REST API endpoints for dependency submission doesn't explain how to enable dependencies

[jsoref]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/rest/dependency-graph/dependency-submission?apiVersion=2022-11-28#create-a-snapshot-of-dependencies-for-a-repository

What part(s) of the article would you like to see updated?

Something should explain how to resolve:

{
  "message": "The Dependency graph is disabled for this repository. Please enable it before submitting snapshots.",
  "documentation_url": "https://docs.github.com/rest/dependency-graph/dependency-submission#create-a-snapshot-of-dependencies-for-a-repository",
  "status": "404"
}

Additional information

There's an action, it triggers this API call, which yielded the above error. The link is to a document that doesn't explain how to do the thing

• https://github.com/check-spelling-sandbox/sbt/actions/runs/13079859672/job/36500733509#step:4:730
• [REST] Get a diff of the dependencies between commits doesn't mention you have to enable it #22555 is related but apparently not the same

Yes, this has to be copied to the internal repository.

[subatoi]

Hi @jsoref, and thanks for raising an issue for this—I'll get this triaged now 👍

[github-actions]

Thanks for opening an issue! We've triaged this issue for technical review by a subject matter expert 👀

[ahpook]

hi @jsoref - PM for dependency graph here 👋 I see that there was a successful run of this action so I think the error you saw was a transient problem.

• Can you confirm that runs since then have succeeded? Were there failures before this one as well, or was it a one-time problem?
• Do other dependency-graph features work for your repo? Export an SBOM and the Dependency insights page both seem to work for me.

The docs url will be updated to point to this doc instead but it's weird that you would see that error in the first place.

Thanks for the report, we'll get to the bottom of this!

[jsoref]

@ahpook: no, it wasn't a transient failure, it failed because I hadn't enabled the required feature (dependencies). Once I enabled them, a rerun worked.

But the problem is that the error path should take me to a page that clearly explains how to enable the feature. It doesn't matter than I've done it a dozen times over the past half dozen years or whatever, I don't do it every day.

For a random repository,
https://github.com/check-spelling-sandbox/parrot/network/dependencies

There's no way for me to disable this feature, so it's a one-way taint. I do have an infinite number of additional repositories I can use to play with it (but you can too, repositories are cheap).

There are half a dozen knobs for github repositories to enable features, and this one is the furthest out of the way of all of them.

Almost all knobs are within settings, e.g. https://github.com/check-spelling-sandbox/parrot/settings

In general, as a user, when I read an error that says I need to do something, I try to follow the instructions, or if it says I need to enable something, I go to settings and look, or maybe I go to the docs. None of those paths work for this product area.

[ahpook]

Ah, gotcha sorry - I thought that dependency graph was enabled, but you still got the error.

There is also an enable button in Settings, under "Code Security" - I take your point though.

[jsoref]

The documentation https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-the-dependency-graph#enabling-and-disabling-the-dependency-graph-for-a-private-repository is misleading, it talks about enabling/disabling the graph for private repositories, but as noted, it applies to public repositories.

[jsoref]

GitHub's settings are sufficiently complicated at this point that they should have search, just like browser settings have search.

[ahpook]

Good point @jsoref - there is an inconsistency in the docs - the correct answer is that Dependency Graph is automatically on for new public repos, but needs to be enabled specifically for both private repos and forks of upstream projects.

This one is correct:

https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph#dependency-graph-availability

But the 'configuring the dependency graph' doc is wrong. We'll get that cleaned up.

[subatoi]

Many thanks for reporting this, @jsoref! We'll fix this internally, and add you as a co-committer.

[docs-bot]

Thank you for opening this issue! Updates to this documentation must be made internally. I have copied your issue to an internal issue, so I will close this issue.

[subatoi]

Just following up that the commit has now been synced with this repo fbb550a

Many thanks again for your help

[jsoref]

Thanks @subatoi ...

docs/content/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-the-dependency-graph.md

Line 36 in fbb550a

To generate a dependency graph, {% data variables.product.github %} needs read-only access to the dependency manifest and lock files for a repository. The dependency graph is automatically generated for all public repositories and you can choose to enable it for private {% ifversion ghec %}and internal {% endif %}repositories, and public forks. For more information on viewing the dependency graph, see [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository).

... The dependency graph is automatically generated for all public repositories ...

Shouldn't that say something about forks? (I know it later says you can enable it for forks, but that doesn't make sense if this part doesn't include a qualifier.)

I don't know how to fix the wording, it's something like "public source repositories" but, I don't think that terminology makes sense to normal readers. (This note applies to a number of paragraphs in that commit.)

[jsoref]

Also, please note that this ticket was originally filed about the REST help which still needs help.

HTTP response status codes for "Create a snapshot of dependencies for a repository" lists a single status code:

Status code	Description
201	Created

It doesn't mention 404 nor does it link to the content that you've updated.

[subatoi]

I'm not sure we really have the right terminology to account for that: I know what you mean by "source repository" but that's not something we'd use, and the term "upstream" would only make sense if it had actually been forked.

It's a limitation of technical content in general, but since this an edge case, the idea was to make sure that somebody reading could distinguish between a "repository" and a "fork" in the context. I accept your point that it's not perfect, but the risk is that we'd end up with such contrived language that we'd lose readability overall.

On the second point, yes, I didn't make this clear but there's a separate issue to track fixing the error message—that's being tracked internally with its own issue as it's not something we can accept open-source contributions on.

[jsoref]

https://github.com/orgs/github/repositories?q=mirror%3Afalse+fork%3Afalse+archived%3Afalse has a Sources thing on the left which maps to the thing:

https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories doesn't talk about Sources just fork:true or fork:only. I'm not even sure how to search the docs to see if other things are used or if Source(s) are used in other places...

It's a problem, and I'd love for someone to fix it. I don't have the resources to, and I understand it's hard since it's terminology.

On the second point, yes, I didn't make this clear but there's a separate issue to track fixing the error message—that's being tracked internally with its own issue as it's not something we can accept open-source contributions on.

Thanks, I appreciate that. I'm so used to the docbot making an annotation that it had copied a thing over to work on the REST side.

[subatoi]

It's a problem, and I'd love for someone to fix it. I don't have the resources to, and I understand it's hard since it's terminology.

I accept your point—let me create an issue to see if there's something we can do about it. Since it'll almost certainly affect more content than just what we've referenced here, it'll need to be done internally, so I can't commit to a timeframe. But to be clear, I do accept your point 👍

[ahpook]

FWIW we're tracking that docs link in the 404 error separately as a Dependency Graph engineering fix