Feature request: Add support to report the versions to the dependency graph API
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start by reviewing the existing automatic dependency submission flow and lockfile generation, then compare the linked actions-dependency-submission implementation. Trace how floating tags, branches, and SHAs are narrowed and how versions reach the dependency graph API. Done means dependencies resolved from an existing or ephemeral lockfile are submitted with actual versions so vulnerability reporting works.
Written by the indexing model from the issue text.
Description
Right now security vulnerability reporting is broken when a workflow uses a floating tag, branch or sha.
The lock file is a perfect source for the dependency graph to record the dependencies.
The built-in narrowing could also report the actual versions so that de vulnerability reporting works.
I currently have an action that implements this based on parsing the workflows directly:
https://github.com/jessehouwing/actions-dependency-submission
It would be awesome if the "automatic dependency submission" would actually use the existing lock file or generate a ephemeral lockfile.
- Dominant language
- Go
- Stars
- 295
- Forks
- 21
- Avg merge
- 19h 30m
- Merged PRs (30d)
- 60
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/gh-actions-lock
-
Fix mode unpins a reusable workflow call when the same repository is also used as a step actionPossibly taken @suzuki-shunsuke claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/gh-actions-lock#261 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
github/gh-actions-lock#264 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 Half a day Newbie friendliness 42/100
github/gh-actions-lock#262 ·
Maintainers usually reply within 1 day
-
Dependabot drops an unchanged transitive dependency when bumping a composite actionPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 4/5 3-5 days Newbie friendliness 30/100
github/gh-actions-lock#257 · 1 comment ·
Maintainers usually reply within 1 day
-
--migrate-local-actions rewrites action files in nested worktrees and submodulesPossibly taken @aksestok claimed this 2 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 20/100
github/gh-actions-lock#253 ·
Maintainers usually reply within 1 day
All issues in github/gh-actions-lock
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
yetone/magpie#5265 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Azure/aztfexport#690 · 1 reaction ·
-
dm: kin-openapi v0.144.0 is affected by five CVEs (panic / auth bypass) — bump to v0.149.0Possibly taken @GMHDBJD claimed this today. Openaffects-26.3 affects-26.9 affects-7.5 affects-8.1 affects-8.5 area/dm dependencies severity/major type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
kubecost/ibm-finops-agent#289 ·
Maintainers usually reply within 2 days
-
ai-driven-fuzzing bug Minor
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
linagora/cozy-stack#5162 ·
Maintainers usually reply within 1 day