|
2 | 2 | layout: blog-detail
|
3 | 3 | post-type: blog
|
4 | 4 | by: Adrien Piquerez, Scala Center
|
5 |
| -title: Secure the Dependencies of your Scala Project on Github |
| 5 | +title: Secure the Dependencies of your Scala Project on GitHub |
6 | 6 | ---
|
7 | 7 |
|
8 | 8 | We released [sbt-dependency-submission][sbt-dependency-submission], a GitHub action that submits the dependencies of sbt builds to the [GitHub Dependency submission API](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api) (currently in beta).
|
9 |
| -This action, once installed in a Github workflow, allows you to view the [Dependency graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph) in Github and to receive regular security reports from [Dependabot](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts). |
| 9 | +This action, once installed in a GitHub workflow, allows you to view the [Dependency graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph) in GitHub and to receive regular security reports from [Dependabot](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts). |
10 | 10 |
|
11 | 11 | A similar action for the Mill build tool, the [mill-dependency-submission][mill-dependency-submission] action, developed by Chris Kipp, is also available.
|
12 | 12 | Other solutions are available for Maven and Gradle as well.
|
@@ -74,7 +74,7 @@ Scala Steward, as a preventive tool, can help you keep your dependencies up-to-d
|
74 | 74 | Dependabot, as a monitoring tool, can notify you when a vulnerability is found, so that you can act quickly.
|
75 | 75 |
|
76 | 76 | Dependabot can also send PRs to update dependencies, but in static configuration files only.
|
77 |
| -It can update the actions in your Github workflows, or the Maven dependencies in your POM files, but not the dependencies in the `build.sbt` or `build.sc` files. |
| 77 | +It can update the actions in your GitHub workflows, or the Maven dependencies in your POM files, but not the dependencies in the `build.sbt` or `build.sc` files. |
78 | 78 |
|
79 | 79 | ## Other supported build tools
|
80 | 80 |
|
@@ -120,7 +120,7 @@ Gradle users can use the [gradle-dependency-submission][gradle-dependency-submis
|
120 | 120 |
|
121 | 121 | ## Summary
|
122 | 122 |
|
123 |
| -In Github, it is now possible to use pre-made actions, like [sbt-dependency-submission][sbt-dependency-submission] or [mill-dependency-submission][mill-dependency-submission], to extract full graphs of dependencies at build time. |
| 123 | +In GitHub, it is now possible to use pre-made actions, like [sbt-dependency-submission][sbt-dependency-submission] or [mill-dependency-submission][mill-dependency-submission], to extract full graphs of dependencies at build time. |
124 | 124 | This allows Dependabot to analyze the dependencies and publish regular reports of vulnerabilities.
|
125 | 125 | Only project administrators, organization owners and users with explicit access can see the Dependabot reports.
|
126 | 126 |
|
|
0 commit comments