GitHub Dependency Graph

[balupton]

Would be cool if Tea was natively supported by the GitHub Dependency Graph — https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph — or provided a command to submit dependencies to the GitHub Dependency API

---

https://discord.com/channels/906608167901876256/1093039291367698493/1093039291367698493

[mxcl]

I don’t know much about this. Do GitHub allow third parties to submit packages or do we need to negotiate with them do you know?

[balupton]

Both/either

When you push a commit to GitHub that changes or adds a supported manifest or lock file to the default branch, the dependency graph is automatically updated. In addition, the graph is updated when anyone pushes a change to the repository of one of your dependencies. For information on the supported ecosystems and manifest files, see "Supported package ecosystems" below.

Additionally, you can use the Dependency submission API (beta) to submit dependencies from the package manager or ecosystem of your choice, even if the ecosystem is not supported by dependency graph for manifest or lock file analysis