[{"data":1,"prerenderedAt":1220},["ShallowReactive",2],{"navigation_docs":3,"-guides-scan-from-github-actions":114,"-guides-scan-from-github-actions-surround":1215},[4,23,85,99],{"title":5,"path":6,"stem":7,"children":8},"Getting Started","\u002Fgetting-started","1.getting-started",[9,13,18],{"title":10,"path":6,"stem":11,"icon":12},"Getting started","1.getting-started\u002Findex","i-lucide-rocket",{"title":14,"path":15,"stem":16,"icon":17},"Try the demo","\u002Fgetting-started\u002Ftry-the-demo","1.getting-started\u002F1.try-the-demo","i-lucide-monitor-play",{"title":19,"path":20,"stem":21,"icon":22},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F2.quickstart","i-lucide-play",{"title":24,"path":25,"stem":26,"children":27},"Guides","\u002Fguides","2.guides",[28,31,37,42,47,53,58,63,68,74,80],{"title":24,"path":25,"stem":29,"icon":30},"2.guides\u002Findex","i-lucide-map",{"title":32,"path":33,"stem":34,"icon":35,"group":36},"Connect a GitHub repository","\u002Fguides\u002Fconnect-a-github-repository","2.guides\u002F01.connect-a-github-repository","i-lucide-git-branch","Connect a project",{"title":38,"path":39,"stem":40,"icon":41,"group":36},"Analyze a project without GitHub","\u002Fguides\u002Fanalyze-a-project-without-github","2.guides\u002F02.analyze-a-project-without-github","i-lucide-upload",{"title":43,"path":44,"stem":45,"icon":46,"group":36},"Exclude dependency scopes","\u002Fguides\u002Fexclude-dependency-scopes","2.guides\u002F04.exclude-dependency-scopes","i-lucide-filter",{"title":48,"path":49,"stem":50,"icon":51,"group":52},"Scan from GitHub Actions","\u002Fguides\u002Fscan-from-github-actions","2.guides\u002F05.scan-from-github-actions","i-lucide-workflow","Automate",{"title":54,"path":55,"stem":56,"icon":57,"group":52},"Scan from another CI","\u002Fguides\u002Fscan-from-another-ci","2.guides\u002F06.scan-from-another-ci","i-lucide-square-terminal",{"title":59,"path":60,"stem":61,"icon":62,"group":52},"Manage API keys","\u002Fguides\u002Fmanage-api-keys","2.guides\u002F07.manage-api-keys","i-lucide-key-round",{"title":64,"path":65,"stem":66,"icon":67,"group":52},"Create many projects at once","\u002Fguides\u002Fcreate-many-projects-at-once","2.guides\u002F08.create-many-projects-at-once","i-lucide-layers",{"title":69,"path":70,"stem":71,"icon":72,"group":73},"Export reports and SBOMs","\u002Fguides\u002Fexport-reports-and-sboms","2.guides\u002F11.export-reports-and-sboms","i-lucide-download","Act on the results",{"title":75,"path":76,"stem":77,"icon":78,"group":79},"Organizations and plans","\u002Fguides\u002Forganizations-and-plans","2.guides\u002F13.organizations-and-plans","i-lucide-building-2","Organization and team",{"title":81,"path":82,"stem":83,"icon":84,"group":79},"Invite your team","\u002Fguides\u002Finvite-your-team","2.guides\u002F14.invite-your-team","i-lucide-users",{"title":86,"path":87,"stem":88,"children":89},"Core Concepts","\u002Fcore-concepts","3.core-concepts",[90,94],{"title":91,"path":87,"stem":92,"icon":93},"Core concepts","3.core-concepts\u002Findex","i-lucide-lightbulb",{"title":95,"path":96,"stem":97,"icon":98},"The health score","\u002Fcore-concepts\u002Fhealth-score","3.core-concepts\u002F1.health-score","i-lucide-gauge",{"title":100,"path":101,"stem":102,"children":103},"Reference","\u002Freference","5.reference",[104,107],{"title":100,"path":101,"stem":105,"icon":106},"5.reference\u002Findex","i-lucide-book-marked",{"title":108,"path":109,"stem":110,"children":111,"icon":113},"Supported ecosystems","\u002Freference\u002Fecosystems","5.reference\u002F1.ecosystems\u002Findex",[112],{"title":108,"path":109,"stem":110,"icon":113},"i-lucide-package",{"id":115,"title":48,"body":116,"description":1208,"extension":1209,"links":1210,"meta":1211,"navigation":1212,"path":49,"seo":1213,"stem":50,"__hash__":1214},"docs\u002F2.guides\u002F05.scan-from-github-actions.md",{"type":117,"value":118,"toc":1200},"minimark",[119,123,131,150,153,167,172,179,318,328,331,334,392,405,413,417,427,481,495,516,524,528,538,626,629,785,788,791,815,823,827,834,944,955,1069,1075,1082,1122,1132,1136,1150,1157,1174,1177,1180,1184,1196],[120,121,122],"p",{},"The Deptools action starts a scan from a GitHub Actions workflow. In its\nshortest form it scans on every push and never blocks anything. Add four more lines and it waits for the analysis and fails the build when the result crosses a threshold you set.",[120,124,125,126,130],{},"It is published on the GitHub Marketplace as ",[127,128,129],"code",{},"deptools-io\u002Fscan-action@v1",".",[132,133,134,135,138,139,142,143,145,146,130],"note",{},"If your pipeline is not GitHub Actions,\n",[136,137,54],"a",{"href":55}," does the same with ",[127,140,141],{},"curl",",\nquality gates included. If your project has no GitHub repository behind it, your\npipeline sends the build files instead, see\n",[136,144,38],{"href":39},".\nThis action cannot feed such a project, since it sends no files. Triggering a\nscan is allowed on every plan. Pushing build files requires ",[147,148,149],"strong",{},"Pro",[120,151,152],{},"The action uploads nothing from the runner. It calls the Deptools API, and\nDeptools reads the build file on GitHub through the GitHub App, on the branch\nconfigured on the project. Two consequences:",[154,155,156,164],"ul",{},[157,158,159,160,163],"li",{},"The workflow needs no ",[127,161,162],{},"actions\u002Fcheckout",", and the job lasts a few seconds when\nit does not wait for the result.",[157,165,166],{},"The branch or ref that triggers the workflow does not affect the scan. On a pull request, the\naction still scans the branch configured on the project. Run it on a push to\nthat branch, or on a schedule.",[168,169,171],"h2",{"id":170},"add-the-action-to-a-workflow","Add the action to a workflow",[120,173,174,175,178],{},"Commit this to ",[127,176,177],{},".github\u002Fworkflows\u002Fdeptools.yml",":",[180,181,186],"pre",{"className":182,"code":183,"language":184,"meta":185,"style":185},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","name: Deptools scan\non:\n  push:\n    branches: [main]\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: deptools-io\u002Fscan-action@v1\n        with:\n          project-id: ${{ vars.DEPTOOLS_PROJECT_ID }}\n          api-key: ${{ secrets.DEPTOOLS_API_KEY }}\n","yaml","",[127,187,188,204,214,222,239,247,255,266,274,288,296,307],{"__ignoreMap":185},[189,190,193,197,200],"span",{"class":191,"line":192},"line",1,[189,194,196],{"class":195},"swJcz","name",[189,198,178],{"class":199},"sMK4o",[189,201,203],{"class":202},"sfazB"," Deptools scan\n",[189,205,207,211],{"class":191,"line":206},2,[189,208,210],{"class":209},"sfNiH","on",[189,212,213],{"class":199},":\n",[189,215,217,220],{"class":191,"line":216},3,[189,218,219],{"class":195},"  push",[189,221,213],{"class":199},[189,223,225,228,230,233,236],{"class":191,"line":224},4,[189,226,227],{"class":195},"    branches",[189,229,178],{"class":199},[189,231,232],{"class":199}," [",[189,234,235],{"class":202},"main",[189,237,238],{"class":199},"]\n",[189,240,242,245],{"class":191,"line":241},5,[189,243,244],{"class":195},"jobs",[189,246,213],{"class":199},[189,248,250,253],{"class":191,"line":249},6,[189,251,252],{"class":195},"  scan",[189,254,213],{"class":199},[189,256,258,261,263],{"class":191,"line":257},7,[189,259,260],{"class":195},"    runs-on",[189,262,178],{"class":199},[189,264,265],{"class":202}," ubuntu-latest\n",[189,267,269,272],{"class":191,"line":268},8,[189,270,271],{"class":195},"    steps",[189,273,213],{"class":199},[189,275,277,280,283,285],{"class":191,"line":276},9,[189,278,279],{"class":199},"      -",[189,281,282],{"class":195}," uses",[189,284,178],{"class":199},[189,286,287],{"class":202}," deptools-io\u002Fscan-action@v1\n",[189,289,291,294],{"class":191,"line":290},10,[189,292,293],{"class":195},"        with",[189,295,213],{"class":199},[189,297,299,302,304],{"class":191,"line":298},11,[189,300,301],{"class":195},"          project-id",[189,303,178],{"class":199},[189,305,306],{"class":202}," ${{ vars.DEPTOOLS_PROJECT_ID }}\n",[189,308,310,313,315],{"class":191,"line":309},12,[189,311,312],{"class":195},"          api-key",[189,314,178],{"class":199},[189,316,317],{"class":202}," ${{ secrets.DEPTOOLS_API_KEY }}\n",[120,319,320,321,323,324,327],{},"Replace ",[127,322,235],{}," with the branch the project analyzes. The two values come from\nthe ",[147,325,326],{},"Integrations"," tab of the project, and the next section declares them.",[120,329,330],{},"This setup is fire-and-forget. The job ends as soon as Deptools accepts the scan,\nand the analysis appears in the dashboard a few minutes later. Nothing here can\nfail your build.",[120,332,333],{},"To use the result as a gate, make the job wait:",[180,335,337],{"className":182,"code":336,"language":184,"meta":185,"style":185},"      - uses: deptools-io\u002Fscan-action@v1\n        with:\n          project-id: ${{ vars.DEPTOOLS_PROJECT_ID }}\n          api-key: ${{ secrets.DEPTOOLS_API_KEY }}\n          wait-for-result: true\n          timeout: 1800\n",[127,338,339,349,355,363,371,381],{"__ignoreMap":185},[189,340,341,343,345,347],{"class":191,"line":192},[189,342,279],{"class":199},[189,344,282],{"class":195},[189,346,178],{"class":199},[189,348,287],{"class":202},[189,350,351,353],{"class":191,"line":206},[189,352,293],{"class":195},[189,354,213],{"class":199},[189,356,357,359,361],{"class":191,"line":216},[189,358,301],{"class":195},[189,360,178],{"class":199},[189,362,306],{"class":202},[189,364,365,367,369],{"class":191,"line":224},[189,366,312],{"class":195},[189,368,178],{"class":199},[189,370,317],{"class":202},[189,372,373,376,378],{"class":191,"line":241},[189,374,375],{"class":195},"          wait-for-result",[189,377,178],{"class":199},[189,379,380],{"class":209}," true\n",[189,382,383,386,388],{"class":191,"line":249},[189,384,385],{"class":195},"          timeout",[189,387,178],{"class":199},[189,389,391],{"class":390},"sbssI"," 1800\n",[120,393,394,397,398,401,402,130],{},[127,395,396],{},"wait-for-result"," polls the analysis every 20 seconds until it completes or\nfails. ",[127,399,400],{},"timeout"," sets how long the job waits, in seconds. The default is ",[127,403,404],{},"300",[406,407,408,409,412],"warning",{},"Past the timeout the job fails with ",[147,410,411],{},"Scan did not complete within 300s\ntimeout",", even when nothing is wrong with your dependencies. The analysis is\nnot canceled: it keeps running on the Deptools side and its result reaches the\ndashboard. An analysis takes about ten minutes, a large one takes longer, and\nDeptools stops an analysis after 60 minutes. So set the timeout to the wait you actually\naccept, and remember that a waiting job burns runner minutes.",[168,414,416],{"id":415},"store-the-project-id-and-the-api-key","Store the project id and the API key",[120,418,419,420,422,423,426],{},"Open the project, then the ",[147,421,326],{}," tab. Its ",[147,424,425],{},"GitHub Action"," card\nshows both values, each with a copy button.",[428,429,430,446],"table",{},[431,432,433],"thead",{},[434,435,436,440,443],"tr",{},[437,438,439],"th",{},"Declare it as",[437,441,442],{},"Name",[437,444,445],{},"Value",[447,448,449,466],"tbody",{},[434,450,451,458,463],{},[452,453,454,455],"td",{},"Repository ",[147,456,457],{},"variable",[452,459,460],{},[127,461,462],{},"DEPTOOLS_PROJECT_ID",[452,464,465],{},"The project UUID, shown at step 2 of the card",[434,467,468,473,478],{},[452,469,454,470],{},[147,471,472],{},"secret",[452,474,475],{},[127,476,477],{},"DEPTOOLS_API_KEY",[452,479,480],{},"An API key, created at the bottom of the same tab",[120,482,483,484,487,488,487,491,494],{},"Both live on GitHub, under ",[147,485,486],{},"Settings",", ",[147,489,490],{},"Secrets and variables",[147,492,493],{},"Actions",".\nThe project id only names a project, so a variable is enough. The key\nauthenticates, so it belongs in a secret and never in the YAML. The action masks\nit in the logs.",[120,496,497,498,501,502,505,506,501,509,512,513,515],{},"Use a ",[147,499,500],{},"project key"," (",[127,503,504],{},"dt_proj_...",") for a single repository. Use an\n",[147,507,508],{},"organization key",[127,510,511],{},"dt_org_...",") when multiple repositories run the same\nworkflow, and store it once as an organization secret on GitHub.\n",[136,514,59],{"href":60}," covers what each scope reaches, who\ncan create a key and how to rotate one.",[517,518],"u-color-mode-image",{"alt":519,"className":520,"dark":522,"light":523},"GitHub Action card of the Integrations tab, with the secret, the project id and the workflow snippet",[521],"wide-capture","\u002Fimages\u002Fdocs\u002Fguides\u002Fscan-from-github-actions-1-integrations-card-dark.webp","\u002Fimages\u002Fdocs\u002Fguides\u002Fscan-from-github-actions-1-integrations-card-light.webp",[168,525,527],{"id":526},"fail-the-build-on-quality-gates","Fail the build on quality gates",[120,529,530,531,533,534,537],{},"Gates are evaluated only when ",[127,532,396],{}," is ",[127,535,536],{},"true",". Without it, the four\ninputs below are ignored and the job always passes.",[428,539,540,553],{},[431,541,542],{},[434,543,544,547,550],{},[437,545,546],{},"Input",[437,548,549],{},"Fails the job when",[437,551,552],{},"Accepted values",[447,554,555,579,596,613],{},[434,556,557,562,565],{},[452,558,559],{},[127,560,561],{},"fail-on-cvss",[452,563,564],{},"the analysis found at least one vulnerability at or above this severity",[452,566,567,487,570,487,573,487,576],{},[127,568,569],{},"CRITICAL",[127,571,572],{},"HIGH",[127,574,575],{},"MODERATE",[127,577,578],{},"LOW",[434,580,581,586,593],{},[452,582,583],{},[127,584,585],{},"min-score",[452,587,588,589,592],{},"the ",[136,590,591],{"href":96},"health score"," is below the value",[452,594,595],{},"0 to 10",[434,597,598,603,606],{},[452,599,600],{},[127,601,602],{},"fail-on-strong-copyleft",[452,604,605],{},"at least one package carries a strong copyleft license, GPL for example",[452,607,608,487,610],{},[127,609,536],{},[127,611,612],{},"false",[434,614,615,620,623],{},[452,616,617],{},[127,618,619],{},"min-up-to-date",[452,621,622],{},"fewer than this percentage of direct dependencies sit on their latest version",[452,624,625],{},"0 to 100",[120,627,628],{},"A complete workflow with all four:",[180,630,632],{"className":182,"code":631,"language":184,"meta":185,"style":185},"name: Deptools scan\non:\n  push:\n    branches: [main]\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: deptools-io\u002Fscan-action@v1\n        with:\n          project-id: ${{ vars.DEPTOOLS_PROJECT_ID }}\n          api-key: ${{ secrets.DEPTOOLS_API_KEY }}\n          wait-for-result: true\n          timeout: 1800\n          fail-on-cvss: HIGH\n          min-score: 7\n          fail-on-strong-copyleft: true\n          min-up-to-date: 80\n",[127,633,634,642,648,654,666,672,678,686,692,702,708,716,724,733,742,753,764,774],{"__ignoreMap":185},[189,635,636,638,640],{"class":191,"line":192},[189,637,196],{"class":195},[189,639,178],{"class":199},[189,641,203],{"class":202},[189,643,644,646],{"class":191,"line":206},[189,645,210],{"class":209},[189,647,213],{"class":199},[189,649,650,652],{"class":191,"line":216},[189,651,219],{"class":195},[189,653,213],{"class":199},[189,655,656,658,660,662,664],{"class":191,"line":224},[189,657,227],{"class":195},[189,659,178],{"class":199},[189,661,232],{"class":199},[189,663,235],{"class":202},[189,665,238],{"class":199},[189,667,668,670],{"class":191,"line":241},[189,669,244],{"class":195},[189,671,213],{"class":199},[189,673,674,676],{"class":191,"line":249},[189,675,252],{"class":195},[189,677,213],{"class":199},[189,679,680,682,684],{"class":191,"line":257},[189,681,260],{"class":195},[189,683,178],{"class":199},[189,685,265],{"class":202},[189,687,688,690],{"class":191,"line":268},[189,689,271],{"class":195},[189,691,213],{"class":199},[189,693,694,696,698,700],{"class":191,"line":276},[189,695,279],{"class":199},[189,697,282],{"class":195},[189,699,178],{"class":199},[189,701,287],{"class":202},[189,703,704,706],{"class":191,"line":290},[189,705,293],{"class":195},[189,707,213],{"class":199},[189,709,710,712,714],{"class":191,"line":298},[189,711,301],{"class":195},[189,713,178],{"class":199},[189,715,306],{"class":202},[189,717,718,720,722],{"class":191,"line":309},[189,719,312],{"class":195},[189,721,178],{"class":199},[189,723,317],{"class":202},[189,725,727,729,731],{"class":191,"line":726},13,[189,728,375],{"class":195},[189,730,178],{"class":199},[189,732,380],{"class":209},[189,734,736,738,740],{"class":191,"line":735},14,[189,737,385],{"class":195},[189,739,178],{"class":199},[189,741,391],{"class":390},[189,743,745,748,750],{"class":191,"line":744},15,[189,746,747],{"class":195},"          fail-on-cvss",[189,749,178],{"class":199},[189,751,752],{"class":202}," HIGH\n",[189,754,756,759,761],{"class":191,"line":755},16,[189,757,758],{"class":195},"          min-score",[189,760,178],{"class":199},[189,762,763],{"class":390}," 7\n",[189,765,767,770,772],{"class":191,"line":766},17,[189,768,769],{"class":195},"          fail-on-strong-copyleft",[189,771,178],{"class":199},[189,773,380],{"class":209},[189,775,777,780,782],{"class":191,"line":776},18,[189,778,779],{"class":195},"          min-up-to-date",[189,781,178],{"class":199},[189,783,784],{"class":390}," 80\n",[120,786,787],{},"They are evaluated in the order of the table, and the first one that fails stops\nthe job. A failed build therefore names one gate at a time: fix it, and the next\nrun may stop on the one below.",[120,789,790],{},"Two of them skip instead of failing, and both print a warning in the log:",[154,792,793,807],{},[157,794,795,796,802,803,806],{},"An ",[147,797,798,799,801],{},"unknown ",[127,800,561],{}," value"," disables that gate and the job passes.\nCase does not matter, ",[127,804,805],{},"high"," works, but a typo protects nothing. Read the log\nof the first run.",[157,808,809,814],{},[147,810,811,813],{},[127,812,619],{}," on a project with no direct dependency"," has nothing to\nmeasure, so it is skipped.",[816,817,818,819,822],"tip",{},"Start with one gate the project passes today, ",[127,820,821],{},"fail-on-cvss: CRITICAL"," for\nexample, then tighten. A workflow that fails on its first run gets disabled by\nthe team instead of being investigated.",[168,824,826],{"id":825},"read-the-action-output","Read the action output",[120,828,829,830,833],{},"Give the step an ",[127,831,832],{},"id",", and later steps can read its outputs.",[428,835,836,848],{},[431,837,838],{},[434,839,840,843,845],{},[437,841,842],{},"Output",[437,844,445],{},[437,846,847],{},"Set when",[447,849,850,875,888,900,916,931],{},[434,851,852,857,872],{},[452,853,854],{},[127,855,856],{},"status",[452,858,859,487,862,487,865,868,869],{},[127,860,861],{},"running",[127,863,864],{},"completed",[127,866,867],{},"failed"," or ",[127,870,871],{},"skipped",[452,873,874],{},"the API answered",[434,876,877,882,885],{},[452,878,879],{},[127,880,881],{},"job-id",[452,883,884],{},"the analysis UUID",[452,886,887],{},"the scan was accepted",[434,889,890,895,898],{},[452,891,892],{},[127,893,894],{},"poll-url",[452,896,897],{},"the status URL of that analysis",[452,899,887],{},[434,901,902,907,910],{},[452,903,904],{},[127,905,906],{},"overall-score",[452,908,909],{},"the health score, 0 to 10",[452,911,912,915],{},[127,913,914],{},"wait-for-result: true"," and the analysis completed",[434,917,918,923,928],{},[452,919,920],{},[127,921,922],{},"commercial-use",[452,924,925,927],{},[127,926,536],{}," when at least one strong copyleft license was found",[452,929,930],{},"same",[434,932,933,938,941],{},[452,934,935],{},[127,936,937],{},"direct-up-to-date",[452,939,940],{},"percentage of direct dependencies on their latest version",[452,942,943],{},"same, and the project has direct dependencies",[406,945,946,948,949,951,952,954],{},[127,947,922],{}," reads backwards. ",[127,950,536],{}," does not mean commercial use is\nallowed. It means the analysis found a strong copyleft license, which is the\ncase you want to look at. Write your condition accordingly.\n",[136,953,95],{"href":96}," explains what strong copyleft\nimplies.",[180,956,958],{"className":182,"code":957,"language":184,"meta":185,"style":185},"      - uses: deptools-io\u002Fscan-action@v1\n        id: deptools\n        with:\n          project-id: ${{ vars.DEPTOOLS_PROJECT_ID }}\n          api-key: ${{ secrets.DEPTOOLS_API_KEY }}\n          wait-for-result: true\n          timeout: 1800\n          fail-on-cvss: HIGH\n      - name: Publish the score\n        if: always()\n        run: |\n          echo \"Status: ${{ steps.deptools.outputs.status }}\" >> \"$GITHUB_STEP_SUMMARY\"\n          echo \"Score: ${{ steps.deptools.outputs.overall-score }}\u002F10\" >> \"$GITHUB_STEP_SUMMARY\"\n",[127,959,960,970,980,986,994,1002,1010,1018,1026,1038,1048,1059,1064],{"__ignoreMap":185},[189,961,962,964,966,968],{"class":191,"line":192},[189,963,279],{"class":199},[189,965,282],{"class":195},[189,967,178],{"class":199},[189,969,287],{"class":202},[189,971,972,975,977],{"class":191,"line":206},[189,973,974],{"class":195},"        id",[189,976,178],{"class":199},[189,978,979],{"class":202}," deptools\n",[189,981,982,984],{"class":191,"line":216},[189,983,293],{"class":195},[189,985,213],{"class":199},[189,987,988,990,992],{"class":191,"line":224},[189,989,301],{"class":195},[189,991,178],{"class":199},[189,993,306],{"class":202},[189,995,996,998,1000],{"class":191,"line":241},[189,997,312],{"class":195},[189,999,178],{"class":199},[189,1001,317],{"class":202},[189,1003,1004,1006,1008],{"class":191,"line":249},[189,1005,375],{"class":195},[189,1007,178],{"class":199},[189,1009,380],{"class":209},[189,1011,1012,1014,1016],{"class":191,"line":257},[189,1013,385],{"class":195},[189,1015,178],{"class":199},[189,1017,391],{"class":390},[189,1019,1020,1022,1024],{"class":191,"line":268},[189,1021,747],{"class":195},[189,1023,178],{"class":199},[189,1025,752],{"class":202},[189,1027,1028,1030,1033,1035],{"class":191,"line":276},[189,1029,279],{"class":199},[189,1031,1032],{"class":195}," name",[189,1034,178],{"class":199},[189,1036,1037],{"class":202}," Publish the score\n",[189,1039,1040,1043,1045],{"class":191,"line":290},[189,1041,1042],{"class":195},"        if",[189,1044,178],{"class":199},[189,1046,1047],{"class":202}," always()\n",[189,1049,1050,1053,1055],{"class":191,"line":298},[189,1051,1052],{"class":195},"        run",[189,1054,178],{"class":199},[189,1056,1058],{"class":1057},"s7zQu"," |\n",[189,1060,1061],{"class":191,"line":309},[189,1062,1063],{"class":202},"          echo \"Status: ${{ steps.deptools.outputs.status }}\" >> \"$GITHUB_STEP_SUMMARY\"\n",[189,1065,1066],{"class":191,"line":726},[189,1067,1068],{"class":202},"          echo \"Score: ${{ steps.deptools.outputs.overall-score }}\u002F10\" >> \"$GITHUB_STEP_SUMMARY\"\n",[120,1070,1071,1074],{},[127,1072,1073],{},"if: always()"," matters here. A failed gate fails the step, and without it every\nstep behind is skipped, including the one that reports why.",[120,1076,1077,1078,1081],{},"If the scan cannot be started, the job fails with ",[147,1079,1080],{},"Failed to trigger scan\n(HTTP …)"," and no output is set:",[428,1083,1084,1094],{},[431,1085,1086],{},[434,1087,1088,1091],{},[437,1089,1090],{},"HTTP",[437,1092,1093],{},"Cause and fix",[447,1095,1096,1104,1112],{},[434,1097,1098,1101],{},[452,1099,1100],{},"401",[452,1102,1103],{},"The key is missing, malformed or expired. Create a new one and update the secret",[434,1105,1106,1109],{},[452,1107,1108],{},"404",[452,1110,1111],{},"Unknown project id, or a project outside the key's scope. A project key reaches its own project only, and the the API deliberately returns the same response in both cases",[434,1113,1114,1117],{},[452,1115,1116],{},"400",[452,1118,1119,1120],{},"The project is a CI upload project, which expects your build files rather than a bare trigger. See ",[136,1121,38],{"href":39},[120,1123,1124,1125,1127,1128,1131],{},"A scan can also be accepted and then fail. With ",[127,1126,914],{}," the job\nfails with ",[147,1129,1130],{},"Deptools scan failed"," followed by the reason, for example when the\nGitHub App no longer has access to the repository.",[168,1133,1135],{"id":1134},"what-happens-during-a-cooldown","What happens during a cooldown",[120,1137,1138,1139,1142,1143,1145,1146,1149],{},"On the ",[147,1140,1141],{},"Free"," plan, Deptools accepts one scan every three hours per project\nconfiguration. ",[147,1144,149],{}," and ",[147,1147,1148],{},"Open Source Max"," have no cooldown, so a workflow\ncan run on every push.",[120,1151,1152,1153,1156],{},"Every scan counts against it, whoever or whatever started it.\n",[136,1154,75],{"href":1155},"\u002Fguides\u002Forganizations-and-plans#the-scan-cooldown","\ndefines what a configuration is.",[120,1158,1159,1160,1163,1164,1167,1168,1170,1171,1173],{},"During the cooldown the API refuses the scan and the action does ",[147,1161,1162],{},"not"," fail\nthe job. It prints ",[127,1165,1166],{},"Scan cooldown active — retry after \u003Cdate>. Skipping scan.",",\nsets ",[127,1169,856],{}," to ",[127,1172,871],{}," and exits. The build stays green, no gate is\nevaluated, and the dashboard keeps the previous analysis.",[120,1175,1176],{},"The action treats the hourly limit of the scan endpoint the same way. Runners\nhosted by GitHub rarely reach it.",[406,1178,1179],{},"On Free, a workflow that runs on every push therefore skips most of its runs,\nand a skipped scan does not protect your merges. If merges must be gated on the\nresult, the Pro plan removes the cooldown.",[168,1181,1183],{"id":1182},"next-steps","Next steps",[154,1185,1186,1191],{},[157,1187,1188,1190],{},[136,1189,59],{"href":60}," to set an expiration and rotate a\nkey without breaking a workflow.",[157,1192,1193,1195],{},[136,1194,54],{"href":55}," when a second pipeline,\noutside GitHub Actions, has to scan too.",[1197,1198,1199],"style",{},"html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}",{"title":185,"searchDepth":206,"depth":206,"links":1201},[1202,1203,1204,1205,1206,1207],{"id":170,"depth":206,"text":171},{"id":415,"depth":206,"text":416},{"id":526,"depth":206,"text":527},{"id":825,"depth":206,"text":826},{"id":1134,"depth":206,"text":1135},{"id":1182,"depth":206,"text":1183},"Add the Deptools action to a workflow and fail the build when quality gates are not met.","md",null,{},{"icon":51,"group":52},{"title":48,"description":1208},"-iqn0rqcqPvuSagi310GI5vOjgdqU78-v7qV2two4S4",[1216,1218],{"title":43,"path":44,"stem":45,"description":1217,"icon":46,"group":36,"children":-1},"Control your dependency graph scope. Choose which dependency scopes are included in your analysis and score.",{"title":54,"path":55,"stem":56,"description":1219,"icon":57,"group":52,"children":-1},"Trigger and poll a scan with curl from GitLab CI, Jenkins or any other pipeline.",1787263157023]