bug: Getting Invalid purl: version must be percent-encoded error

[stevehipwell]

I'm seeing the Invalid purl: version must be percent-encoded error using v0.1.0 in workflows which were working correctly on v0.0.1. This is likely due to the packageurl-js dependency (via @github/dependency-submission-toolkit). See example workflow.

FYI I think package-url/packageurl-js#61 may possibly fix this.

[GeekMasher]

Thanks for raising this @stevehipwell, I have seen this issue when updating the packages and I thought I had fixed this myself.

Let me see what I can do to fix this

[GeekMasher]

@stevehipwell I've created this PR #42 that should help fix the issue. If there are issues with the PURL, it will show them as warnings + I've added better testing support.

You can try out this PR before I merge by using the following (once merged it will go)

- name: SBOM upload
  uses: advanced-security/spdx-dependency-submission-action@hotfix-purl

I'm not 100% sure why its failing to parse the PURL but at least now it will upload + tell you which PURL caused the errors.

[GeekMasher]

@stevehipwell Please me me know if you have any other issues