Skip to content

Commit 7612d9e

Browse files
committed
updates based on feedback!
1 parent 723444d commit 7612d9e

File tree

3 files changed

+18
-10
lines changed

3 files changed

+18
-10
lines changed

content/code-security/guides.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ includeGuides:
8484
- /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository
8585
- /code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review
8686
- /code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph
87+
- /code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api
8788
- /code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository
8889
---
8990

content/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api.md

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Using the Dependency submission API
3-
intro: 'You can use the Dependency submission API to submit dependencies for projects that resolve dependencies when the project is built or compiled.'
3+
intro: 'You can use the Dependency submission API to submit dependencies for projects that resolve dependencies when the project is built or compiled, providing a fuller picture of your project's dependencies for the dependency graph.'
44
shortTitle: Dependency submission API
55
topics:
66
- API
@@ -17,17 +17,15 @@ versions:
1717

1818
{% data reusables.dependency-submission.about-dependency-submission %}
1919

20-
For more information about the Dependency submission API, see the [Dependency submission REST API documentation](/rest/dependency-graph/dependency-submission).
20+
Dependencies are submitted to the dependency submission API in the form of a snapshot, a set of dependencies, associated with a commit SHA and other metadata, that reflects the current state of your repository for the commit. For more information about the Dependency submission API, see the [Dependency submission REST API documentation](/rest/dependency-graph/dependency-submission).
2121

2222
## Submitting dependencies at build-time
2323

24-
You can use the Dependency submission API in a {% data variables.product.prodname_actions %} workflow to submit dependencies for your project when your project is built. Your workflow should:
24+
You can use the Dependency submission API in a {% data variables.product.prodname_actions %} workflow to submit dependencies for your project when your project is built.
2525

26-
- generate a list of dependencies for your project.
27-
- translate the list of dependencies into the format accepted by the Dependency submission API. For more information about the format, see the body parameters for the "Create a repository snapshot" API operation in the [Dependency submission REST API documentation](/rest/dependency-graph/dependency-submission).
28-
- submit the formatted list of dependencies to the Dependency submission API.
26+
### Using pre-made actions
2927

30-
Actions that perform these steps for various ecosystems are available on {% data variables.product.prodname_marketplace %}. You can find links to the available actions in the table below:
28+
The simplest way to use the Dependency submission API is by adding a pre-made action to your repository that will gather and convert the list of dependencies to the required snapshot format and submit the list to the API. Actions that complete these steps for various ecosystems are available on {% data variables.product.prodname_marketplace %} and more actions will be created during the course of the beta. You can find links to the currently available actions in the table below:
3129

3230
Ecosystem | Action |
3331
--- | --- |
@@ -70,5 +68,12 @@ jobs:
7068
go-build-target: go-example/cmd/octocat.go
7169

7270
```
71+
### Creating your own action
7372

74-
Alternatively, you can write your own action to perform these steps. {% data variables.product.product_name %} maintains the [Dependency Submission Toolkit](https://github.com/github/dependency-submission-toolkit), a TypeScript library to help you build your own GitHub Action for submitting dependencies to the Dependency submission API. For more information about writing an action, see "[Creating actions](/actions/creating-actions)".
73+
Alternatively, you can write your own action to submit dependencies for your project at build-time. Your workflow should:
74+
75+
1. Generate a list of dependencies for your project.
76+
2. Translate the list of dependencies into the snapshot format accepted by the Dependency submission API. For more information about the format, see the body parameters for the "Create a repository snapshot" API operation in the [Dependency submission REST API documentation](/rest/dependency-graph/dependency-submission).
77+
3. Submit the formatted list of dependencies to the Dependency submission API.
78+
79+
{% data variables.product.product_name %} maintains the [Dependency Submission Toolkit](https://github.com/github/dependency-submission-toolkit), a TypeScript library to help you build your own GitHub Action for submitting dependencies to the Dependency submission API. For more information about writing an action, see "[Creating actions](/actions/creating-actions)".
Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1-
The Dependency submission API lets you submit dependencies for a project to generate a dependency graph. This enables you to integrate dependencies that are resolved when software is compiled or built with {% data variables.product.prodname_dotcom %}'s dependency graph feature. For more information about viewing the dependency graph, see "[Exploring the dependencies of a repository](/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#viewing-the-dependency-graph)." Submitted dependencies will receive {% data variables.product.prodname_dependabot_alerts %} and {% data variables.product.prodname_dependabot_security_updates %} for any known vulnerabilities.
1+
The Dependency submission API lets you submit dependencies for a project. This enables you to add dependencies that are resolved when software is compiled or built to {% data variables.product.prodname_dotcom %}'s dependency graph feature, providing a more complete picture of all of your project's dependencies.
22

3-
The dependency graph shows any dependencies you submit using the API in addition to any dependencies that are identified from manifest or lock files in the repository (for example, a `package-lock.json` file in a JavaScript project).
3+
The dependency graph shows any dependencies you submit using the API in addition to any dependencies that are identified from manifest or lock files in the repository (for example, a `package-lock.json` file in a JavaScript project). For more information about viewing the dependency graph, see "[Exploring the dependencies of a repository](/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#viewing-the-dependency-graph)."
4+
5+
Submitted dependencies will receive {% data variables.product.prodname_dependabot_alerts %} and {% data variables.product.prodname_dependabot_security_updates %} for any known vulnerabilities. Submitted dependencies will not be surfaced in dependency reviews or your organization's dependency insights.

0 commit comments

Comments
 (0)