Configuring automatic dependency submission for your repository

You can use automatic dependency submission to submit transitive dependency data in your repository. This enables you to analyze these transitive dependencies using the dependency graph.

Who can use this feature?

Repository owners, organization owners, security managers, and users with the admin role

In this article

Prerequisites

Dependency graph must be enabled for the repository for you to enable automatic dependency submission.

You must also enable GitHub Actions for the repository in order to use automatic dependency submission. For more information, see Managing GitHub Actions settings for a repository.

Note

For ecosystems that support Dependabot graph jobs, you do not need to enable automatic dependency submission. Dependabot graph jobs run automatically when the dependency graph is enabled for your repository, and they take precedence over automatic dependency submission. See How the dependency graph recognizes dependencies.

Enabling automatic dependency submission

Repository administrators can enable or disable automatic dependency submission for a repository by following the steps outlined in this procedure.

Organization owners can enable automatic dependency submission for multiple repositories using a security configuration. For more information, see Creating a custom security configuration.

  1. On GitHub, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security" section of the sidebar, click Advanced Security.

  4. Under "Dependency graph", click the dropdown menu next to “Automatic dependency submission”, then select Enabled.

Once you've enabled automatic dependency submission for a repository, GitHub will:

  • Watch for pushes to the repository.
  • Run the dependency graph build action associated with the package ecosystem for any manifests in the repository.
  • Perform an automatic dependency submission with the results.

You can view details about the automatic workflows run by viewing the Actions tab of your repository.

Note

After you enable automatic dependency submission, we'll automatically trigger a run of the action. Once enabled, it'll run each time a commit to the default branch updates a manifest.

Accessing private registries

Using Dependabot secrets

For ecosystems that support Dependabot graph jobs, you can configure access to private registries using Dependabot secrets at the organization or repository level.

When Dependabot graph jobs encounter private packages that are not accessible through configured secrets, those packages are gracefully omitted from the dependency graph without causing a failure.

For more information on configuring private registry access, see Configuring access to private registries for Dependabot.

Using self-hosted runners

You can configure self-hosted runners to run automatic dependency submission jobs, instead of using the GitHub Actions infrastructure. This is necessary to access private registries for ecosystems that do not support Dependabot graph jobs, or when your registries are only reachable from within your network. The self-hosted runners must be running on Linux or macOS. For .NET and Python auto-submission, they must have access to the public internet in order to download the latest component-detection release.

  1. Provision one or more self-hosted runners, at the repository or organization level. For more information, see Self-hosted runners and Adding self-hosted runners.
  2. Assign a dependency-submission label to each runner you want automatic dependency submission to use. For more information, see Using labels with self-hosted runners.
  3. In the "Security" section of the sidebar, click Advanced Security.
  4. Under "Dependency graph", click the dropdown menu next to "Automatic dependency submission", then select Enabled for labeled runners.

Once enabled, automatic dependency submission jobs will run on the self-hosted runners, unless:

  • The self-hosted runners are unavailable.
  • There aren't any runner groups tagged with a dependency-submission label.

Note

For Maven or Gradle projects that use self-hosted runners with private Maven registries, you need to modify the Maven server settings file to allow the dependency submission workflows to connect to the registries. For more information about the Maven server settings file, see Security and Deployment Settings in the Maven documentation.

For network allowlist URLs, larger runner configuration, troubleshooting details, and package ecosystem-specific information, see Automatic dependency submission.

Further reading