Exercise: Secure your Repository's Supply Chain

[github-actions]

Secure your Repository's Supply Chain

👋 Hey there ageddev! Welcome to your Skills exercise!

Let's explore how to secure your repository's supply chain, understand dependencies in your environment, and find vulnerabilities in those dependencies and patch them. 💻✨

As you complete each step, I will respond in the comments to:

• check your work and give feedback
• share next steps
• occasionally share tips
• congratulate you when you finish!

Good luck and have fun!
- Mona

[github-actions]

Step 1: Review and add dependencies using dependency graph

What's the big deal about securing your repository's supply chain?: With the accelerated use of open source, most projects depend on hundreds of open-source dependencies. This poses a security problem: what if the dependencies you're using are vulnerable? You could be putting your users at risk of a supply chain attack. One of the most important things you can do to protect your supply chain is to patch your vulnerable dependencies and replace any malware.

GitHub offers a range of features to help you understand the dependencies in your environment, know about vulnerabilities in those dependencies, and patch them. The supply chain features on GitHub are:

• Dependency graph
• Dependency review
• Dependabot alerts
• Dependabot updates
  • Dependabot security updates
  • Dependabot version updates

What is a dependency graph: The dependency graph is a summary of the manifest and lock files stored in a repository and any dependencies that are submitted for the repository using the dependency submission API (beta). For each repository, it shows:

• Dependencies, the ecosystems and packages it depends on
• Dependents, the repositories and packages that depend on it

⌨️ Activity 1.1: Verify that dependency graph is enabled

We recommend opening another browser tab to work through the following activities so you can keep these instructions open for reference.

Note

Dependency graph is enabled by default for all new public repositories.

1. Navigate to the Settings tab.
2. Click Advanced Security.
3. Verify Dependency Graph is Enabled

⌨️ Activity 1.2: Add a new dependency and view your dependency graph

1. Navigate to the Code tab and locate the code/src/AttendeeSite folder.

2. Commit the following content on the main branch to the package-lock.json file as the last item on the dependencies map (after the third to last bracket } and before the last two brackets)

   🪧 Note: You can edit and commit the file on github.com directly or hit the . key to open the lightweight editor to edit and commit changes.

   ,
   "follow-redirects": {
     "version": "1.14.1",
     "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.1.tgz",
     "integrity": "sha512-HWqDgT7ZEkqRzBvc2s64vSZ/hfOceEol3ac/7tKwzuvEyWx3/4UegXh5oBOIotkGsObyk3xznnSRVADBgWSQVg=="
   }

3. Navigate to the Insights tab.

4. Select Dependency graph from the side navigation bar.

5. Review all the dependencies on the Dependencies tab.

6. Search for follow-redirects and review the new dependency you just added.
   

7. With the new dependency added, Mona should already be busy checking your work. Give her a moment and keep watch in the comments. You will see her respond with progress info and the next lesson.

[github-actions]

🎉🎉🎉 Nice work! Everything is perfect! 🎉🎉🎉
Preparing content for step 2! One moment... 🤓

[github-actions]

Step 2: Enable and view Dependabot alerts

Nice work! 🎉 You added and viewed a dependency using Dependency graph!

Given how many dependencies our repository uses, maintaining them needs to become an automated task. Keeping our code secure is a top priority, so the first thing we need to do is set up a way to be notified when a dependency we are using is vulnerable or malware. We can do this by enabling Dependabot alerts.

What are Dependabot alerts?

Dependabot alerts tell you that your code depends on a package that is insecure. These Dependabot alerts reference the GitHub Advisory Database, which contains a list of known security vulnerabilities and malware, grouped in two categories: GitHub reviewed advisories and unreviewed advisories.

If your code depends on a package that has a security vulnerability, this can cause a range of problems for your project or the people who use it. You should upgrade to a secure version of the package as soon as possible. If your code uses malware, you need to replace the package with a secure alternative.

Let's try this out with our newly added follow-redirects dependency!

⌨️ Activity 2.1: View security advisories in the GitHub Advisory Database

1. Navigate to GitHub Advisory Database.
2. Type or paste follow-redirects into the advisory search box.
3. Click on any of the advisories that were found to see more information.
4. You'll see the packages, impact, patches, workaround, and references for the advisory.

Notice the long list of advisories for our dependency! This can look scary but it's actually a good thing. It means that our dependency is actively being maintained and patches are being pushed to remove the vulnerability. If we had Dependabot alerts enabled, we could receive alerts when we need to update a dependency and act promptly to secure them.

Let's enable Dependabot alerts on our repository!

⌨️ Activity 2.2: Enable Dependabot alerts

1. Navigate to the Settings tab.
2. Display the settings for Advanced Security.
3. Enable Dependabot alerts.
4. Wait about 60 seconds for Dependabot to check for alerts.
5. Navigate to the Security tab.
6. Under "Vulnerability alerts" in the side bar, select Dependabot to view a list of the Dependabot alerts for the default branch.

Dependabot has alerted us to vulnerabilities in the dependencies that we use. We can also use Dependabot to help us address these vulnerabilities by creating pull requests to update the dependency to a safe version.

Let's see how this would work by using Dependabot to create a pull request for one of the alerts!

⌨️ Activity 2.3: Create a pull request based on a Dependabot alert

1. In the list of Dependabot alerts, click the "Prototype Pollution in minimist" to display more information.
2. Click the Create Dependabot security update button to create a pull request to update the dependency. This could take up to 2 minutes.
3. When the pull request is open, the alert page is updated to show a Review security update button.
4. Click the Review security update button to display the pull request.
   • You can view the pull request and Files changed tab to review the update.
5. Navigate back to the Conversation tab and merge the pull request.
6. With the pull request merged, Mona should already be busy checking your work. Give her a moment and keep watch in the comments. You will see her respond with progress info and the next lesson.

[github-actions]

🎉🎉🎉 Nice work! Everything is perfect! 🎉🎉🎉
Preparing content for step 3! One moment... 🤓

[github-actions]

Step 3: Enable and trigger Dependabot security updates

Nice work enabling, viewing, and creating Dependabot alerts ✨

Enabling Dependabot alerts on our repository was a great step toward improving our code security, but we still had to manually select an alert and then manually select the option to create the pull request. It would be nice to further improve the automation and maintenance of our dependencies! Well, with Dependabot security updates, we can do just that.

What are Dependabot security updates?

When this feature is enabled, Dependabot detects and fixes vulnerable dependencies for you by opening pull requests automatically to resolve Dependabot alerts.

We manually created a pull request to fix the "Prototype Pollution in minimist" alert, but let's enable Dependabot security updates to automate this process for future alerts!

⌨️ Activity 3.1: Enable and trigger Dependabot security updates

1. Navigate to the Settings tab and select Advanced Security.
2. Enable Dependabot security updates. You may need to wait 30-60 seconds before you see any new pull requests.
3. Navigate to the Pull requests repository tab to view the what Dependabot has found.
4. Find the new pull request that requests to patch the axios dependency.
5. Review and merge the pull request.
6. With the pull request merged, Mona should already be busy checking your work. Give her a moment and keep watch in the comments. You will see her respond with progress info and the next lesson.

[github-actions]

🎉🎉🎉 Nice work! Everything is perfect! 🎉🎉🎉
Preparing content for step 4! One moment... 🤓

[github-actions]

Step 4: Enable and trigger Dependabot version updates

Nicely done! 🥳

You now have automated the process for Dependabot to alert you to vulnerabilities with your dependencies and to create pull requests to update them to secure versions! At this point, you only need to review the pull request and then merge it to stay on top of security problems with Dependencies.

Note

Did you notice that there were several pull requests suggested by Dependabot? You only merged the one related to the axios dependency, but the others disappeared from the Pull requests panel. That's because the upgrade of the axios dependency triggered changes of other transitive dependencies, that might be either removed or updated to other versions. Whenever there is a change in your dependency graph, Dependabot will automatically review the existing pull requests and close the ones that are no longer relevant. So don't merge everything at once, let Dependabot do the job for you!

The security updates feature helps automate the process to resolve alerts, but what about just keeping up-to-date with version updates? We can also automate pull request generation for updated versions of dependencies using the Dependabot version updates feature.

What are Dependabot version updates?: In addition to security alerts, Dependabot can also take the effort out of maintaining your dependencies. You can use it to ensure that your repository automatically keeps up with the latest releases of the packages and applications it depends on. Similar to security alerts, Dependabot will identify an outdated dependency and create a pull request to update the manifest to the latest version of the dependency.

Let's see how this works!

⌨️ Activity 4.1: Enable and trigger Dependabot version updates

1. Navigate to the Settings tab and select Advanced Security.

2. Locate Dependabot version updates and click Configure to open a new file editor with pre-poplulated contents. The file is called dependabot.yml.

3. Notice that the file is prepopulated to update the GitHub actions in the repository, the github-actions package ecosystem.

4. Edit your dependabot.yml configuration file to include another entry. It should look like:

   version: 2
   updates:
     - package-ecosystem: "github-actions"
       directory: "/"
       schedule:
         interval: "monthly"
     - package-ecosystem: "nuget"
       directory: "/code/"
       schedule:
         interval: "weekly"

   💡 Tip: While, you can edit and commit a file directly on github.com, you can also press the period key . to open a lightweight VS Code editor directly in browser.

5. Commit your changes directly to the main branch.

6. With the configuration file updated, Mona should already be busy checking your work. Give her a moment and keep watch in the comments. You will see her respond with progress info and the next lesson.

You have now configured Dependabot version updates to run and check for updates as follows:

• Check once a month for updates to GitHub Actions and create pull requests to update any that are out of date.
• Check once a week for updates to .NET packages and create pull requests to update any that are out of date. By default, this check runs on a Monday, to run the check on a different day, see schedule.day.

[github-actions]

🎉🎉🎉 Nice work! Everything is perfect! 🎉🎉🎉
Preparing content for step 4! One moment... 🤓

[github-actions]

Step 4: Enable and trigger Dependabot version updates

Nicely done! 🥳

You now have automated the process for Dependabot to alert you to vulnerabilities with your dependencies and to create pull requests to update them to secure versions! At this point, you only need to review the pull request and then merge it to stay on top of security problems with Dependencies.

Note

Did you notice that there were several pull requests suggested by Dependabot? You only merged the one related to the axios dependency, but the others disappeared from the Pull requests panel. That's because the upgrade of the axios dependency triggered changes of other transitive dependencies, that might be either removed or updated to other versions. Whenever there is a change in your dependency graph, Dependabot will automatically review the existing pull requests and close the ones that are no longer relevant. So don't merge everything at once, let Dependabot do the job for you!

The security updates feature helps automate the process to resolve alerts, but what about just keeping up-to-date with version updates? We can also automate pull request generation for updated versions of dependencies using the Dependabot version updates feature.

What are Dependabot version updates?: In addition to security alerts, Dependabot can also take the effort out of maintaining your dependencies. You can use it to ensure that your repository automatically keeps up with the latest releases of the packages and applications it depends on. Similar to security alerts, Dependabot will identify an outdated dependency and create a pull request to update the manifest to the latest version of the dependency.

Let's see how this works!

⌨️ Activity 4.1: Enable and trigger Dependabot version updates

1. Navigate to the Settings tab and select Advanced Security.

2. Locate Dependabot version updates and click Configure to open a new file editor with pre-poplulated contents. The file is called dependabot.yml.

3. Notice that the file is prepopulated to update the GitHub actions in the repository, the github-actions package ecosystem.

4. Edit your dependabot.yml configuration file to include another entry. It should look like:

   version: 2
   updates:
     - package-ecosystem: "github-actions"
       directory: "/"
       schedule:
         interval: "monthly"
     - package-ecosystem: "nuget"
       directory: "/code/"
       schedule:
         interval: "weekly"

   💡 Tip: While, you can edit and commit a file directly on github.com, you can also press the period key . to open a lightweight VS Code editor directly in browser.

5. Commit your changes directly to the main branch.

6. With the configuration file updated, Mona should already be busy checking your work. Give her a moment and keep watch in the comments. You will see her respond with progress info and the next lesson.

You have now configured Dependabot version updates to run and check for updates as follows:

• Check once a month for updates to GitHub Actions and create pull requests to update any that are out of date.
• Check once a week for updates to .NET packages and create pull requests to update any that are out of date. By default, this check runs on a Monday, to run the check on a different day, see schedule.day.

[github-actions]

🎉🎉🎉 Nice work! Everything is perfect! 🎉🎉🎉
Now, let's do a quick review!

[github-actions]

Review

Congratulations, you've completed this exercise and learned a lot securing your supply chain!

Here's a recap of all the tasks you've accomplished in your repository:

• You've learned how to view and use dependency graph.
• You've learned how to enable and use Dependabot alerts.
• You've learned how to enable and use Dependabot security updates.
• You've learned how to enable and use Dependabot version updates.

Additional learning and resources

• Dependency graph
• Exploring the dependencies of a repository
• About supply chain security
• Dependabot alerts
• GitHub Advisory Database

What's next?

• Learn more about securing your supply chain by reading: Securing your supply chain.
• Check out other security focused GitHub Skills exercises.
• Read the Get started with GitHub docs.
• To find projects to contribute to, check out GitHub Explore.

[github-actions]

Congratulations ageddev! You finished the exercise! 🎉🎉🎉

We've updated the repository with a couple changes to highlight your success!

Return to the repository home page to see your progress!