Initialize verifier repo.

[taotao-circle]

I squash all history to prepare for the open source.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Manifest Files

[tjbaker]

missing newline

[taotao-circle]

updated it

[jscaltreto]

I don't think the @ between the package and the version should be percent-encoded. I tested using the purl parser from the dependency-review-action, and it ends up lumping the version in with the package name:

> parsePURL('pkg:npm/%40bcoe/v8-coverage%40%5E0.2.3')
{
  type: 'npm',
  namespace: '@bcoe',
  name: 'v8-coverage@^0.2.3',
  version: null,
  original: 'pkg:npm/%40bcoe/v8-coverage%40%5E0.2.3',
  error: null
}

Using the @ symbol there it parses correctly:

> parsePURL('pkg:npm/%40bcoe/v8-coverage@%5E0.2.3')
{
  type: 'npm',
  namespace: '@bcoe',
  name: 'v8-coverage',
  version: '^0.2.3',
  original: 'pkg:npm/%40bcoe/v8-coverage@%5E0.2.3',
  error: null
}

(incidentally, it doesn't look like the percent encoding is required at all with this action; 'pkg:npm/@bcoe/v8-coverage@^0.2.3' parses correctly)

It also doesn't look like it's necessary to specify version here at all as only the package type and name are matched in the dependency-review-action, so you could safely remove the versions entirely.

[taotao-circle]

@jscaltreto it's one of the check flow requires that (basic workflows/scan/...)

[taotao-circle]

@jscaltreto see I changed it back to the @. The basic flow fails.