scan-step/actions/workflows/codeql-analysis.yml)
![Coverage](./badges/coverage.svg)

The SCANOSS Code Scan Action enhances your software development process by automatically scanning your code for security
Expand Down Expand Up @@ -77,11 +77,11 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v6

- name: Run SCANOSS Code Scan
id: scanoss-code-scan-step
uses: scanoss/code-scan-action@v1
uses: scanoss/gha-code-scan@v1
```

For example workflow runs, check out our
Expand Down Expand Up @@ -178,7 +178,7 @@ When Dependency Track integration is enabled, you'll see these checks in your Gi
#### Basic Configuration
```yaml
- name: Run SCANOSS Code Scan with Dependency Track
uses: scanoss/code-scan-action@v1
uses: scanoss/gha-code-scan@v1
with:
deptrack.upload: true
deptrack.url: 'https://your-dt-instance.com'
Expand All @@ -190,7 +190,7 @@ When Dependency Track integration is enabled, you'll see these checks in your Gi
#### Advanced Configuration with Policies
```yaml
- name: Run SCANOSS Code Scan with Full Dependency Track Integration
uses: scanoss/code-scan-action@v1
uses: scanoss/gha-code-scan@v1
with:
policies: copyleft, undeclared, dt # Enable all policies including Dependency Track
deptrack.upload: true
Expand Down Expand Up @@ -237,11 +237,11 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v6

- name: Run SCANOSS Code Scan
id: scanoss-code-scan-step
uses: scanoss/code-scan-action@v1
uses: scanoss/gha-code-scan@v1
with:
policies: copyleft, undeclared, dt
scanMode: 'delta'
Expand Down
40 changes: 40 additions & 0 deletions __mocks__/@actions/core.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
// SPDX-License-Identifier: MIT
/*
Copyright (c) 2026, SCANOSS

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
*/

export const debug = jest.fn();
export const error = jest.fn();
export const info = jest.fn();
export const notice = jest.fn();
export const warning = jest.fn();
export const setFailed = jest.fn();
export const setOutput = jest.fn();
export const setSecret = jest.fn();
export const getInput = jest.fn().mockReturnValue('');

export const summary = {
addHeading: jest.fn().mockReturnThis(),
addRaw: jest.fn().mockReturnThis(),
addSeparator: jest.fn().mockReturnThis(),
addCodeBlock: jest.fn().mockReturnThis(),
write: jest.fn().mockResolvedValue(undefined)
};
9 changes: 1 addition & 8 deletions __tests__/dep-track-policy-check.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,19 +69,12 @@ jest.mock('@actions/github', () => ({

const mockGetExecOutput = jest.spyOn(exec, 'getExecOutput');

// Mock core.warning at the module level
jest.mock('@actions/core', () => ({
...jest.requireActual('@actions/core'),
warning: jest.fn()
}));

const mockCoreWarning = core.warning as jest.MockedFunction<typeof core.warning>;

describe('DepTrackPolicyCheck', () => {
let depTrackPolicyCheck: DepTrackPolicyCheck;
const appInput = jest.requireMock('../src/app.input');
const TEST_DIR = __dirname;
const TEST_REPO_DIR = path.join(TEST_DIR, 'data');
const TEST_REPO_DIR = path.join(__dirname, 'data');

beforeEach(() => {
appInput.REPO_DIR = TEST_REPO_DIR;
Expand Down
2 changes: 1 addition & 1 deletion action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,5 +120,5 @@ outputs:
description: 'Scanner command output'

runs:
using: node20
using: node24
main: dist/index.js
Loading
Loading