Welcome to "Secure your repository's supply chain"! 👋
What's the big deal about securing your repository's supply chain?: With the accelerated use of open source, most projects depend on hundreds of open-source dependencies. This poses a security problem: what if the dependencies you're using are vulnerable? You could be putting your users at risk of a supply chain attack. One of the most important things you can do to protect your supply chain is to patch your vulnerable dependencies and replace any malware.
GitHub offers a range of features to help you understand the dependencies in your environment, know about vulnerabilities in those dependencies, and patch them. The supply chain features on GitHub are:
- Dependency graph
- Dependency review
- Dependabot alerts
- Dependabot updates
- Dependabot security updates
- Dependabot version updates
What is a dependency graph: The dependency graph is a summary of the manifest and lock files stored in a repository and any dependencies that are submitted for the repository using the dependency submission API (beta). For each repository, it shows:
- Dependencies, the ecosystems and packages it depends on
- Dependents, the repositories and packages that depend on it
We recommend opening another browser tab to work through the following activities so you can keep these instructions open for reference.
- Navigate to the
Settings
tab. - Click
Code security and analysis
. - Verify/enable Dependency graph. (If the repo is private, you will enable it here. If the repo is public, it will be enabled by default)
- Navigate to the
Code
tab and locate thecode/src/AttendeeSite
folder. - Add the following content to the
package-lock.json
file after the third to last}
, "follow-redirects": { "version": "1.14.1", "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.1.tgz", "integrity": "sha512-HWqDgT7ZEkqRzBvc2s64vSZ/hfOceEol3ac/7tKwzuvEyWx3/4UegXh5oBOIotkGsObyk3xznnSRVADBgWSQVg==" }
- Navigate to the
Insights
tab. - Click
Dependency graph
. - Review all new dependencies on the
Dependencies
hub. - Search for
follow-redirects
and review the new dependency you just added.
Wait about 20 seconds then refresh this page for the next step
Nice work! 🎉 You added and viewed a dependency with dependency graph
!
Given how many dependencies our repository is using, maintaining them needs to become an automated task. Keeping our code secure is a top priority, so one thing we need to do is set up a way to be notified when a dependency we are using is vulnerable or malware. We can do this by enabling Dependabot alerts!
What are Dependabot alerts?: Dependabot alerts tell you that your code depends on a package that is insecure. These Dependabot alerts reference the GitHub Advisory Database, which contains a list of known security vulnerabilities and malware, grouped in two categories: GitHub reviewed advisories and unreviewed advisories.
If your code depends on a package that has a security vulnerability, this can cause a range of problems for your project or the people who use it. You should upgrade to a secure version of the package as soon as possible. If your code uses malware, you need to replace the package with a secure alternative.
Let's try this out with our newly added follow-redirects
dependency!
- Navigate to the GitHub Advisory Database.
- Type or paste
follow-redirects
into the search box. - Click on any of the advisories that were found.
- Note the packages, impact, patches, workaround, and references for the advisory.
Notice the list of advisories for our dependency! This can look scary but it's actually a good thing. It means that our dependency is actively being maintained and patches are being pushed to remove the vulnerability. If we had Dependabot alerts enabled, we could receive alerts when we need to update a dependency and act promptly to secure them.
Let's enable Dependabot alerts on our repository!
- Navigate to the
Settings
tab. - Click
Code security and analysis
. - Click
Enable
Dependabot alerts (Wait about 60 seconds and then click theSecurity
tab at the top of the repository). - Review each of the four
Dependabot
alerts under theVulnerability alerts
section.
Dependabot has alerted us of four vulnerabilities that need to be updated from the dependencies that we are using. Dependabot helps us address these vulnerabilities by creating pull requests for each one as we select and review the alert.
Let's see how this would work by using Dependabot to create a pull request for one of the alerts!
- Select the
Prototype Pollution in minimist
alert under theDependabot alerts
section and click on the alert. - Click the
Create Dependabot security update
button (This will create a pull request for the fix and could take ~2 minutes). - Click the
Review security update
button. The pull request will be displayed.- You can view the pull request and
Files changed
tab to review the update.
- You can view the pull request and
- Navigate back to the
Conversation
tab and click theMerge pull request
button. - Click
Confirm merge
.
Wait about 20 seconds then refresh this page for the next step.
Nice work enabling, viewing, and creating Dependabot alerts ✨
Enabling Dependabot alerts on our repository was a great step toward improving our code security, but we still had to manually select an alert and then manually select the option to create the pull request. It would be nice to further improve the automation and maintenance of our dependencies! Well, with Dependabot security updates, we can do just that.
What are Dependabot security updates?: When enabled, Dependabot will detect and fix vulnerable dependencies for you by opening pull requests automatically to resolve Dependabot alerts when they arise.
We manually created the pull request for the Prototype Pollution in minimist
alert, but let's now enable Dependabot security updates to automate this process with the next alert!
- Navigate to the
Settings
tab, selectCode security and analysis
, and enable theDependabot security updates
. - Navigate to the
Pull requests
repository tab and select the newly created pull request titled Bump axios from 0.21.1 to 0.21.2 in /code/src/AttendeeSite.- You may need to wait 30-60 seconds.
- Click the
Merge pull request
button. - Click
Confirm merge
.
Wait about 20 seconds then refresh this page for the next step.
Nicely done! 🥳
You now have automated the process for Dependabot to alert and create pull requests to update your dependencies! At this point, you only need to review the pull request and then merge it to stay on top of your security alerts.
The security updates feature helps automate the process to resolve alerts, but what about just keeping up-to-date with version updates? We can have the same automation to update our dependencies for updated versions using the Dependabot version updates feature.
What are Dependabot version updates?: In addition to security alerts, Dependabot can also take the effort out of maintaining your dependencies. You can use it to ensure that your repository automatically keeps up with the latest releases of the packages and applications it depends on. Just like security alerts, Dependabot will identify an outdated dependency and create a pull request to update the manifest to the latest version of the dependency.
Let's see how this works!
- Navigate to the
Settings
tab, selectCode security and analysis
, and enable theDependabot version updates
.- A new file editor opens with pre-poplulated contents. The file is called
dependabot.yml
.
- A new file editor opens with pre-poplulated contents. The file is called
- Add
nuget
to thepackage-ecosystem
. - Change the
directory
to/code/
. (Thedependabot.yml
file should look like this) - Click
Commit changes
directly to the main branch.
Wait about 20 seconds then refresh this page for the next step.
Congratulations friend, you've completed this course!
Here's a recap of all the tasks you've accomplished in your repository:
- You've learned how to view and use dependency graph.
- You've learned how to enable and use Dependabot alerts.
- You've learned how to enable and use Dependabot secuirty updates.
- You've learned how to enable and use Dependabot version updates.
- Dependency graph
- Exploring the dependencies of a repository
- About supply chain security
- Dependabot alerts
- GitHub Advisory Database
- Learn more about securing your supply chain by reading: Securing your supply chain.
- We'd love to hear what you thought of this course.
- Learn another GitHub skill.
- Read the Get started with GitHub docs.
- To find projects to contribute to, check out GitHub Explore.
Get help: TBD-support • Review the GitHub status page
© 2022 TBD-copyright-holder • Code of Conduct • CC-BY-4.0 License