Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Submit sbt dependencies to GitHub for vulnerability monitoring #44

Conversation

gu-dependency-graph-integrator[bot]

What does this change?

This PR sends your sbt dependencies to GitHub for vulnerability monitoring via Dependabot. The submitted dependencies will appear in the Dependency Graph on merge to main (it might take a few minutes to update).

Why?

If a repository is in production, we need to track its third party dependencies for vulnerabilities. Historically, we have done this using Snyk, but we are now moving to GitHub’s native Dependabot. Scala is not a language that Dependabot supports out of the box, this workflow is required to make it happen. As a result, we have raised this PR on your behalf to add it to the Dependency Graph.

How has it been verified?

We have tested this workflow, and the process of raising a PR on DevX repos, and have verified that it works. However, we have included some instructions below to help you verify that it works for you. Please do not hesitate to contact DevX Security if you have any questions or concerns.

Further information for sbt

See the sbt workflow documentation for further information and configuration options.

What do I need to do?

  • Ensure that the version of sbt in the project is v1.5 or above in order for the dependency submission action to run.
  • A run of this action should have been triggered when the branch was created. Sense check the output of "Log snapshot for user validation", and make sure that your dependencies look okay.
  • When you are happy the action works, remove the branch name sbt-dependency-graph-b1d7ec77cb7613db trigger from the the yaml file (aka delete line 6), approve, and merge.

@NovemberTang NovemberTang deleted the sbt-dependency-graph-b1d7ec77cb7613db branch October 16, 2024 10:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant