{"repo":"rmuir/uv-dependency-submission","free":true,"listed":false,"github":"https://github.com/rmuir/uv-dependency-submission","clone":"git clone https://github.com/rmuir/uv-dependency-submission.git","description":"GitHub Action for submitting uv.lock dependencies","language":"Python","stars":22,"topics":["dependency-graph","dependency-management","github-actions","security","python","uv"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"uv-dependency-submission GitHub Action for submitting uv.lock dependencies This is a GitHub Action that will generate a complete dependency graph from uv.lock files in the repository and submit the graph to the GitHub repository so that the graph is complete and includes all the transitive dependencies. The action will use git ls-files to locate all uv.lock files, validate their schema version, then parse them with python's tomllib to generate JSON output of the complete dependency graph, and submit the manifests using the gh CLI to the GitHub repository. Example workflow Make sure you've enabled Dependency Graph in the Security section of the repository Settings first. [!NOTE] After committing the workflow file, trigger once manually from Actions UI for initial setup. Configuration Currently there are no parameters. The gh cli is used to upload the snapshot, you can pass env: variables to change some behavior: - Background If you have a uv-based project, GitHub will detect dependencies from uv.lock automatically. However, the built-in GitHub functionality is new and currently very minimal: - Dependencies are submitted as a flat list from each uv.lock - No indication of Transitive vs Direct. - No SBOM paths (e.g. to see how particular dependency was brought in) The built-in GitHub functionality is enough for you to receive Dependabot security alerts. By using this action, the full graph metadata will be populated, enabling more of Github's security features. Caveats - Very ne","default_branch":null,"files":null,"tree":[],"storefront":"/r/rmuir","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/rmuir/uv-dependency-submission/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}