You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit f4e736b
Browse filesBrowse the repository at this point in the historyBrowse files
Copy file name to clipboardExpand all lines: content/actions/creating-actions/creating-a-javascript-action.md
+14-13Lines changed: 14 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -35,13 +35,13 @@ Once you complete this project, you should understand how to build your own Java
35
35
36
36
### Prerequisites
37
37
38
-
Before you begin, you'll need to download Node.js and create a GitHub repository.
38
+
Before you begin, you'll need to download Node.js and create a public {% data variables.product.prodname_dotcom %} repository.
39
39
40
40
1. Download and install Node.js 12.x, which includes npm.
41
41
42
42
https://nodejs.org/en/download/current/
43
43
44
-
1. Create a new repository on {% data variables.product.product_location %}. You can choose any repository name or use "hello-world-javascript-action" like this example. You can add these files after your project has been pushed to {% data variables.product.product_name %}. For more information, see "[Create a new repository](/articles/creating-a-new-repository)."
44
+
1. Create a new public repository on {% data variables.product.product_location %} and call it "hello-world-javascript-action". For more information, see "[Create a new repository](/articles/creating-a-new-repository)."
45
45
46
46
1. Clone your repository to your computer. For more information, see "[Cloning a repository](/articles/cloning-a-repository)."
47
47
@@ -51,18 +51,16 @@ Before you begin, you'll need to download Node.js and create a GitHub repository
51
51
cd hello-world-javascript-action
52
52
```
53
53
54
-
1. From your terminal, initialize the directory with a `package.json` file.
54
+
1. From your terminal, initialize the directory with npm to generate a `package.json` file.
55
55
56
56
```shell
57
57
npm init -y
58
58
```
59
59
60
60
### Creating an action metadata file
61
61
62
-
Create a new file `action.yml` in the `hello-world-javascript-action` directory with the following example code. For more information, see "[Metadata syntax for {% data variables.product.prodname_actions %}](/actions/creating-actions/metadata-syntax-for-github-actions)."
62
+
Create a new file named `action.yml` in the `hello-world-javascript-action` directory with the following example code. For more information, see "[Metadata syntax for {% data variables.product.prodname_actions %}](/actions/creating-actions/metadata-syntax-for-github-actions)."
63
63
64
-
65
-
**action.yml**
66
64
```yaml
67
65
name: 'Hello World'
68
66
description: 'Greet someone and record the time'
@@ -108,7 +106,7 @@ GitHub Actions provide context information about the webhook event, Git refs, wo
108
106
109
107
Add a new file called `index.js`, with the following code.
110
108
111
-
**index.js**
109
+
{% raw %}
112
110
```javascript
113
111
const core = require('@actions/core');
114
112
const github = require('@actions/github');
@@ -126,6 +124,7 @@ try {
126
124
core.setFailed(error.message);
127
125
}
128
126
```
127
+
{% endraw %}
129
128
130
129
If an error is thrown in the above `index.js` example, `core.setFailed(error.message);` uses the actions toolkit [`@actions/core`](https://github.com/actions/toolkit/tree/main/packages/core) package to log a message and set a failing exit code. For more information, see "[Setting exit codes for actions](/actions/creating-actions/setting-exit-codes-for-actions)."
131
130
@@ -143,7 +142,6 @@ In your `hello-world-javascript-action` directory, create a `README.md` file tha
143
142
- Environment variables the action uses.
144
143
- An example of how to use your action in a workflow.
145
144
146
-
**README.md**
147
145
```markdown
148
146
# Hello world javascript action
149
147
@@ -180,7 +178,7 @@ It's best practice to also add a version tag for releases of your action. For mo
@@ -205,7 +203,7 @@ Checking in your `node_modules` directory can cause problems. As an alternative,
205
203
```shell
206
204
git add action.yml dist/index.js node_modules/*
207
205
git commit -m "Use vercel/ncc"
208
-
git tag -a -m "My first action release" v1
206
+
git tag -a -m "My first action release" v1.1
209
207
git push --follow-tags
210
208
```
211
209
@@ -217,10 +215,11 @@ Now you're ready to test your action out in a workflow. When an action is in a p
217
215
218
216
#### Example using a public action
219
217
220
-
The following workflow code uses the completed hello world action in the `actions/hello-world-javascript-action` repository. Copy the workflow code into a `.github/workflows/main.yml` file, but replace the `actions/hello-world-javascript-action` repository with the repository you created. You can also replace the `who-to-greet` input with your name.
218
+
This example demonstrates how your new public action can be run from within an external repository.
219
+
220
+
Copy the following YAML into a new file at `.github/workflows/main.yml`, and update the `uses: octocat/hello-world-javascript-action@v1.1` line with your username and the name of the public repository you created above. You can also replace the `who-to-greet` input with your name.
221
221
222
222
{% raw %}
223
-
**.github/workflows/main.yml**
224
223
```yaml
225
224
on: [push]
226
225
@@ -231,7 +230,7 @@ jobs:
231
230
steps:
232
231
- name: Hello world action step
233
232
id: hello
234
-
uses: actions/hello-world-javascript-action@v1.1
233
+
uses: octocat/hello-world-javascript-action@v1.1
235
234
with:
236
235
who-to-greet: 'Mona the Octocat'
237
236
# Use the output from the `hello` step
@@ -240,6 +239,8 @@ jobs:
240
239
```
241
240
{% endraw %}
242
241
242
+
When this workflow is triggered, the runner will download the `hello-world-javascript-action` action from your public repository and then execute it.
243
+
243
244
#### Example using a private action
244
245
245
246
Copy the workflow code into a `.github/workflows/main.yml` file in your action's repository. You can also replace the `who-to-greet` input with your name.
Copy file name to clipboardExpand all lines: content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning.md
+12Lines changed: 12 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -81,6 +81,18 @@ For more information about the `pull_request` event, see "[Workflow syntax for {
81
81
82
82
If you scan pull requests, then the results appear as alerts in a pull request check. For more information, see "[Triaging code scanning alerts in pull requests](/code-security/secure-coding/triaging-code-scanning-alerts-in-pull-requests)."
83
83
84
+
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
85
+
#### Defining the alert severities causing pull request check failure
86
+
87
+
By default, only alerts with the severity level of `error` will cause a pull request check failure, and a check will still succeed with alerts of lower severities. You can change the levels of alert severities that will cause a pull request check failure in your repository settings.
88
+
89
+
{% data reusables.repositories.navigate-to-repo %}
90
+
{% data reusables.repositories.sidebar-settings %}
91
+
{% data reusables.repositories.navigate-to-security-and-analysis %}
92
+
1. Under "Code scanning", to the right of "Check Failure", use the drop-down menu to select the level of severity you would like to cause a pull request check failure.
You might want to avoid a code scan being triggered on specific pull requests targeted against the default branch, irrespective of which files have been changed. You can configure this by specifying `on:pull_request:paths-ignore` or `on:pull_request:paths` in the {% data variables.product.prodname_code_scanning %} workflow. For example, if the only changes in a pull request are to files with the file extensions `.md` or `.txt` you can use the following `paths-ignore` array.
Copy file name to clipboardExpand all lines: content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/triaging-code-scanning-alerts-in-pull-requests.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,7 +27,11 @@ topics:
27
27
28
28
In repositories where {% data variables.product.prodname_code_scanning %} is configured as a pull request check, {% data variables.product.prodname_code_scanning %} checks the code in the pull request. By default, this is limited to pull requests that target the default branch, but you can change this configuration within {% data variables.product.prodname_actions %} or in a third-party CI/CD system. If merging the changes would introduce new {% data variables.product.prodname_code_scanning %} alerts to the target branch, these are reported as check results in the pull request. The alerts are also shown as annotations in the **Files changed** tab of the pull request. If you have write permission for the repository, you can see any existing {% data variables.product.prodname_code_scanning %} alerts on the **Security** tab. For information about repository alerts, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)."
29
29
30
-
If {% data variables.product.prodname_code_scanning %} has any results with a severity of `error`, the check fails and the error is reported in the check results. If all the results found by {% data variables.product.prodname_code_scanning %} have lower severities, the alerts are treated as warnings or notices and the check succeeds. If your pull request targets a protected branch that uses {% data variables.product.prodname_code_scanning %}, and the repository owner has configured required status checks, then you must either fix or dismiss all error alerts before the pull request can be merged. For more information, see "[About protected branches](/github/administering-a-repository/about-protected-branches#require-status-checks-before-merging)."
30
+
If {% data variables.product.prodname_code_scanning %} has any results with a severity of `error`, the check fails and the error is reported in the check results. If all the results found by {% data variables.product.prodname_code_scanning %} have lower severities, the alerts are treated as warnings or notices and the check succeeds.
31
+
32
+
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}You can override the default behavior in your repository settings, by specifying the level of severities that will cause a pull request check failure. For more information, see "[Defining the alert severities causing pull request check failure](/code-security/secure-coding/configuring-code-scanning#defining-the-alert-severities-causing-pull-request-check-failure)".
33
+
34
+
{% endif %}If your pull request targets a protected branch that uses {% data variables.product.prodname_code_scanning %}, and the repository owner has configured required status checks, then you must either fix or dismiss all error alerts before the pull request can be merged. For more information, see "[About protected branches](/github/administering-a-repository/about-protected-branches#require-status-checks-before-merging)."
31
35
32
36

Copy file name to clipboardExpand all lines: content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -298,7 +298,7 @@ Dependencies ignored by using the `@dependabot ignore` command are stored centra
298
298
299
299
You can check whether a repository has stored `ignore` preferences by searching the repository for `"@dependabot ignore" in:comments`. If you wish to un-ignore a dependency ignored this way, re-open the pull request.
300
300
301
-
For more information about the `@dependabot ignore` commands, see "[Managing pull requests for dependency updates](/github/administering-a-repository/managing-pull-requests-for-dependency-updates)."
301
+
For more information about the `@dependabot ignore` commands, see "[Managing pull requests for dependency updates](/github/administering-a-repository/managing-pull-requests-for-dependency-updates#managing-dependabot-pull-requests-with-comment-commands)."
302
302
303
303
##### Specifying dependencies and versions to ignore
Copy file name to clipboardExpand all lines: content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates.md
+16-1Lines changed: 16 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,6 +37,21 @@ By default, {% data variables.product.prodname_dependabot %} automatically rebas
37
37
38
38
### Managing {% data variables.product.prodname_dependabot %} pull requests with comment commands
39
39
40
-
{% data variables.product.prodname_dependabot %} responds to simple commands in comments. Each pull request contains details of the commands you can use to process the pull request, for example: to merge, squash, reopen, close, or rebase the pull request. The aim is to make it as easy as possible for you to triage these automatically generated pull requests.
40
+
{% data variables.product.prodname_dependabot %} responds to simple commands in comments. Each pull request contains details of the commands you can use to process the pull request (for example: to merge, squash, reopen, close, or rebase the pull request) under the "{% data variables.product.prodname_dependabot %} commands and options" section. The aim is to make it as easy as possible for you to triage these automatically generated pull requests.
41
+
42
+
You can use any of the following commands on a {% data variables.product.prodname_dependabot %} pull request.
43
+
44
+
-`@dependabot cancel merge` cancels a previously requested merge.
45
+
-`@dependabot close` closes the pull request and prevents {% data variables.product.prodname_dependabot %} from recreating that pull request. You can achieve the same result by closing the pull request manually.
46
+
-`@dependabot ignore this dependency` closes the pull request and prevents {% data variables.product.prodname_dependabot %} from creating any more pull requests for this dependency (unless you reopen the pull request or upgrade to the suggested version of the dependency yourself).
47
+
-`@dependabot ignore this major version` closes the pull request and prevents {% data variables.product.prodname_dependabot %} from creating any more pull requests for this major version (unless you reopen the pull request or upgrade to this major version yourself).
48
+
-`@dependabot ignore this minor version` closes the pull request and prevents {% data variables.product.prodname_dependabot %} from creating any more pull requests for this minor version (unless you reopen the pull request or upgrade to this minor version yourself).
49
+
-`@dependabot merge` merges the pull request once your CI tests have passed.
50
+
-`@dependabot rebase` rebases the pull request.
51
+
-`@dependabot recreate` recreates the pull request, overwriting any edits that have been made to the pull request.
52
+
-`@dependabot reopen` reopens the pull request if the pull request is closed.
53
+
-`@dependabot squash and merge` squashes and merges the pull request once your CI tests have passed.
54
+
55
+
{% data variables.product.prodname_dependabot %} will react with a "thumbs up" emoji to acknowledge the command, and may respond with a comment on the pull request. While {% data variables.product.prodname_dependabot %} usually responds quickly, some commands may take several minutes to complete if {% data variables.product.prodname_dependabot %} is busy processing other updates or commands.
41
56
42
57
If you run any of the commands for ignoring dependencies or versions, {% data variables.product.prodname_dependabot %} stores the preferences for the repository centrally. While this is a quick solution, for repositories with more than one contributor it is better to explicitly define the dependencies and versions to ignore in the configuration file. This makes it easy for all contributors to see why a particular dependency isn't being updated automatically. For more information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates#ignore)."
Copy file name to clipboardExpand all lines: data/reusables/gpg/list-keys-with-note.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
2
-
1. Use the `gpg --list-secret-keys --keyid-format LONG` command to list GPG keys for which you have both a public and private key. A private key is required for signing commits or tags.
2
+
1. Use the `gpg --list-secret-keys --keyid-format=long` command to list the long form of the GPG keys for which you have both a public and private key. A private key is required for signing commits or tags.
0 commit comments