Fix github dependency submission API call

[chejn]

Curl in line 189 incorrectly provides credentials to the github dependency submission API.

[CLAassistant]

All committers have signed the CLA.

[simar7]

Curl in line 189 incorrectly provides credentials to the github dependency submission API.

hi @chejn - I recently tried to use the old way and it still worked. Have you tested the new way out? Just curious.

[michaelmworthington]

Hi @simar7 , I was having trouble getting this to work and was going to attempt the same change.

I was able to get this PR to post the dependency snapshot. I have tried a number of things and cannot get the official 0.7.0 to work. I am curious what you are using for github_pat_token and if you have explicitly set permissions in your action yml that differs from the example in the readme.

I'm happy to compare notes further, but for my configuration, I would +1 this change.

[chejn]

Curl in line 189 incorrectly provides credentials to the github dependency submission API.

hi @chejn - I recently tried to use the old way and it still worked. Have you tested the new way out? Just curious.

Hi Simar, yes i have tested this method using my fork and it works. Also i was never able to get it to work using the old changes.

[simar7]

Hi @simar7 , I was having trouble getting this to work and was going to attempt the same change.

I was able to get this PR to post the dependency snapshot. I have tried a number of things and cannot get the official 0.7.0 to work. I am curious what you are using for github_pat_token and if you have explicitly set permissions in your action yml that differs from the example in the readme.

I'm happy to compare notes further, but for my configuration, I would +1 this change.

Thanks for chiming in @michaelmworthington – I took another look at it again. Here's what I got:

Current way:

GITHUB_REPOSITORY="org/repo"; curl -u "simar7:<token>" -H 'Content-Type: application/json' 'https://api.github.com/repos/'$GITHUB_REPOSITORY'/dependency-graph/snapshots' -d @./sbom.file
{
  "id": 363574,
  "created_at": "2022-08-17T21:47:11.457Z",
  "result": "SUCCESS",
  "message": "Dependency results for the repo have been successfully updated."
}

Proposed way:

curl -X POST -H "Accept: application/vnd.github+json" -H "Authorization: token <token>" "https://api.github.com/repos/org/repo/dependency-graph/snapshots" -d @./sbom.file
{
  "id": 363575,
  "created_at": "2022-08-17T21:49:50.196Z",
  "result": "SUCCESS",
  "message": "Dependency results for the repo have been successfully updated."
}

It seems that both work fine. My token only has repo scope set as mentioned in the docs. But I'm happy to update it to follow the API spec.

[simar7]

thanks!

[michaelmworthington]

thanks for the info @simar7

i think i see my issue. i was using just my PAT for github-pat, i did not have my username in there.

i'm still coming up to speed on GH Actions, but in most situations I've come to prefer the automatically generated GITHUB_TOKEN over a PAT.

With this change, I think that means that the value for github-pat in the action yaml would need to change. if that's true, this is probably a breaking change for folks that have not pinned a version.