Extend your dependency information in the GitHub Dependency Graph with new GitHub Actions

More ways to enrich the GitHub Dependency Graph

GitHub's dependency graph was historically built exclusively from static scans of manifest files checked into repositories. That approach could leave coverage gaps in certain ecosystems. The dependency submission API, released earlier this month, changes that by letting you upload dependency information directly—for example, from a build tool or container scanner. Combining build-time detection with static scanning gives a more complete dependency graph and, in turn, more comprehensive vulnerability alerts.

To make that workflow practical, GitHub has announced new Actions from partners that plug into the dependency submission API. A typical setup is to add one of these Actions to your repository so the scan results are submitted automatically against the current commit.

What the new Actions cover

Anchore

Anchore's sbom-action scans source repositories and container images to generate software bills of materials (SBOMs), which can then be uploaded to the dependency graph. The SBOMs capture nested dependencies and component metadata such as file system and package information, which supports highly accurate vulnerability matching. The Action can be paired with Anchore's scan-action for container workflows. Supported ecosystems are listed in the Syft documentation.

NowSecure

NowSecure performs automated static and dynamic security analysis for iOS and Android apps built in Swift, Objective-C, Java, Kotlin, Dart, React-Native, and other frameworks. Its new GitHub Action for Mobile SBOMs uses black-box dynamic SBOM generation to identify third-party components and transitive dependencies. Those results can populate the dependency graph, enabling Dependabot alerts for vulnerable mobile libraries. The Action works alongside the NowSecure scan action, which handles automated static and dynamic security testing. NowSecure is a paid service, but a free mobile SBOM dependency scan can be requested from the NowSecure site.

sbt

The sbt action lets Scala projects submit dependencies to the dependency graph. That gives sbt-based builds, which previously had no visibility through the graph, access to dependency tracking and Dependabot alerts. Scala ranks as the 25th most popular language on GitHub, and this Action extends dependency graph support to that community.

Aqua Trivy

Aqua Trivy is a free, open source, cloud-native security scanner that detects vulnerabilities in code repositories and container images, and also flags misconfigurations in Infrastructure as Code (IaC) and Kubernetes. The Trivy action can now be used to upload detailed SBOM data into the GitHub Dependency Graph, drawing on Trivy's support for a range of programming languages and operating systems.

Reviewing the results

Once an Action is configured, scan results are submitted to the dependency graph and available for review in the repository.

Getting started

Developers who want to use the dependency submission API can follow the official documentation. For those who need a custom detector, the Dependency Submission Toolkit provides a way to write your own submission logic.