skills / secure-repository-supply-chain

Secure your supply chain, understand dependencies in your environment, know about vulnerabilities in those dependencies and patch them

Secure your repository's supply chain

Secure your supply chain, understand dependencies in your environment, know about vulnerabilities in those dependencies and patch them.

Welcome

GitHub helps you secure your supply chain, from understanding the dependencies in your environment, to knowing about vulnerabilities in those dependencies and patching them.

• Who this is for: Developers, DevOps Engineers, Site Reliability Engineers, Security experts
• What you'll learn: How to view repository dependencies, view Dependabot alerts, and enable Dependabot security and version updates
• What you'll build: Repository dependencies, Dependabot alerts, pull requests to fix dependencies and version updates
• Prerequisites: None
• Timing: This course can be completed in under an hour

In this course, you will explore:

1. Dependency graph
2. Dependency alerts
3. Dependency security updates
4. Dependency versions updates

How to start this course

1. Right-click Start course and open the link in a new tab.
2. In the new tab, most of the prompts will automatically fill in for you.
   • For owner, choose your personal account or an organization to host the repository.
   • We recommend creating a public repository, as private repositories will use Actions minutes.
   • Scroll down and click the Create repository button at the bottom of the form.
3. After your new repository is created, wait about 20 seconds, then refresh the page. Follow the step-by-step instructions in the new repository's README.

---

Get help: Post in our discussion board • Review the GitHub status page

© 2024 GitHub • Code of Conduct • MIT License

secure-repository-supply-chain's Issues

[Bug]

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Device information

• Type: [e.g. iPhone6]
• OS: [e.g. iOS]
• Browser [e.g. chrome, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

[Bug]

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Device information

• Type: [e.g. iPhone6]
• OS: [e.g. iOS]
• Browser [e.g. chrome, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

Update discussion links

We now have a designated discussion area for each course! 🎉

This means all of our course links need to be updated to point to the correct discussion page.

There are two places in each course where discussions are referenced

• README.md
• .github > steps > X-finish.md

These two files will have a link to https://github.com/orgs/skills/discussions that will need to be replaced with the link for the course specific discussion. You can find those links here, in the left menu section. Copy the link to the discussion category for this course and replace it in those two files.

Be sure to link your PR to this issue for review.

[Bug] Axios dependency version check fails in step 3 of the workflow.

Summary
This issue has been reoccurring. Due to a new vulnerability for axios, Depeandabot creates a PR "Bump axios from 0.21.1 to 0.28.0 in /code/src/AttendeeSite" indtead of "Bump axios from 0.21.1 to 0.21.2 in /code/src/AttendeeSite". As a result GH Actions cant proceed to the next step.

Instead of hardcoding the value, might the version check validate against a regex or range?

How to reproduce
Just follow the step of the tutorial

[Feature]

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like
A clear and concise description of what you want to happen.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

[Bug] Stucked at step 3 due to axios dependency

Summary

Due to a new vulnerability for axios 0.21.2, Depeandabot creates a PR "Bump axios from 0.21.1 to 1.6.0 in /code/src/AttendeeSite" indtead of "Bump axios from 0.21.1 to 0.21.2 in /code/src/AttendeeSite". As a result GH Actions cant proceed to the next step.

How to reproduce

Just follow the step of the tutorial