packages starting with "@" are not working in allowlist about audit-ci

[quinnturner]

Hi there, just trying to confirm the implementation here based on the logs that you've shown:

• @optimizely/react-sdk: if I recall the implementation correctly, allowlisting modules only allowlists direct advisories of the module itself. It will not work with transitive advisories. In this case, none of the advisories are @optimizely/react-sdk itself. Rather, it's things like json-schema. If you want all transitives for @optimizely/react-sdk, you'd do @optimizely/react-sdk>* (I think that's how it works, it's late, forgetting off the top of my head :))
• @storybook/react: same
• *|@storybook/addon-actions>* none of these have the first level of advisory being @storybook/addon-actions, so it won't allowlist.
• @svgr/webpack same as first

I added some test cases in a WIP PR here to show scoped packages working: quinnturner#2.

[WhatIfWeDigDeeper]

Thanks for looking into this. I changed the config per your comment and they now all get allow listed. Thanks!

  "allowlist": [
  "*|@optimizely/react-sdk>*",
  "*|@storybook/react>*",
  "*|@storybook/addon-actions>*",
  "*|@svgr/webpack>*",
  "minimist"
 ]