Repositories and scans
Repositories lists the repositories added to Depos. Only these are scanned and checked.
Which repositories you can add is decided on GitHub, by the installation's "All repositories / Only select repositories" choice. After you change it there, open Add repositories and click Refresh list.
Add repositories
Click Add repositories. It lists every repository the GitHub App can see that is not added yet. Tick the ones Depos should read and click Add. Archived repositories are listed but cannot be added: they are never scanned.
An added repository:
- is scanned at once;
- is scanned again on every push to its default branch;
- gets pull request checks for pull requests into its default branch, unless you narrow the check down on Allowlist → Policy.
There is nothing to scan by hand while things work: pushes keep an added repository current. When a scan does not finish — it failed or was paused — the repository shows Retry, and Retry failed above the list retries all of them at once.
Adding, retrying and removing need an organization admin.
Remove a repository
Choose Remove… in a repository's menu, or on its page. Depos then:
- stops scanning it and checking its pull requests;
- deletes its dependencies, its notes files and its scan state from Depos;
- keeps its history on the Activity page.
The repository goes back to the Add repositories list. Adding it again scans it from scratch.
What a scan reads
A scan reads the default branch through the GitHub API; nothing is cloned. It looks for:
- the manifests of the supported ecosystems, anywhere in the repository;
- the notes files the editor extension writes offline:
.depos/DEPENDENCY-NOTES.mdfor npm, and.depos/<ecosystem>/DEPENDENCY-NOTES.mdfor the others (for example.depos/python/DEPENDENCY-NOTES.md). Older repositories keep them under.pacmon/, which is read the same way.
Manifests are parsed with the same parser the editor extension uses, so a package's name is normalized the same way in both.
Scan statuses
| Status | Means |
|---|---|
| Waiting | Added; its first scan has not run yet. |
| Queued | Waiting for its turn. |
| Scanning | Being read now. |
| Up to date | The last scan read everything. |
| Partial | Read, but some files were skipped. The packages found are kept. |
| Paused | GitHub's request budget ran out. Retry it later. |
| Failed | The last scan failed. The packages from the scan before stay. |
Hover the status to see why. Files are skipped when they are:
- larger than 1 MB;
- past the limit of 500 manifests per repository;
- impossible to parse;
- left out because GitHub truncated the repository's file list.
Scans share GitHub's request budget. When it runs low, the organization's remaining scans stop and those repositories show Paused. GitHub's budget resets within the hour; retry them then. A scan cut short by a server restart is marked Failed with Interrupted by a server restart — Retry it.
A repository's page
Click a repository to see its scan state, every dependency it declares (with the manifest it comes from and its allowlist result), its notes files and any problems found in them, and the history of packages added to or removed from it.