actions/dependency-review-action
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a8dcc6b77458afad2fe007dff69fb0cf04d2544f
dependency-review-action/CONTRIBUTING.md
Federico Builes 0b8c1ff0d6 Update CONTRIBUTING.md
2022-05-12 10:25:45 +02:00

2.9 KiB
Raw Blame History

Contributing

Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.

Contributions to this project are released to the public under the project's open source license.

Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms.

How it works

This Action makes an authenticated query to the Dependency Graph Diff API endpoint (GET /repos/{owner}/{repo}/dependency-graph/compare/{basehead}) to find out the set of added and removed dependencies for each manifest.

Bootstrapping the project

git clone https://github.com/actions/dependency-review-action.git
cd dependency-review-action
npm install

Running the tests

npm run test

Note: We don't have any useful tests yet, contributions are welcome!

Local Development

We have a script to scan a given PR for vulnerabilities, this will help you test your local changes. Make sure to grab a Personal Access Token (PAT) before proceeding (you'll need repo permissions for private repos):

Screenshot 2022-05-12 at 10 22 21

The syntax of the script is:

$ GITHUB_TOKEN=<token> ./scripts/scan_pr <pr_url>

Like this:

$ GITHUB_TOKEN=my-secret-token ./scripts/scan_pr https://github.com/actions/dependency-review-action/pull/3

Submitting a pull request

  1. Fork and clone the repository
  2. Configure and install the dependencies: npm install
  3. Make sure the tests pass on your machine: npm run test
  4. Create a new branch: git checkout -b my-branch-name
  5. Make your change, add tests, and make sure the tests still pass
  6. Make sure to build and package before pushing: npm run build && npm run package
  7. Push to your fork and submit a pull request
  8. Pat your self on the back and wait for your pull request to be reviewed and merged.

Here are a few things you can do that will increase the likelihood of your pull request being accepted:

  • Write tests.
  • Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
  • Write a good commit message.

Resources