依存関係のサブミット
Dependency submission APIを使うと、プロジェクトのビルドあるいはコンパイル時に解決される依存関係などをプロジェクトにサブミットできます。
Dependency submission APIについて
Note: The Dependency submission API is currently in public beta and subject to change.
The Dependency submission API lets you submit dependencies for a project. This enables you to add dependencies, such as those resolved when software is compiled or built, to GitHub's dependency graph feature, providing a more complete picture of all of your project's dependencies.
The dependency graph shows any dependencies you submit using the API in addition to any dependencies that are identified from manifest or lock files in the repository (for example, a package-lock.json file in a JavaScript project). For more information about viewing the dependency graph, see "Exploring the dependencies of a repository."
Submitted dependencies will receive Dependabotアラート and Dependabotセキュリティアップデート for any known vulnerabilities. 依存関係に対するDependabotアラートが得られるのは、GitHub Advisory Databaseのサポートされているエコシステムのいずれかからのものである場合だけです。 Submitted dependencies will not be surfaced in dependency review or your organization's dependency insights.
依存関係は、スナップショットの形でDependency submission APIにサブミットされます。 スナップショットは、コミットSHAに関連づけられた依存関係のセット及び他のメタデータで、コミットに対するリポジトリの現在の状態を反映します。 プロジェクトがビルドされるたびに、必要な形式でDependency submission APIに依存関係をサブミットするために、事前作成されたアクションを使うか、独自のアクションを作成するかは選択できます。 Dependency submission APIの利用に関する詳しい情報については「Dependency submission APIの利用」を参照してください。
依存関係グラフに含める依存関係の複数のセットをDependency submission APIにサブミットできます。 このAPIは、スナップショットのjob.correlatorプロパティとdetector.nameカテゴリを使い、示された各ワークフローに対する最新のサブミットを保証します。 correlator自体は、独立したサブミットを区別するために使用する主要なフィールドです。 correlatorの例としては、アクションの実行で利用できる<GITHUB_WORKFLOW> <GITHUB_JOB>という2つの変数のシンプルな組み合わせがあります。
Create a snapshot of dependencies for a repository
Create a new snapshot of a repository's dependencies. You must authenticate using an access token with the repo scope to use this endpoint for a repository that the requesting user has access to.
パラメータ
| Headers | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 名前, 種類, 説明 | ||||||||||||||||||||
acceptstringSetting to | ||||||||||||||||||||
| Path parameters | ||||||||||||||||||||
| 名前, 種類, 説明 | ||||||||||||||||||||
ownerstring必須The account owner of the repository. The name is not case sensitive. | ||||||||||||||||||||
repostring必須The name of the repository. The name is not case sensitive. | ||||||||||||||||||||
| Body parameters | ||||||||||||||||||||
| 名前, 種類, 説明 | ||||||||||||||||||||
versioninteger必須The version of the repository snapshot submission. | ||||||||||||||||||||
jobobject必須 | ||||||||||||||||||||
Properties of the | ||||||||||||||||||||
| 名前, 種類, 説明 |
|---|
idstring必須The external ID of the job. |
correlatorstring必須Correlator provides a key that is used to group snapshots submitted over time. Only the "latest" submitted snapshot for a given combination of |
html_urlstringThe url for the job. |
shastring必須The commit SHA associated with this dependency snapshot.
refstring必須The repository branch that triggered this snapshot.
detectorobject必須A description of the detector used.
Properties of thedetectorobject
| 名前, 種類, 説明 |
|---|
namestring必須The name of the detector used. |
versionstring必須The version of the detector used. |
urlstring必須The url of the detector used. |
metadataobjectUser-defined metadata to store domain-specific information limited to 8 keys with scalar values.
manifestsobjectA collection of package manifests
Properties of themanifestsobject
| 名前, 種類, 説明 |
|---|
keystringA user-defined key to represent an item in |
Properties of thekeyobject
| 名前, 種類, 説明 |
|---|
namestring必須The name of the manifest. |
fileobject |
metadataobjectUser-defined metadata to store domain-specific information limited to 8 keys with scalar values. |
resolved |
Properties of thefileobject
| 名前, 種類, 説明 |
|---|
source_locationstringThe path of the manifest file relative to the root of the Git repository. |
Properties of theresolved
| 名前, 種類, 説明 |
|---|
keystringA user-defined key to represent an item in |
Properties of thekeyobject
| 名前, 種類, 説明 |
|---|
package_urlstringPackage-url (PURL) of dependency. See https://github.com/package-url/purl-spec for more details. |
metadataobjectUser-defined metadata to store domain-specific information limited to 8 keys with scalar values. |
relationshipstringA notation of whether a dependency is requested directly by this manifest or is a dependency of another dependency. Can be one of: |
scopestringA notation of whether the dependency is required for the primary build artifact (runtime) or is only used for development. Future versions of this specification may allow for more granular scopes. Can be one of: |
dependenciesarray of stringsArray of package-url (PURLs) of direct child dependencies. |
scannedstring必須The time at which the snapshot was scanned.
HTTP response status codes
| Status code | 説明 |
|---|---|
201 | Created |
コードサンプル
curl \
-X POST \
-H "Accept: application/vnd.github+json" \
-H "Authorization: token <TOKEN>" \
https://api.github.com/repos/OWNER/REPO/dependency-graph/snapshots \
-d '{"version":0,"sha":"ce587453ced02b1526dfb4cb910479d431683101","ref":"refs/heads/main","job":{"correlator":"yourworkflowname_youractionname","id":"yourrunid"},"detector":{"name":"octo-detector","version":"0.0.1","url":"https://github.com/octo-org/octo-repo"},"scanned":"2022-06-14T20:25:00Z","manifests":{"package-lock.json":{"name":"package-lock.json","file":{"source_location":"src/package-lock.json"},"resolved":{"@actions/core":{"package_url":"pkg:/npm/%40actions/core@1.1.9","dependencies":["@actions/http-client"]},"@actions/http-client":{"package_url":"pkg:/npm/%40actions/http-client@1.0.7","dependencies":["tunnel"]},"tunnel":{"package_url":"pkg:/npm/tunnel@0.0.6"}}}}}'Response
Status: 201{
"id": 12345,
"created_at": "2018-05-04T01:14:52Z",
"message": "Dependency results for the repo have been successfully updated.",
"result": "SUCCESS"
}