依存関係のサブミット
Dependency submission APIを使うと、プロジェクトのビルドあるいはコンパイル時に解決される依存関係などをプロジェクトにサブミットできます。
Dependency submission APIについて
Note: The Dependency submission API is currently in public beta and subject to change.
The Dependency submission API lets you submit dependencies for a project. This enables you to add dependencies, such as those resolved when software is compiled or built, to GitHub's dependency graph feature, providing a more complete picture of all of your project's dependencies.
The dependency graph shows any dependencies you submit using the API in addition to any dependencies that are identified from manifest or lock files in the repository (for example, a package-lock.json
file in a JavaScript project). For more information about viewing the dependency graph, see "Exploring the dependencies of a repository."
Submitted dependencies will receive Dependabotアラート and Dependabotセキュリティアップデート for any known vulnerabilities. 依存関係に対するDependabotアラートが得られるのは、GitHub Advisory Databaseのサポートされているエコシステムのいずれかからのものである場合だけです。 Submitted dependencies will not be surfaced in dependency review or your organization's dependency insights.
依存関係は、スナップショットの形でDependency submission APIにサブミットされます。 スナップショットは、コミットSHAに関連づけられた依存関係のセット及び他のメタデータで、コミットに対するリポジトリの現在の状態を反映します。 プロジェクトがビルドされるたびに、必要な形式でDependency submission APIに依存関係をサブミットするために、事前作成されたアクションを使うか、独自のアクションを作成するかは選択できます。 Dependency submission APIの利用に関する詳しい情報については「Dependency submission APIの利用」を参照してください。
依存関係グラフに含める依存関係の複数のセットをDependency submission APIにサブミットできます。 このAPIは、スナップショットのjob.correlator
プロパティとdetector.name
カテゴリを使い、示された各ワークフローに対する最新のサブミットを保証します。 correlator
自体は、独立したサブミットを区別するために使用する主要なフィールドです。 correlator
の例としては、アクションの実行で利用できる<GITHUB_WORKFLOW> <GITHUB_JOB>
という2つの変数のシンプルな組み合わせがあります。
Create a snapshot of dependencies for a repository
Create a new snapshot of a repository's dependencies. You must authenticate using an access token with the repo
scope to use this endpoint for a repository that the requesting user has access to.
パラメータ
Headers | ||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
名前, 種類, 説明 | ||||||||||||||||||||
accept stringSetting to | ||||||||||||||||||||
Path parameters | ||||||||||||||||||||
名前, 種類, 説明 | ||||||||||||||||||||
owner string必須The account owner of the repository. The name is not case sensitive. | ||||||||||||||||||||
repo string必須The name of the repository. The name is not case sensitive. | ||||||||||||||||||||
Body parameters | ||||||||||||||||||||
名前, 種類, 説明 | ||||||||||||||||||||
version integer必須The version of the repository snapshot submission. | ||||||||||||||||||||
job object必須 | ||||||||||||||||||||
Properties of the |
名前, 種類, 説明 |
---|
id string必須The external ID of the job. |
correlator string必須Correlator provides a key that is used to group snapshots submitted over time. Only the "latest" submitted snapshot for a given combination of |
html_url stringThe url for the job. |
sha
string必須The commit SHA associated with this dependency snapshot.
ref
string必須The repository branch that triggered this snapshot.
detector
object必須A description of the detector used.
Properties of thedetector
object
名前, 種類, 説明 |
---|
name string必須The name of the detector used. |
version string必須The version of the detector used. |
url string必須The url of the detector used. |
metadata
objectUser-defined metadata to store domain-specific information limited to 8 keys with scalar values.
manifests
objectA collection of package manifests
Properties of themanifests
object
名前, 種類, 説明 |
---|
key stringA user-defined key to represent an item in |
Properties of thekey
object
名前, 種類, 説明 |
---|
name string必須The name of the manifest. |
file object |
metadata objectUser-defined metadata to store domain-specific information limited to 8 keys with scalar values. |
resolved |
Properties of thefile
object
名前, 種類, 説明 |
---|
source_location stringThe path of the manifest file relative to the root of the Git repository. |
Properties of theresolved
名前, 種類, 説明 |
---|
key stringA user-defined key to represent an item in |
Properties of thekey
object
名前, 種類, 説明 |
---|
package_url stringPackage-url (PURL) of dependency. See https://github.com/package-url/purl-spec for more details. |
metadata objectUser-defined metadata to store domain-specific information limited to 8 keys with scalar values. |
relationship stringA notation of whether a dependency is requested directly by this manifest or is a dependency of another dependency. Can be one of: |
scope stringA notation of whether the dependency is required for the primary build artifact (runtime) or is only used for development. Future versions of this specification may allow for more granular scopes. Can be one of: |
dependencies array of stringsArray of package-url (PURLs) of direct child dependencies. |
scanned
string必須The time at which the snapshot was scanned.
HTTP response status codes
Status code | 説明 |
---|---|
201 | Created |
コードサンプル
curl \
-X POST \
-H "Accept: application/vnd.github+json" \
-H "Authorization: token <TOKEN>" \
https://api.github.com/repos/OWNER/REPO/dependency-graph/snapshots \
-d '{"version":0,"sha":"ce587453ced02b1526dfb4cb910479d431683101","ref":"refs/heads/main","job":{"correlator":"yourworkflowname_youractionname","id":"yourrunid"},"detector":{"name":"octo-detector","version":"0.0.1","url":"https://github.com/octo-org/octo-repo"},"scanned":"2022-06-14T20:25:00Z","manifests":{"package-lock.json":{"name":"package-lock.json","file":{"source_location":"src/package-lock.json"},"resolved":{"@actions/core":{"package_url":"pkg:/npm/%40actions/core@1.1.9","dependencies":["@actions/http-client"]},"@actions/http-client":{"package_url":"pkg:/npm/%40actions/http-client@1.0.7","dependencies":["tunnel"]},"tunnel":{"package_url":"pkg:/npm/tunnel@0.0.6"}}}}}'
Response
Status: 201
{
"id": 12345,
"created_at": "2018-05-04T01:14:52Z",
"message": "Dependency results for the repo have been successfully updated.",
"result": "SUCCESS"
}