github / github/dependency-submission-toolkit

Add a field for dependency resolution errors

Aperta
#78 1 commento 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
TypeScript
Stelle
62
Fork
18
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

First of all, I'm sorry if this is not the right place to file this as it's more about the JSON schema for the submissions API, but I could not find a more fitting project to file this for.

Coming from [here](https://github.com/gradle/github-dependency-graph-gradle-plugin/issues/140) my ask is to add a field to the [JSON body of the submission API](https://docs.github.com/en/rest/dependency-graph/dependency-submission?apiVersion=2022-11-28#create-a-snapshot-of-dependencies-for-a-repository) that can be used to document any failures during dependency resolution.

Because currently, there seems to be no way to indicate to the API that the dependency resolution process that created the JSON might have been unable to resolve some dependencies (maybe due to temporary network issues), and thus the list of submitted dependencies might be incomplete. This is a problem if the user relies on the dependencies and resulting SBOM to be complete. On the other hand, not submitting the dependency graph at all if just a single dependency failed to resolve (maybe also due to misconfiguration on the project side) is probably not a good solution either.

So IMO the best solution is to simply be transparent and allow the dependency resolver to say so if there were any issues in dependency resolution. The GitHub web UI could then show these errors as part of the dependency graph so that he user knows to take the results "with a grain of salt".

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Start with the JSON body and dependency-submission API documentation linked in the issue, then read the related Gradle plugin issue. Determine how dependency-resolution failures should be represented and surfaced so incomplete submissions are distinguishable; the work is done when the schema and expected behavior are agreed and documented.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
typescript
Ambito
api, backend-api-design
Tipo di issue
Funzionalità
Difficoltà
5/5
Tempo stimato
Più di una settimana
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
30/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.