Skip to content

ci: resubmit the NuGet dependency graph daily #1331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mforce merged 2 commits into from
Oct 19, 2026
Merged

ci: resubmit the NuGet dependency graph daily #1331

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0a70f8f
ci: resubmit the NuGet dependency graph daily
mforce Oct 19, 2026
d56e5d2
docs(decisions): note the daily dependency submission in #146
mforce Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/workflows/dependency-submission.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,15 @@ name: NuGet dependency submission
#
# Runs on push to main so the graph tracks the default branch, which is what
# dependency-review diffs a PR against.
#
# Also runs daily (#1291): Dependabot matched a new advisory against the
# submitted graph only when the next snapshot arrived. MessagePack's
# GHSA-qhrr-8q5h-9q3h was published 2026-10-15 18:35 UTC and alerted
# 2026-10-16 17:24 UTC, when a dependency push to main resubmitted.

on:
schedule:
- cron: "30 5 * * *"
push:
branches:
- main
Expand Down
6 changes: 4 additions & 2 deletions docs/decisions/146-ci-security-gates.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,10 @@ entirely. The tree-scoped `dotnet list package --vulnerable
covers those at PR time. All of this leaves
dependency-review blind to a transitively-introduced vulnerable package.
`.github/workflows/dependency-submission.yml` closes that: on a push to `main`
touching the dependency set, Microsoft's component-detection reads the restore
output and submits the resolved graph via the Dependency Submission API. npm needs
touching the dependency set, and daily, Microsoft's component-detection reads the restore
output and submits the resolved graph via the Dependency Submission API. The
daily run exists because Dependabot matched a new advisory against the submitted
graph only when the next snapshot arrived (#1291). npm needs
none of this — the graph reads `web/package-lock.json` and already has the full tree.

### Dependabot NuGet PRs: automatic lock-file healing
Expand Down