A curated list of Dependabot / Dependency Graph (and related software supply chain) resources.
- cli - A tool for testing and debugging Dependabot update jobs.
- fetch-metadata - Extract information about the dependencies being updated by a Dependabot-generated PR.
- spdx-to-dependency-graph-action - A GitHub Action that takes SPDX SBOMs and uploads them to GitHub's dependency submission API to power Dependabot alerts
- jessehouwing/actions-dependency-submission - Action to automatically report versions for pinned action dependencies
- advanced-security/codeql-dependency-graph-action - CodeQL <-> Dependency Graph Actions
- generate-dependencies-csv-action - GitHub Action to generate a csv file listing the dependencies detected in a repository
- gh-dependency-report - GitHub CLI extension for generating a report on repository dependencies.
- sbom-generator - Generates an sbom from a repository's dependency graph
- gh-sbom - Generate SBOMs with gh CLI
- generate-org-repos-sbom-action - An Action to wrap creating an SBOM for the entire organization via REST API
- generate-sbom-action - An Action to wrap creating an SBOM via REST API
- blueoak-to-dependency-review - A GitHub Dependency Review compatible YAML file for the Blue Oak Council license list
- package-policy - A GitHub action to enforce that only approved packages are used within a project by providing an allow or prohibit list of packages.
- dependabot-kev-action - Action to detect if any open Dependabot alerts are in the CISA Known Exploited Vulnerabilities (KEV) Catalog of CVEs and fail the workflow.
- policy-as-code - GitHub Advanced Security Policy as Code Action that supports Alerts and License compliance.
- fetch-metadata - Extract information about the dependencies being updated by a Dependabot-generated PR.
- github/deployment-tracker - K8s deployment tracker for artifact registry
- osv-schema OSSF OSV schema used by the advisory-database
- SecurityAdvisory GitHub GraphQL object to query the advisory DB
Contributions welcome! Read the contribution guidelines first.