From 3d7156567497d12f5c01c3217c1acd74b96ca966 Mon Sep 17 00:00:00 2001 From: Courtney Wilson <77312589+cmwilson21@users.noreply.github.com> Date: Thu, 10 Mar 2022 21:24:33 +0000 Subject: [PATCH 1/3] added first note about dependencies viewed in public repository to paragraph --- .../exploring-the-dependencies-of-a-repository.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md b/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md index 999f6b3955ab..8a884871155b 100644 --- a/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md +++ b/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md @@ -40,7 +40,7 @@ Enterprise owners can configure the dependency graph at an enterprise level. For ### Dependencies view {% ifversion fpt or ghec %} -Dependencies are grouped by ecosystem. You can expand a dependency to view its dependencies. For dependencies on public repositories hosted on {% data variables.product.product_name %}, you can also click a dependency to view the repository. Dependencies on private repositories, private packages, or unrecognized files are shown in plain text. +Dependencies are grouped by ecosystem. You can expand a dependency to view its dependencies. If the package manager for the dependency is in a public repository, a link to that repository will be displayed. However, dependencies on private repositories, private packages, or unrecognized files are shown in plain text. If vulnerabilities have been detected in the repository, these are shown at the top of the view for users with access to {% data variables.product.prodname_dependabot_alerts %}. From 40606b81b89290dfeb89b3fafde292293113a01c Mon Sep 17 00:00:00 2001 From: Courtney Wilson <77312589+cmwilson21@users.noreply.github.com> Date: Fri, 11 Mar 2022 14:42:56 +0000 Subject: [PATCH 2/3] changed the wording around the used by package paragraph --- .../exploring-the-dependencies-of-a-repository.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md b/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md index 8a884871155b..ec316480c524 100644 --- a/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md +++ b/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md @@ -84,7 +84,10 @@ You can disable the dependency graph at any time by clicking **Disable** next to ## Changing the "Used by" package -If the dependency graph is enabled, and your repository contains a package that's published on a supported package ecosystem, {% data variables.product.prodname_dotcom %} displays a "Used by" section in the sidebar of the **Code** tab of your repository. For more information about the supported package ecosystems, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)." +You may notice some repositories have a "Used by" section in the sidebar of their **Code** tab. In order for your repository to display this "Used by" section, three conditions must be met: + * The dependency graph is enabled for the repository (see the above section for more details). + * Your repository contains a package that is published on a [supported package ecosystem](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems). + * In said ecosystem, your package has a link to a *public* repository where the source is stored. The "Used by" section shows the number of public references to the package that were found, and displays the avatars of some of the owners of the dependent projects. From c327b7c8bc092df4e7eb3ded78a80a455c15767a Mon Sep 17 00:00:00 2001 From: Courtney Wilson <77312589+cmwilson21@users.noreply.github.com> Date: Thu, 17 Mar 2022 09:20:38 -0500 Subject: [PATCH 3/3] Apply suggestions from code review Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> --- .../exploring-the-dependencies-of-a-repository.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md b/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md index ec316480c524..a2cb9069bf79 100644 --- a/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md +++ b/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md @@ -40,7 +40,7 @@ Enterprise owners can configure the dependency graph at an enterprise level. For ### Dependencies view {% ifversion fpt or ghec %} -Dependencies are grouped by ecosystem. You can expand a dependency to view its dependencies. If the package manager for the dependency is in a public repository, a link to that repository will be displayed. However, dependencies on private repositories, private packages, or unrecognized files are shown in plain text. +Dependencies are grouped by ecosystem. You can expand a dependency to view its dependencies. Dependencies on private repositories, private packages, or unrecognized files are shown in plain text. If the package manager for the dependency is in a public repository, {% data variables.product.product_name %} will display a link to that repository. If vulnerabilities have been detected in the repository, these are shown at the top of the view for users with access to {% data variables.product.prodname_dependabot_alerts %}. @@ -84,10 +84,10 @@ You can disable the dependency graph at any time by clicking **Disable** next to ## Changing the "Used by" package -You may notice some repositories have a "Used by" section in the sidebar of their **Code** tab. In order for your repository to display this "Used by" section, three conditions must be met: +You may notice some repositories have a "Used by" section in the sidebar of the **Code** tab. Your repository will have a "Used by" section if: * The dependency graph is enabled for the repository (see the above section for more details). * Your repository contains a package that is published on a [supported package ecosystem](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems). - * In said ecosystem, your package has a link to a *public* repository where the source is stored. + * Within the ecosystem, your package has a link to a _public_ repository where the source is stored. The "Used by" section shows the number of public references to the package that were found, and displays the avatars of some of the owners of the dependent projects.