Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Dependency Review API response error handling #1

Closed
wants to merge 4 commits into from

Conversation

felickz
Copy link
Owner

@felickz felickz commented Jan 4, 2023

Bug: Failures in the Dependency Review API response are not properly handled due to an oktokit version mismatch

Fixes:

  • downgrade octokit/request-error to ^2.1.0
    • supported by actions/core ^1.10.0 (see)
  • Add integration test to invoke API (to avoid mocking a response that is dependent on the version of actions/core used) and validate exception response
  • Enhanced Forbidden error message back to user to hint that a culprit might also be lack of GitHub Advanced Security for a private repo

Graph Disabled / Private Repo w/o GHAS

Before:

::error::Forbidden

After:

::error::Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled along with GitHub Advanced Security on private repositories, see https://github.com/OWNER/REPO/settings/security_analysis

- supported by actions/core ^1.10.0
@felickz
Copy link
Owner Author

felickz commented Jan 5, 2023

Integration Test fails with 3.0.2
image

Succeeds with 2.1.0
image

@felickz felickz changed the title Fix Request error handling Fix Dependency Review API response error handling Jan 5, 2023
@felickz
Copy link
Owner Author

felickz commented Jan 5, 2023

Close in favor official PR https://github.com/actions/dependency-review-action/pulls # 370

@felickz felickz closed this Jan 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant