{"id":15046164,"url":"https://github.com/scalacenter/sbt-dependency-submission","last_synced_at":"2025-04-05T01:07:19.620Z","repository":{"id":37236601,"uuid":"504158746","full_name":"scalacenter/sbt-dependency-submission","owner":"scalacenter","description":"A Github Action to submit the dependency graph of an sbt build to the Dependency Submission API","archived":false,"fork":false,"pushed_at":"2025-03-18T07:08:46.000Z","size":1485,"stargazers_count":64,"open_issues_count":14,"forks_count":20,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-03-29T00:09:55.308Z","etag":null,"topics":["actions","dependencies","github-actions","sbt","scala","submission-api"],"latest_commit_sha":null,"homepage":"","language":"Scala","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/scalacenter.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-06-16T13:04:53.000Z","updated_at":"2025-03-18T07:08:50.000Z","dependencies_parsed_at":"2023-11-14T09:27:13.799Z","dependency_job_id":"8b16efb6-7cb8-4073-8028-7a6f2ed097ca","html_url":"https://github.com/scalacenter/sbt-dependency-submission","commit_stats":{"total_commits":175,"total_committers":13,"mean_commits":"13.461538461538462","dds":0.5771428571428572,"last_synced_commit":"c94e0a1637d6852c23ce7d50556035dea2fed9a3"},"previous_names":[],"tags_count":21,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scalacenter%2Fsbt-dependency-submission","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scalacenter%2Fsbt-dependency-submission/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scalacenter%2Fsbt-dependency-submission/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scalacenter%2Fsbt-dependency-submission/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/scalacenter","download_url":"https://codeload.github.com/scalacenter/sbt-dependency-submission/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247271530,"owners_count":20911587,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["actions","dependencies","github-actions","sbt","scala","submission-api"],"created_at":"2024-09-24T20:52:47.870Z","updated_at":"2025-04-05T01:07:19.604Z","avatar_url":"https://github.com/scalacenter.png","language":"Scala","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Sbt Dependency Submission\n\nA Github action to submit the dependency graph of an [sbt](https://www.scala-sbt.org/) build to the Github [Dependency submission API](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api).\n\nBefore running the workflow, make sure that the `Dependency Graph` feature is enabled in the settings of your repository (`Settings` \u003e `Code Security and Analysis`). \nThe graph of your sbt build will be visible in the [Dependency Graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository) page of the `Insights` tab.\n\nEnable [Dependabot](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security#what-is-dependabot) in your project settings to receive alerts for vulnerabilities that affect your sbt project.\n\n## Support\n\nAny sbt project whose sbt version is equal to or greater than 1.5.\n\n## Usage\n\nCreate a Github Action file under `.github/workflows` containing the following definition.\n\n```yml\n# .github/workflows/dependency-graph.yml\nname: Update Dependency Graph\non:\n  push:\n    branches:\n      - main # default branch of the project\njobs:\n  dependency-graph:\n    name: Update Dependency Graph\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v3\n      - uses: sbt/setup-sbt@v1\n      - uses: scalacenter/sbt-dependency-submission@v2\n```\n\n### Inputs\n\n#### - `working-directory` (optional)\n\nThe  relative path of the working directory of your sbt build.\nDefault value is `.`\n\n#### - `modules-ignore` (optional)\n\nA list of space-separated names of modules to ignore. The action will not resolve nor submit the dependencies of these modules.\nThe name of a module contains the name of the project and its binary version.\n\nExample: `foo_2.13 bar_2.13`\n\n#### - `configs-ignore` (optional)\n\nA list of space-separated names of configurations to ignore. The action will not submit the dependencies of these configurations.\n\nExample of configurations are `compile`, `test`, `scala-tool`, `scala-doc-tool`.\n\n#### - `correlator` (optional)\n\nAn optional identifier to distinguish between multiple dependency snapshots of the same type.\nDefaults to the concatenation of the workflow name, the job id and the action id.\n\nTypically you would specify the correlator in a matrix-based job like this:\n\n```yaml\n  correlator: ${{ github.job }}-${{ matrix.directory }}\n```\n\n#### - `token` (optional)\n\nGitHub Personal Access Token (PAT). Defaults to PAT provided by Action runner.\n\nExample: `${{ secrets.USER_TOKEN }}`\n\n### Outputs\n\n#### `submission-id`\n\nOnce the snapshot of the dependencies has been submitted, GitHub responds with an ID of this snapshot.\n\n#### `submission-api-url`\n\nThe API URL of the submission created by the action. It can be queried to get the submitted snapshot.\n\n#### `snapshot-json-path`\n\nPath to the temporary JSON file with the dependency snapshot that has been submitted.\n\n#### Example\n\n##### Excluding some projects or some Scala versions from the dependency submission.\n\nIn this example the snapshot will not contain the graphs of `foo_2.13` and `bar_3`.\n\n```yaml\n\n## in .github/workflows/dependency-graph.md\n...\nsteps:\n  - uses: actions/checkout@v3\n  - uses: scalacenter/sbt-dependency-submission@v2\n    with:\n      working-directory: ./my-scala-project\n      modules-ignore: foo_2.13 bar_3\n```\n\n#### Excluding the Scaladoc dependencies.\n\nIn this example the snapshot will not contain the dependencies of the scala-doc-tool configuration.\n\n```yaml\n\n## in .github/workflows/dependency-graph.md\n...\nsteps:\n  - uses: actions/checkout@v3\n  - uses: scalacenter/sbt-dependency-submission@v2\n    with:\n      working-directory: ./my-scala-project\n      configs-ignore: scala-doc-tool\n```\n\n## Troubleshooting\n\n### How to generate a snapshot locally?\n\nFor troubleshooting, it can be convenient to generate a snapshot locally.\n\nTo do so you need to install the `sbt-dependency-submission` plugin in your sbt project.\n\n```scala\n// In project/plugins.sbt\naddSbtPlugin(\"ch.epfl.scala\" % \"sbt-github-dependency-submission\" % \"3.1.0\")\n```\n\nAfter reloading your build, you can run:\n```\nsbt:example\u003e githubGenerateSnapshot\n...\n[info] Dependency snapshot written to /tmp/dependency-snapshot-3080240838874963577.json\n```\n\nOr if you want to exclude some modules or configs:\n\n```\nsbt:example\u003e githubGenerateSnapshot {\"ignoredModules\":[\"server_2.13\"], \"ignoredConfigs\":[\"test\"]}\n...\n[info] Dependency snapshot written to /tmp/dependency-snapshot-14803616116503623758.json\n```\n\n### Unexpected Status: 404\n\nThis error happens when the `Dependency Graph` feature is disabled.\nYou can enable it in `Settings` \u003e `Code Security and Analysis`.\n\n![image](https://user-images.githubusercontent.com/13123162/177736071-5bd63d3c-d338-4e51-a3c9-ad8d11e35508.png)\n\n### Unexpected Status: 403\n\nThis error happens when the workflow does not have the right permission on the repository.\n\nFirst you should check that the workflow is not triggered on PR from forked repositories.\nIt should be triggered by push to the default branch.\n\n```yaml\n## in .github/workflows/dependency-graph.md\non:\n  push:\n    branches:\n      - main # default branch of the project\n...\n```\n\nThen check that you enabled the read and write permissions for all workflows, at the bottom of the `Settings \u003e Actions \u003e General` page.\n\n![image](https://user-images.githubusercontent.com/13123162/179472237-bffea114-9e99-4736-83ef-00dc7f41149b.png)\n\nIf you do not want to enable this you can add the write permission on the `dependency-graph` workflow only:\n\n```yaml\n## in .github/workflows/dependency-graph.md\n...\npermissions:\n      contents: write # this permission is needed to submit the dependency graph\n...\n```\n\n### sbt.librarymanagement.ResolveException: Error downloading\n\nThis error may happen when you try to access artifacts from private GitHub packages with the default GitHub token. You need to pass personal access token which is allowed to access private packages in the `token` input.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscalacenter%2Fsbt-dependency-submission","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fscalacenter%2Fsbt-dependency-submission","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscalacenter%2Fsbt-dependency-submission/lists"}