{"id":32491,"date":"2023-06-27T19:07:11","date_gmt":"2023-06-27T19:07:11","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/cppblog\/?p=32491"},"modified":"2023-07-24T17:27:34","modified_gmt":"2023-07-24T17:27:34","slug":"vcpkg-integration-with-the-github-dependency-graph","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/cppblog\/vcpkg-integration-with-the-github-dependency-graph\/","title":{"rendered":"vcpkg integration with the GitHub dependency graph"},"content":{"rendered":"<p>We are excited to share that vcpkg has an experimental feature to provide data to the GitHub dependency graph. We are actively developing this feature and would like to hear your feedback. Let us know if you have any thoughts about the current functionality or would like to see further improvements. If you have feedback on any of the GitHub features that a vcpkg-powered dependency graph enables, let us know that too and we&#8217;ll make sure that it reaches the right folks at GitHub.<\/p>\n<h2>About the GitHub dependency graph<\/h2>\n<p>The GitHub <a href=\"https:\/\/docs.github.com\/code-security\/supply-chain-security\/understanding-your-software-supply-chain\/about-the-dependency-graph\">dependency graph<\/a> stores the set of dependencies for a repository. Beyond just being able to visualize what a repository&#8217;s dependencies are, GitHub builds several useful features on top of this data, including <a href=\"https:\/\/docs.github.com\/code-security\/supply-chain-security\/understanding-your-software-supply-chain\/about-dependency-review\">dependency review<\/a> and <a href=\"https:\/\/docs.github.com\/code-security\/dependabot\/dependabot-alerts\/about-dependabot-alerts\">Dependabot alerts<\/a>.<\/p>\n<h3>Enabling the GitHub dependency graph<\/h3>\n<p>Enabling the dependency graph for your repository is a requirement for vcpkg to be able to populate the dependencies for your repository. The dependency graph is enabled by default for public repositories on GitHub. If you want the dependency graph enabled for a private repository, you should follow the <a href=\"https:\/\/docs.github.com\/code-security\/supply-chain-security\/understanding-your-software-supply-chain\/configuring-the-dependency-graph#enabling-and-disabling-the-dependency-graph-for-a-private-repository\">GitHub documentation to enable the dependency graph<\/a>.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/cppblog\/wp-content\/uploads\/sites\/9\/2023\/06\/github-enable-dependencygraph.png\" alt=\"Screenshot showing the button to enable the dependency graph\" \/><\/p>\n<p>If you are already using reusable actions in your GitHub Actions workflows and the dependency graph is enabled, there&#8217;s a good chance your repository&#8217;s dependency graph already has some dependencies listed. Check it out by selecting <strong>Insights<\/strong> for your repository and then selecting <strong>Dependency graph<\/strong>.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/cppblog\/wp-content\/uploads\/sites\/9\/2023\/06\/github-insights-dependencygraph.png\" alt=\"Screenshot of a sample repository's dependency graph\" \/><\/p>\n<h3>Techniques for populating the dependency graph<\/h3>\n<p>There are two ways that the dependency graph may get populated. For some package management systems that have a static list of dependencies that can be fully described in a manifest file, GitHub will automatically scan those manifests once they are pushed into your repository and will begin showing up in the dependency graph.<\/p>\n<p>For package management systems that are more dynamic, the tools used to process the list of dependencies must be involved in determining the complete set of dependencies. The complete set of dependencies for C and C++ are usually highly dependent upon build configuration and target platform. For these ecosystems, GitHub has a <a href=\"https:\/\/docs.github.com\/rest\/dependency-graph\/dependency-submission\">dependency submission API<\/a> that tools can use to provide the dependency information, usually as a part of a GitHub Actions workflow job.<\/p>\n<h2>Reporting dependencies with vcpkg<\/h2>\n<p>vcpkg integration with the GitHub dependency graph can be enabled by adding the value <code>dependencygraph<\/code> to the <code>VCPKG_FEATURE_FLAGS<\/code> environment variable within your GitHub Actions workflow file that runs vcpkg (either directly or indirectly via CMake). You must also modify your workflow file to set the <code>GITHUB_TOKEN<\/code> environment variable with the value <code>${{ secrets.GITHUB_TOKEN }}<\/code> and request permission for the workflow job to write the dependency information into your repository&#8217;s metadata by including the following YAML snippet near the top of your workflow file.<\/p>\n<pre><code class=\"language-YAML\">permissions:\r\n  contents: write<\/code><\/pre>\n<p>Once those changes have been made, and your workflow runs again, you should begin to see the dependencies in your vcpkg.json manifest listed in the <strong>Dependency graph<\/strong> section on GitHub.<\/p>\n<p>See our documentation at <a href=\"https:\/\/aka.ms\/vcpkg-dependency-graph\">GitHub integration &#8211; The GitHub dependency graph<\/a> for more information.<\/p>\n<h3>Examples<\/h3>\n<p>A <a href=\"https:\/\/aka.ms\/vcpkg-dependency-graph-example\">live example template repository<\/a> is on GitHub if you want to try it out in a clean project. If you want to try it out on an existing project, see the workflow files defined below that shows the changes you need to make to enable the feature.<\/p>\n<p>Both workflow examples below work with the <code>vcpkg.json<\/code> and <code>main.cpp<\/code> files listed here.<\/p>\n<p><strong>vcpkg.json<\/strong><\/p>\n<pre><code class=\"language-json\">{\r\n  \"name\": \"your-project\",\r\n  \"version-string\": \"0.0.1\",\r\n  \"dependencies\": [\r\n    \"fmt\"\r\n  ]\r\n}<\/code><\/pre>\n<p><strong>main.cpp<\/strong><\/p>\n<pre><code class=\"language-cpp\">#define FMT_HEADER_ONLY\r\n#include \"fmt\/color.h\"\r\n\r\nint main(int argc, char** argv)\r\n{\r\n    fmt::print(\r\n        fg(fmt::color::light_salmon),\r\n        \"\u00a1Hola, Mundo!\\n\"\r\n    );\r\n}<\/code><\/pre>\n<p><br\/><\/p>\n<h4>Indirectly through CMake integration<\/h4>\n<p>Add the following files to test the vcpkg dependency graph integration when using CMake.<\/p>\n<p><strong>CMakeLists.txt<\/strong><\/p>\n<pre><code class=\"language-cmake\">cmake_minimum_required(VERSION 3.15)\r\n\r\nproject(your-project CXX)\r\nfind_package(fmt REQUIRED)\r\nset(CMAKE_CXX_STANDARD 20)\r\n\r\nadd_executable(hola main.cpp)\r\n\r\ntarget_link_libraries(hola\r\n  PRIVATE\r\n    fmt::fmt)<\/code><\/pre>\n<p><strong>.github\/workflows\/cmake.yml<\/strong><\/p>\n<pre><code class=\"language-yaml\">name: Example that uses CMake integration\r\n\r\non:\r\n  workflow_dispatch:\r\n\r\n###############################################################################\r\n# Add this section to your workflow file does not already have it to enable\r\n# the job to write the dependency metadata.\r\n###############################################################################\r\npermissions:\r\n  contents: write\r\n\r\n###############################################################################\r\n# Add these environment variables to your workflow to enable the vcpkg\r\n# dependency graph integration.\r\n###############################################################################\r\nenv:\r\n  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\r\n  VCPKG_FEATURE_FLAGS: dependencygraph\r\n\r\njobs:\r\n  cmake:\r\n    runs-on: ubuntu-latest\r\n\r\n    # These steps assume an appropriate version of vcpkg is listed as a\r\n    # submodule in your git repo. If it is not, you must update this workflow\r\n    # to obtain it.\r\n\r\n    steps:\r\n      - uses: actions\/checkout@v3\r\n        with:\r\n          submodules: 'recursive'  \r\n\r\n      - name: Bootstrap vcpkg\r\n        run: ${{ github.workspace }}\/vcpkg\/bootstrap-vcpkg.sh\r\n\r\n      - name: Configure with CMake\r\n        run: |\r\n          cmake -B build -S ${{ github.workspace }} \\\r\n          -DCMAKE_TOOLCHAIN_FILE=${{ github.workspace }}\/vcpkg\/scripts\/buildsystems\/vcpkg.cmake\r\n\r\n      - name: Build with CMake\r\n        run: cmake --build build\r\n\r\n      - name: Hola, amigos\r\n        run: ${{ github.workspace }}\/build\/hola<\/code><\/pre>\n<p><br\/><\/p>\n<h4>Directly calling <code>vcpkg install<\/code><\/h4>\n<p>Add the following file to test the vcpkg dependency graph integration with workflows that call <code>vcpkg install<\/code> directly.<\/p>\n<p><strong>.github\/workflows\/build.yml<\/strong><\/p>\n<pre><code class=\"language-yaml\">name: Example that directly invokes `vcpkg install`\r\n\r\non:\r\n  push:\r\n    branches: [ main ]\r\n  workflow_dispatch:\r\n\r\n###############################################################################\r\n# Add this section to your workflow file does not already have it to enable\r\n# the job to write the dependency metadata.\r\n###############################################################################\r\npermissions:\r\n  contents: write\r\n\r\n###############################################################################\r\n# Add these environment variables to your workflow to enable the vcpkg\r\n# dependency graph integration.\r\n###############################################################################\r\nenv:\r\n  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\r\n  VCPKG_FEATURE_FLAGS: dependencygraph\r\n\r\njobs:\r\n  build:\r\n    runs-on: ubuntu-latest\r\n\r\n    # These steps assume an appropriate version of vcpkg is listed as a\r\n    # submodule in your git repo. If it is not, you must update this workflow\r\n    # to obtain it.\r\n\r\n    steps:\r\n      - uses: actions\/checkout@v3\r\n        with:\r\n          submodules: 'recursive'  \r\n\r\n      - name: Bootstrap vcpkg\r\n        run: ${{ github.workspace }}\/vcpkg\/bootstrap-vcpkg.sh\r\n\r\n      - name: Directly invoke `vcpkg install`\r\n        run: ${{ github.workspace }}\/vcpkg\/vcpkg install\r\n\r\n      - name: Build with G++\r\n        run: g++ -I${{ github.workspace }}\/vcpkg_installed\/x64-linux\/include -o hola main.cpp\r\n\r\n      - name: Hola, amigos\r\n        run: ${{ github.workspace }}\/hola<\/code><\/pre>\n<h2>Call to action<\/h2>\n<p>We are gathering feedback from users to determine the improvements we need to make to consider this integration fully supported. This is the foundation for opening up really powerful, Enterprise-grade dependency management for our users, and we are excited to have you all try it out. You can find the feature and the latest bug fixes in the most recent commit to the <a href=\"https:\/\/github.com\/microsoft\/vcpkg\" rel=\"noopener\" target=\"_blank\">vcpkg<\/a> default branch.<\/p>\n<p>As usual, if you have feedback, leave us a comment below or contact us on Twitter (<a href=\"https:\/\/twitter.com\/visualc\">@VisualC<\/a>) or via email at <a href=\"mailto:visualcpp@microsoft.com\">visualcpp@microsoft.com<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introducing vcpkg&#8217;s integration with the GitHub dependency graph<\/p>\n","protected":false},"author":85414,"featured_media":28096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[3920,230,272],"tags":[],"class_list":["post-32491","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-github","category-new-feature","category-vcpkg"],"acf":[],"blog_post_summary":"<p>Introducing vcpkg&#8217;s integration with the GitHub dependency graph<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts\/32491","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/users\/85414"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/comments?post=32491"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts\/32491\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/media\/28096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/media?parent=32491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/categories?post=32491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/tags?post=32491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}