Supply chain

Re-run dependency review

Run the Dependency review check again on an open pull request's head, with the advisories known now: its status is set again and its one comment on the pull request is changed in place (or added, when it has dependency changes to show and none is there yet).

POST/repos/{owner}/{name}/pulls/{number}/dependency-review/rerun

Returns the review. g1t reviews a pull request by itself when it opens and when its head moves, carrying the result over when the head’s lockfile changes are the ones reviewed before. Takes the Write role. Needs the g1t plan on a private repository.

The pull request’s one dependency review comment is changed in place; nothing new is posted when the review says the same.

Authentication: Required. Send an access token as Authorization: Bearer.
MCP tool: security with action rerun_dependency_review, and the same inputs
Scope: An access token needs security:write.

Path parameters

Name	Type	Required	Description
`owner`	string	Yes	The workspace that owns the repository.
`name`	string	Yes	The repository’s name.
`number`	integer	Yes	The pull request’s number.

Example request

curl -X POST https://api.g1t.sh/repos/flagon-io/hello/pulls/12/dependency-review/rerun \
  -H "Authorization: Bearer $G1T_TOKEN"

Example response

A successful request answers 200 with:

{
  "base": "4b1d7c0e9a2f6e3d8c5b0a7f4e1d2c3b4a5f6e7d",
  "head": "9f2c4e1a7b3d5f60812a4c6e8b0d2f4a6c8e0b13",
  "changes": [
    {
      "change_type": "added",
      "manifest": "package-lock.json",
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21",
      "relationship": "direct",
      "development": false,
      "license": "MIT",
      "purl": "pkg:npm/lodash@4.17.21",
      "vulnerabilities": [],
      "denied_license": false,
      "failing": false
    },
    {
      "change_type": "removed",
      "manifest": "package-lock.json",
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.20",
      "relationship": "direct",
      "development": false,
      "license": "MIT",
      "purl": "pkg:npm/lodash@4.17.20",
      "vulnerabilities": [],
      "denied_license": false,
      "failing": false
    }
  ],
  "passed": true,
  "headline": "2 dependency changes, none vulnerable",
  "fail_on": "high",
  "deny_licenses": []
}

Errors

A failed request answers with one of these statuses and a body like {"error": {"code": "not_found", "message": "Repository not found."}}. See errors.

Status	Code	When
401	`unauthenticated`	A token is required, or the one sent is not valid.
403	`forbidden`	The token is valid but not allowed to do this, such as a member-only change, or a token without the scope it needs.
404	`not_found`	It does not exist, or you cannot see it.
409	`conflict`	The request conflicts with the current state.
422	`invalid`	The input is not valid. `message` says which field and why.