{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Create a new snapshot of a repository's dependencies.\n\nThe authenticated user must have access to the repository.\n\nOAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.","properties":{"path":{"type":"object","properties":{"owner":{"type":"string","description":"The account owner of the repository. The name is not case sensitive."},"repo":{"type":"string","description":"The name of the repository without the `.git` extension. The name is not case sensitive."}},"required":["owner","repo"],"additionalProperties":false},"body":{"$ref":"#/definitions/snapshot"}},"required":["path","body"],"additionalProperties":false,"definitions":{"snapshot":{"title":"snapshot","description":"Create a new snapshot of a repository's dependencies.","type":"object","properties":{"version":{"description":"The version of the repository snapshot submission.","type":"integer"},"job":{"type":"object","properties":{"id":{"type":"string","description":"The external ID of the job.","examples":["5622a2b0-63f6-4732-8c34-a1ab27e102a11"]},"correlator":{"type":"string","description":"Correlator provides a key that is used to group snapshots submitted over time. Only the \"latest\" submitted snapshot for a given combination of `job.correlator` and `detector.name` will be considered when calculating a repository's current dependencies. Correlator should be as unique as it takes to distinguish all detection runs for a given \"wave\" of CI workflow you run. If you're using GitHub Actions, a good default value for this could be the environment variables GITHUB_WORKFLOW and GITHUB_JOB concatenated together. If you're using a build matrix, then you'll also need to add additional key(s) to distinguish between each submission inside a matrix variation.","examples":["yourworkflowname_yourjobname"]},"html_url":{"type":"string","description":"The url for the job.","examples":["http://example.com/build"]}},"required":["id","correlator"],"additionalProperties":false},"sha":{"description":"The commit SHA associated with this dependency snapshot. Maximum length: 64 characters.","type":"string","minLength":40,"maxLength":64,"examples":["ddc951f4b1293222421f2c8df679786153acf689"]},"ref":{"description":"The repository branch that triggered this snapshot.","type":"string","pattern":"^refs/","examples":["refs/heads/main"]},"detector":{"type":"object","description":"A description of the detector used.","properties":{"name":{"type":"string","description":"The name of the detector used.","examples":["docker buildtime detector"]},"version":{"type":"string","description":"The version of the detector used.","examples":["1.0.0"]},"url":{"type":"string","description":"The url of the detector used.","examples":["http://example.com/docker-buildtimer-detector"]}},"required":["name","version","url"],"additionalProperties":false},"metadata":{"$ref":"#/definitions/metadata"},"manifests":{"type":"object","description":"A collection of package manifests, which are a collection of related dependencies declared in a file or representing a logical group of dependencies.","additionalProperties":{"$ref":"#/definitions/manifest"}},"scanned":{"type":"string","format":"date-time","description":"The time at which the snapshot was scanned.","examples":["2020-06-13T14:52:50-05:00"]}},"required":["detector","version","ref","sha","job","scanned"],"additionalProperties":false},"metadata":{"title":"metadata","description":"User-defined metadata to store domain-specific information limited to 8 keys with scalar values.","type":"object","maxProperties":8,"additionalProperties":{"anyOf":[{"type":"string"},{"type":"number"},{"type":"boolean"}]}},"manifest":{"type":"object","properties":{"name":{"type":"string","description":"The name of the manifest.","examples":["package-lock.json"]},"file":{"type":"object","properties":{"source_location":{"type":"string","description":"The path of the manifest file relative to the root of the Git repository.","examples":["/src/build/package-lock.json"]}},"additionalProperties":false},"metadata":{"$ref":"#/definitions/metadata"},"resolved":{"type":"object","description":"A collection of resolved package dependencies.","additionalProperties":{"$ref":"#/definitions/dependency"}}},"required":["name"],"additionalProperties":false},"dependency":{"type":"object","properties":{"package_url":{"type":"string","description":"Package-url (PURL) of dependency. See https://github.com/package-url/purl-spec for more details.","pattern":"^pkg","examples":["pkg:/npm/%40actions/http-client@1.0.11"]},"metadata":{"$ref":"#/definitions/metadata"},"relationship":{"type":"string","description":"A notation of whether a dependency is requested directly by this manifest or is a dependency of another dependency.","enum":["direct","indirect"],"examples":["direct"]},"scope":{"type":"string","description":"A notation of whether the dependency is required for the primary build artifact (runtime) or is only used for development. Future versions of this specification may allow for more granular scopes.","enum":["runtime","development"],"examples":["runtime"]},"dependencies":{"type":"array","description":"Array of package-url (PURLs) of direct child dependencies.","items":{"type":"string"},"examples":["@actions/http-client"]}},"additionalProperties":false}}},"name":"Create a snapshot of dependencies for a repository","id":"github.dependency-graph.create-repository-snapshot","example":{"path":{"owner":"octocat","repo":"hello-world"},"body":{"detector":{"name":"docker buildtime detector","version":"1.0.0","url":"http://example.com/docker-buildtimer-detector"},"version":1,"ref":"refs/heads/main","sha":"ddc951f4b1293222421f2c8df679786153acf689","job":{"id":"5622a2b0-63f6-4732-8c34-a1ab27e102a11","correlator":"yourworkflowname_yourjobname"},"scanned":"2020-06-13T14:52:50-05:00"}},"maxRequests":1,"summary":false}}