Accessing repository dependencies in the GitHub GraphQL API#

Access to a Repositories Dependency Graph describes a preview API for accessing GitHub repository dependencies.

To access the preview you need to send this Accept: header: application/vnd.github.hawkgirl-preview+json

But… GitHub’s own GraphQL explorer at https://developer.github.com/v4/explorer/ doesn’t currently allow you to set custom HTTP headers.

Installing GraphiQL#

So I decided to try https://github.com/skevy/graphiql-app - since it’s mentioned in the GitHub docs here.

1
brew cask install graphiql

Then you can launch the app from /Applications/GraphiQL.app.

I created a personal access token at https://github.com/settings/tokens called graphiql and gave it all of the read: permissions.

I launched the graphiql app and added the following headers:

1
Authorization: Bearer MY-PERSONAl-ACCESS-TOKEN
2
Accept: application/vnd.github.hawkgirl-preview+json

I added https://api.github.com/graphql as the endpoint.

I tested it by running these queries:

1
{
2
  user(login:"simonw") {
3
    id
4
    name
5
    url
6
    websiteUrl
7
  }
8
}

1
{
2
  repository(owner:"simonw", name:"datasette") {
3
    id
4
    name
5
    issues {
6
      totalCount
7
    }
8
  }
9
}

1
{
2
  search(type:REPOSITORY query:"datasette" first:10) {
3
    repositoryCount
4
    edges {
5
      node {
6
        __typename
7
        ... on Repository {
8
          nameWithOwner
9
          description
10
        }
11
      }
12
    }
13
  }
14
}

Then I figured out this query (using autocomplete) which returns dependencies detected for a repo:

1
{
2
  repository(owner:"simonw", name:"datasette") {
3
    dependencyGraphManifests {
4
      totalCount
5
      nodes {
6
        filename
7
      }
8
      edges {
9
        node {
10
          blobPath
11
          dependencies {
12
            totalCount
13
            nodes {
14
              packageName
15
              requirements
16
              hasDependencies
17
              packageManager
18
            }
19
          }
20
        }
21
      }
22
    }
23
  }
24
}

This gave me back:

1
{
2
  "data": {
3
    "repository": {
4
      "dependencyGraphManifests": {
5
        "totalCount": 1,
6
        "nodes": [
7
          {
8
            "filename": "setup.py"
9
          }
10
        ],
11
        "edges": [
12
          {
13
            "node": {
14
              "blobPath": "/simonw/datasette/blob/master/setup.py",
15
              "dependencies": {
16
                "totalCount": 12,
17
                "nodes": [
18
                  {
19
                    "packageName": "aiofiles",
20
                    "requirements": "~> 0.4.0",
21
                    "hasDependencies": false,
22
                    "packageManager": "PIP"
23
                  },
24
                  {
25
                    "packageName": "click",
26
                    "requirements": "~> 7.1.1",
27
                    "hasDependencies": false,
28
                    "packageManager": "PIP"
29
                  },
30
                  {
31
                    "packageName": "click-default-group",
32
                    "requirements": "~> 1.2.2",
33
                    "hasDependencies": true,
34
                    "packageManager": "PIP"
35
                  },
36
                  {
37
                    "packageName": "datasette",
38
                    "requirements": "",
39
                    "hasDependencies": true,
40
                    "packageManager": "PIP"
41
                  },
42
                  {
43
                    "packageName": "hupper",
44
                    "requirements": "~> 1.9",
45
                    "hasDependencies": true,
46
                    "packageManager": "PIP"
47
                  },
48
                  {
49
                    "packageName": "janus",
50
                    "requirements": "~> 0.4.0",
51
                    "hasDependencies": false,
52
                    "packageManager": "PIP"
53
                  },
54
                  {
55
                    "packageName": "jinja2",
56
                    "requirements": "~> 2.10.3",
57
                    "hasDependencies": true,
58
                    "packageManager": "PIP"
59
                  },
60
                  {
61
                    "packageName": "mergedeep",
62
                    "requirements": "~> 1.1.1",
63
                    "hasDependencies": false,
64
                    "packageManager": "PIP"
65
                  },
66
                  {
67
                    "packageName": "pint",
68
                    "requirements": "~> 0.9",
69
                    "hasDependencies": false,
70
                    "packageManager": "PIP"
71
                  },
72
                  {
73
                    "packageName": "pluggy",
74
                    "requirements": "~> 0.13.0",
75
                    "hasDependencies": true,
76
                    "packageManager": "PIP"
77
                  },
78
                  {
79
                    "packageName": "pyyaml",
80
                    "requirements": "~> 5.3",
81
                    "hasDependencies": false,
82
                    "packageManager": "PIP"
83
                  },
84
                  {
85
                    "packageName": "uvicorn",
86
                    "requirements": "~> 0.11",
87
                    "hasDependencies": true,
88
                    "packageManager": "PIP"
89
                  }
90
                ]
91
              }
92
            }
93
          }
94
        ]
95
      }
96
    }
97
  }
98
}

Sadly I really wanted to get the dependents, not the dependencies - but that’s still not available even as a preview API. So I scraped them instead.