GopherCon 2025 tutorial: What story does your dependency tree tell you about your organisation?

This is the corresponding supporting details for the GopherCon 2025 tutorial, What story does your dependency tree tell you about your organisation? by Jamie Tanna.

More discussion on the GopherCon UK Slack: #tutorial-story-dependency-organisation.

Prerequisites

• Have Docker installed (to use pre-built container with core dependencies needed)
• Install the Dependency Management Data CLI, dmd via docs

Scanning repos

Note

If you've never logged into the GitHub Container Registry before, you'll need to follow these instructions.

For simplicity, there is a make task to download the scanning image, which contains prerequisites:

make -C ./container-image/scanner pull

It can also be manually downloaded via:

docker pull ghcr.io/deps-fyi/gophercon-uk-2025:latest

This image will scan given repo(s) with:

• renovate-graph, which uses Renovate under the hood for its wide support of supported languages and package ecosystems
• dependabot-graph, which uses GitHub Advanced Security's Dependency Graph
  • NOTE: if you are using this on repositories after 2025-06, please verify that the Dependency Graph is enabled on your repo. After 2025-06, it was disabled by default.

This allows a comparison between the data that GitHub Advanced Security's Dependency Graph gets (through the Software Bill of Materials (SBOM) endpoint) vs Renovate's much more in-depth and configurable support.

Scanning GitHub repositories

(Currently only supports GitHub.com)

Note

You will need a Personal Access Token created for this.

If you will only be scanning public repositories, you can create a Personal Access Token (Classic) with public_repo scope.

For a fine-grained Personal Access Token, you will need:

• Contents: Read only
• Issues: Read only
• Metadata: Read only

Make sure you're selecting the correct Resource Owner of the fine-grained Personal Access Token, and repositories that want to be scanned.

For instance, if we want to run against GitHub.com, we would use:

# NOTE that for ease, I personally use the GitHub token from https://cli.github.com/
$ export GITHUB_TOKEN=$(gh auth token)
# Alternatively, set it to the Personal Access Token from above
$ export GITHUB_TOKEN=ghp_...

$ env RENOVATE_TOKEN=$GITHUB_TOKEN make -C ./container-image/scanner run
# this will then interactively ask:
Enter space-separated repo slugs (i.e. oapi-codegen/oapi-codegen): oapi-codegen/oapi-codegen jamietanna-jamietanna
# ...
Finished processing, to import, run:
# I.e. if you have `dmd.db`
cd /home/jamie/workspaces/gophercon2025/tutorial && dmd import dependabot --db dmd.db out/jamietanna-jamietanna.json out/oapi-codegen-oapi-codegen.json
cd /home/jamie/workspaces/gophercon2025/tutorial && dmd import renovate --db dmd.db out/renovate-graph/github-jamietanna-jamietanna.json out/renovate-graph/github-oapi-codegen-oapi-codegen.json

You can also avoid interactively setting arguments by running:

$ env RENOVATE_TOKEN=$GITHUB_TOKEN make -C ./container-image/scanner run oapi-codegen/oapi-codegen

Scanning GitLab repositories

(Currently only supports GitLab.com)

$ env RENOVATE_TOKEN=... RENOVATE_PLATFORM=gitlab make -C ./container-image/scanner run
# this will then interactively ask:
Enter space-separated repo slugs (i.e. oapi-codegen/oapi-codegen): tanna.dev/renovate-graph
# ...
Finished processing, to import, run:
# I.e. if you have `dmd.db`
cd /home/jamie/workspaces/gophercon2025/tutorial && dmd import renovate --db dmd.db out/renovate-graph/gitlab-tanna.dev-tz.json

You can also avoid interactively setting arguments by running:

$ env RENOVATE_TOKEN=... RENOVATE_PLATFORM=gitlab make -C ./container-image/scanner run tanna.dev/tz

Building from source

It is also possible to build this container image from source:

# from the root of this repository
make -C ./container-image/scanner build

Not using the pre-built container

If you've not pre-downloaed the ~700MB container image, and don't want to - or don't want to build it up from source - you can also "just" use the CLIs yourself.

You will need:

• NodeJS 22.13 (other 22.x likely fine)
• renovate-graph
• dependabot-graph (if scanning GitHub repos)

You could modify container-image/scanner/scan.sh to use npx to avoid a global install of renovate-graph:

-env LOG_LEVEL=warn OUT_DIR=out/renovate-graph RENOVATE_DRY_RUN=lookup renovate-graph $repo_slugs
+env LOG_LEVEL=warn OUT_DIR=out/renovate-graph RENOVATE_DRY_RUN=lookup npx @jamietanna/renovate-graph@latest $repo_slugs

renovate-graph debug logs

For ease, it is also possible to use make ... run-debug to get the full renovate-graph debug logs for a given Renovate run.

Using example data

If you don't have your laptop, or don't have access to repos you want to grab data from, you can use this deployment of the example data.

This uses Evidence to provide rich, visual breakdowns of the data.

Using Evidence with your own data

If you'd like to use this set up with your own data - to see what some of the pre-written queries look like - you can follow the steps below:

cd ./web
npm install
# NOTE that the destination path is important, and must be called `dmd.db`
cp /path/to/dmd.db web/sources/dmd/dmd.db
npm run sources
npm run dev
# this will open it up locally