GitHub Repo Dependency Intelligence

Analyze public GitHub repositories, package manifests, dependencies, and repository health signals using the GitHub REST API.

Use cases

Use this actor for OSS dependency & supply-chain audit — enumerate GitHub repo dependencies, releases, and manifests. Auth-free, official-API-first, with a stable output schema and documented source compliance.

What It Does

• Fetch repository metadata from GitHub
• Inspect common manifest files such as package.json, requirements.txt, pyproject.toml, and go.mod
• Emit dependency rows with package manager, dependency group, name, and version
• Emit manifest file rows and repository summary rows
• Support optional GitHub token for higher API limits

Input

{
  "repositories": ["facebook/react", "nodejs/node"],
  "manifestPaths": [],
  "includeDevDependencies": true,
  "includeRepositorySummary": true,
  "maxDependenciesPerRepo": 250,
  "delivery": "dataset",
  "dryRun": false
}

manifestPaths can be left empty to use common defaults.

Input Examples

Example: Single-target audit

{
  "targets": [
    "example-target-1"
  ],
  "maxResultsPerTarget": 30
}

Example: Bulk portfolio

{
  "targets": [
    "target-1",
    "target-2",
    "target-3"
  ],
  "maxResultsPerTarget": 50,
  "snapshotKey": "github-repo-dependency-intelligence-state"
}

Example: Recurring delta watch

{
  "targets": [
    "target-1"
  ],
  "snapshotKey": "github-repo-dependency-intelligence-state",
  "emitChangedOnly": true
}

Output Rows

• repository_summary
• manifest_file
• dependency

Webhook delivery sends the full payload and does not also push dataset rows.

Local Run

npm install
npm test
node src/index.js

Notes

This actor uses public GitHub APIs. Without a token, GitHub rate limits are lower. Add githubToken for larger batches.