fix

Bump @octokit/plugin-retry from 4.1.3 to 5.0.0

__tests__/summary.test.ts

@@ -24,7 +24,9 @@ const defaultConfig: ConfigurationOptions = {
   allow_ghsas: [],
   allow_licenses: [],
   deny_licenses: [],
-  comment_summary_in_pr: true
+  comment_summary_in_pr: true,
+  retry_on_snapshot_warnings: true,
+  retry_on_snapshot_warnings_timeout: 120
 }
 
 const changesWithEmptyManifests: Changes = [

action.yml

@@ -47,6 +47,14 @@ inputs:
   comment-summary-in-pr:
     description: A boolean to determine if the report should be posted as a comment in the PR itself. Setting this to true requires you to give the workflow the write permissions for pull-requests
     required: false
+  retry-on-snapshot-warnings:
+    description: Whether to retry on snapshot warnings
+    required: false
+    default: true
+  retry-on-snapshot-warnings-timeout:
+    description: How many seconds before bailing on retries
+    required: false
+    default: 120
 runs:
   using: 'node16'
   main: 'dist/index.js'

dist/index.js

@@ -188,7 +188,7 @@ function compare({ owner, repo, baseRef, headRef }) {
         let snapshot_warnings = '';
         const changes = yield octo.paginate({
             method: 'GET',
-            url: '/repos/{owner}/{repo}/dependency-graph/compare/{basehead}',
+            url: '/repos/{owner}/{repo}/dependency-graph/compare/{basehead}?includes_dependency_snapshots=true',
             owner,
             repo,
             basehead: `${baseRef}...${headRef}`
@@ -485,17 +485,47 @@ const summary = __importStar(__nccwpck_require__(8608));
 const git_refs_1 = __nccwpck_require__(1086);
 const utils_1 = __nccwpck_require__(918);
 const comment_pr_1 = __nccwpck_require__(5842);
+function delay(ms) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    });
+}
+function getComparison(baseRef, headRef, retryOpts) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const comparison = yield dependencyGraph.compare({
+            owner: github.context.repo.owner,
+            repo: github.context.repo.repo,
+            baseRef,
+            headRef
+        });
+        if (comparison.snapshot_warnings.trim() !== '') {
+            core.info(comparison.snapshot_warnings);
+            if (retryOpts !== undefined) {
+                if (retryOpts.retryUntil < Date.now()) {
+                    core.info(`Retry timeout exceeded. Proceeding...`);
+                    return comparison;
+                }
+                else {
+                    core.info(`Retrying in ${retryOpts.retryDelay} seconds...`);
+                    yield delay(retryOpts.retryDelay * 1000);
+                    return getComparison(baseRef, headRef, retryOpts);
+                }
+            }
+        }
+        return comparison;
+    });
+}
 function run() {
     return __awaiter(this, void 0, void 0, function* () {
         try {
             const config = yield (0, config_1.readConfig)();
             const refs = (0, git_refs_1.getRefs)(config, github.context);
-            const comparison = yield dependencyGraph.compare({
-                owner: github.context.repo.owner,
-                repo: github.context.repo.repo,
-                baseRef: refs.base,
-                headRef: refs.head
-            });
+            const comparison = yield getComparison(refs.base, refs.head, config.retry_on_snapshot_warnings
+                ? {
+                    retryUntil: Date.now() + config.retry_on_snapshot_warnings_timeout * 1000,
+                    retryDelay: 10
+                }
+                : undefined);
             const changes = comparison.changes;
             const snapshot_warnings = comparison.snapshot_warnings;
             if (!changes) {
@@ -717,7 +747,9 @@ exports.ConfigurationOptionsSchema = z
     config_file: z.string().optional(),
     base_ref: z.string().optional(),
     head_ref: z.string().optional(),
-    comment_summary_in_pr: z.boolean().default(false)
+    comment_summary_in_pr: z.boolean().default(false),
+    retry_on_snapshot_warnings: z.boolean().default(true),
+    retry_on_snapshot_warnings_timeout: z.number().default(120)
 })
     .superRefine((config, context) => {
     if (config.allow_licenses && config.deny_licenses) {
@@ -9167,54 +9199,83 @@ exports.restEndpointMethods = restEndpointMethods;
 /***/ }),
 
 /***/ 6298:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
 "use strict";
 
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-Object.defineProperty(exports, "__esModule", ({ value: true }));
+// pkg/dist-src/index.js
+var dist_src_exports = {};
+__export(dist_src_exports, {
+  VERSION: () => VERSION,
+  retry: () => retry
+});
+module.exports = __toCommonJS(dist_src_exports);
 
-function _interopDefault (ex) { return (ex && (typeof ex === 'object') && 'default' in ex) ? ex['default'] : ex; }
-
-var Bottleneck = _interopDefault(__nccwpck_require__(1174));
-var requestError = __nccwpck_require__(537);
-
-// @ts-ignore
+// pkg/dist-src/error-request.js
 async function errorRequest(state, octokit, error, options) {
   if (!error.request || !error.request.request) {
-    // address https://github.com/octokit/plugin-retry.js/issues/8
     throw error;
   }
-  // retry all >= 400 && not doNotRetry
   if (error.status >= 400 && !state.doNotRetry.includes(error.status)) {
     const retries = options.request.retries != null ? options.request.retries : state.retries;
     const retryAfter = Math.pow((options.request.retryCount || 0) + 1, 2);
     throw octokit.retry.retryRequest(error, retries, retryAfter);
   }
-  // Maybe eventually there will be more cases here
   throw error;
 }
 
-// @ts-nocheck
+// pkg/dist-src/wrap-request.js
+var import_light = __toESM(__nccwpck_require__(1174));
+var import_request_error = __nccwpck_require__(537);
 async function wrapRequest(state, octokit, request, options) {
-  const limiter = new Bottleneck();
-  limiter.on("failed", function (error, info) {
+  const limiter = new import_light.default();
+  limiter.on("failed", function(error, info) {
     const maxRetries = ~~error.request.request.retries;
     const after = ~~error.request.request.retryAfter;
     options.request.retryCount = info.retryCount + 1;
     if (maxRetries > info.retryCount) {
-      // Returning a number instructs the limiter to retry
-      // the request after that number of milliseconds have passed
       return after * state.retryAfterBaseValue;
     }
   });
-  return limiter.schedule(requestWithGraphqlErrorHandling.bind(null, state, octokit, request), options);
+  return limiter.schedule(
+    requestWithGraphqlErrorHandling.bind(null, state, octokit, request),
+    options
+  );
 }
 async function requestWithGraphqlErrorHandling(state, octokit, request, options) {
   const response = await request(request, options);
-  if (response.data && response.data.errors && /Something went wrong while executing your query/.test(response.data.errors[0].message)) {
-    // simulate 500 request error for retry handling
-    const error = new requestError.RequestError(response.data.errors[0].message, 500, {
+  if (response.data && response.data.errors && /Something went wrong while executing your query/.test(
+    response.data.errors[0].message
+  )) {
+    const error = new import_request_error.RequestError(response.data.errors[0].message, 500, {
       request: options,
       response
     });
@@ -9223,14 +9284,18 @@ async function requestWithGraphqlErrorHandling(state, octokit, request, options)
   return response;
 }
 
-const VERSION = "4.1.3";
+// pkg/dist-src/index.js
+var VERSION = "5.0.0";
 function retry(octokit, octokitOptions) {
-  const state = Object.assign({
-    enabled: true,
-    retryAfterBaseValue: 1000,
-    doNotRetry: [400, 401, 403, 404, 422],
-    retries: 3
-  }, octokitOptions.retry);
+  const state = Object.assign(
+    {
+      enabled: true,
+      retryAfterBaseValue: 1e3,
+      doNotRetry: [400, 401, 403, 404, 422],
+      retries: 3
+    },
+    octokitOptions.retry
+  );
   if (state.enabled) {
     octokit.hook.error("request", errorRequest.bind(null, state, octokit));
     octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
@@ -9239,8 +9304,8 @@ function retry(octokit, octokitOptions) {
     retry: {
       retryRequest: (error, retries, retryAfter) => {
         error.request.request = Object.assign({}, error.request.request, {
-          retries: retries,
-          retryAfter: retryAfter
+          retries,
+          retryAfter
         });
         return error;
       }
@@ -9248,10 +9313,8 @@ function retry(octokit, octokitOptions) {
   };
 }
 retry.VERSION = VERSION;
-
-exports.VERSION = VERSION;
-exports.retry = retry;
-//# sourceMappingURL=index.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (0);
 
 
 /***/ }),
@@ -35901,7 +35964,7 @@ module.exports = __toCommonJS(dist_src_exports);
 var import_core = __nccwpck_require__(6762);
 var import_plugin_paginate_rest = __nccwpck_require__(3932);
 var import_plugin_rest_endpoint_methods = __nccwpck_require__(3779);
-var import_plugin_retry = __nccwpck_require__(6298);
+var import_plugin_retry = __nccwpck_require__(8519);
 var import_plugin_throttling = __nccwpck_require__(9968);
 
 // pkg/dist-src/version.js
@@ -37479,6 +37542,127 @@ exports.restEndpointMethods = restEndpointMethods;
 //# sourceMappingURL=index.js.map
 
 
+/***/ }),
+
+/***/ 8519:
+/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
+
+"use strict";
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// pkg/dist-src/index.js
+var dist_src_exports = {};
+__export(dist_src_exports, {
+  VERSION: () => VERSION,
+  retry: () => retry
+});
+module.exports = __toCommonJS(dist_src_exports);
+
+// pkg/dist-src/error-request.js
+async function errorRequest(state, octokit, error, options) {
+  if (!error.request || !error.request.request) {
+    throw error;
+  }
+  if (error.status >= 400 && !state.doNotRetry.includes(error.status)) {
+    const retries = options.request.retries != null ? options.request.retries : state.retries;
+    const retryAfter = Math.pow((options.request.retryCount || 0) + 1, 2);
+    throw octokit.retry.retryRequest(error, retries, retryAfter);
+  }
+  throw error;
+}
+
+// pkg/dist-src/wrap-request.js
+var import_light = __toESM(__nccwpck_require__(1174));
+var import_request_error = __nccwpck_require__(537);
+async function wrapRequest(state, octokit, request, options) {
+  const limiter = new import_light.default();
+  limiter.on("failed", function(error, info) {
+    const maxRetries = ~~error.request.request.retries;
+    const after = ~~error.request.request.retryAfter;
+    options.request.retryCount = info.retryCount + 1;
+    if (maxRetries > info.retryCount) {
+      return after * state.retryAfterBaseValue;
+    }
+  });
+  return limiter.schedule(
+    requestWithGraphqlErrorHandling.bind(null, state, octokit, request),
+    options
+  );
+}
+async function requestWithGraphqlErrorHandling(state, octokit, request, options) {
+  const response = await request(request, options);
+  if (response.data && response.data.errors && /Something went wrong while executing your query/.test(
+    response.data.errors[0].message
+  )) {
+    const error = new import_request_error.RequestError(response.data.errors[0].message, 500, {
+      request: options,
+      response
+    });
+    return errorRequest(state, octokit, error, options);
+  }
+  return response;
+}
+
+// pkg/dist-src/index.js
+var VERSION = "4.1.6";
+function retry(octokit, octokitOptions) {
+  const state = Object.assign(
+    {
+      enabled: true,
+      retryAfterBaseValue: 1e3,
+      doNotRetry: [400, 401, 403, 404, 422],
+      retries: 3
+    },
+    octokitOptions.retry
+  );
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, octokit));
+    octokit.hook.wrap("request", wrapRequest.bind(null, state, octokit));
+  }
+  return {
+    retry: {
+      retryRequest: (error, retries, retryAfter) => {
+        error.request.request = Object.assign({}, error.request.request, {
+          retries,
+          retryAfter
+        });
+        return error;
+      }
+    }
+  };
+}
+retry.VERSION = VERSION;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (0);
+
+
 /***/ }),
 
 /***/ 1223:
@@ -46200,6 +46384,8 @@ function readInlineConfig() {
     const base_ref = getOptionalInput('base-ref');
     const head_ref = getOptionalInput('head-ref');
     const comment_summary_in_pr = getOptionalBoolean('comment-summary-in-pr');
+    const retry_on_snapshot_warnings = getOptionalBoolean('retry-on-snapshot-warnings');
+    const retry_on_snapshot_warnings_timeout = getOptionalNumber('retry-on-snapshot-warnings-timeout');
     validatePURL(allow_dependencies_licenses);
     validateLicenses('allow-licenses', allow_licenses);
     validateLicenses('deny-licenses', deny_licenses);
@@ -46214,10 +46400,17 @@ function readInlineConfig() {
         vulnerability_check,
         base_ref,
         head_ref,
-        comment_summary_in_pr
+        comment_summary_in_pr,
+        retry_on_snapshot_warnings,
+        retry_on_snapshot_warnings_timeout
     };
     return Object.fromEntries(Object.entries(keys).filter(([_, value]) => value !== undefined));
 }
+function getOptionalNumber(name) {
+    const value = core.getInput(name);
+    const parsed = z.string().regex(/^\d+$/).transform(Number).safeParse(value);
+    return parsed.success ? parsed.data : undefined;
+}
 function getOptionalBoolean(name) {
     const value = core.getInput(name);
     return value.length > 0 ? core.getBooleanInput(name) : undefined;
@@ -46497,7 +46690,9 @@ exports.ConfigurationOptionsSchema = z
     config_file: z.string().optional(),
     base_ref: z.string().optional(),
     head_ref: z.string().optional(),
-    comment_summary_in_pr: z.boolean().default(false)
+    comment_summary_in_pr: z.boolean().default(false),
+    retry_on_snapshot_warnings: z.boolean().default(true),
+    retry_on_snapshot_warnings_timeout: z.number().default(120)
 })
     .superRefine((config, context) => {
     if (config.allow_licenses && config.deny_licenses) {

package-lock.json

@@ -11,10 +11,10 @@
       "dependencies": {
         "@actions/core": "^1.10.0",
         "@actions/github": "^5.1.1",
-        "@octokit/plugin-retry": "^4.1.1",
+        "@octokit/plugin-retry": "^5.0.0",
         "@octokit/request-error": "^2.1.0",
         "ansi-styles": "^6.2.1",
-        "got": "^12.6.0",
+        "got": "^13.0.0",
         "nodemon": "^2.0.22",
         "octokit": "^2.0.16",
         "packageurl-js": "^1.0.2",
@@ -33,7 +33,7 @@
         "@vercel/ncc": "^0.36.1",
         "esbuild-register": "^3.4.2",
         "eslint": "^8.41.0",
-        "eslint-plugin-github": "^4.7.0",
+        "eslint-plugin-github": "^4.8.0",
         "eslint-plugin-jest": "^27.2.1",
         "jest": "^27.5.1",
         "js-yaml": "^4.1.0",
@@ -1684,15 +1684,15 @@
       }
     },
     "node_modules/@octokit/plugin-retry": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-4.1.3.tgz",
-      "integrity": "sha512-3YKBj7d0J/4mpEc4xzMociWsMNl5lZqrpAnYcW6mqiSGF3wFjU+c6GHih6GLClk31JNvKDr0x9jc5cfm7evkZg==",
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-5.0.0.tgz",
+      "integrity": "sha512-mfON7q30NLdivuJktZuSP6I4/WPMjc/bcoxcHEWXd4esedHTqQpp3OUq2NzD2+M+J6o33zYDtJTl4qtRYh8HQQ==",
       "dependencies": {
         "@octokit/types": "^9.0.0",
         "bottleneck": "^2.15.3"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 18"
       },
       "peerDependencies": {
         "@octokit/core": ">=3"
@@ -3771,9 +3771,9 @@
       }
     },
     "node_modules/eslint-plugin-github": {
-      "version": "4.7.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-4.7.0.tgz",
-      "integrity": "sha512-SIFSy6IXtN3aGQ6YyFWg/oxRUyAcYwg5G0wh+ov1HQCvmp+Pzs1GzeVjU8QcIQSSJfverQzuxWrJCAln/d2PuQ==",
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-4.8.0.tgz",
+      "integrity": "sha512-1qu1qcyac4FfZmT9KNPr5250DwWzwp6uy6xAqHD2boE4OquUpeTni05yPn1b6y6vUYm/q8+npTdyYiRSqvg+BQ==",
       "dev": true,
       "dependencies": {
         "@github/browserslist-config": "^1.0.0",
@@ -4533,9 +4533,9 @@
       }
     },
     "node_modules/got": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/got/-/got-12.6.0.tgz",
-      "integrity": "sha512-WTcaQ963xV97MN3x0/CbAriXFZcXCfgxVp91I+Ze6pawQOa7SgzwSx2zIJJsX+kTajMnVs0xcFD1TxZKFqhdnQ==",
+      "version": "13.0.0",
+      "resolved": "https://registry.npmjs.org/got/-/got-13.0.0.tgz",
+      "integrity": "sha512-XfBk1CxOOScDcMr9O1yKkNaQyy865NbYs+F7dr4H0LZMVgCj2Le59k6PqbNHoL5ToeaEQUYh6c6yMfVcc6SJxA==",
       "dependencies": {
         "@sindresorhus/is": "^5.2.0",
         "@szmarczak/http-timer": "^5.0.1",
@@ -4550,7 +4550,7 @@
         "responselike": "^3.0.0"
       },
       "engines": {
-        "node": ">=14.16"
+        "node": ">=16"
       },
       "funding": {
         "url": "https://github.com/sindresorhus/got?sponsor=1"
@@ -6648,6 +6648,21 @@
         "@octokit/core": ">=3"
       }
     },
+    "node_modules/octokit/node_modules/@octokit/plugin-retry": {
+      "version": "4.1.6",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-4.1.6.tgz",
+      "integrity": "sha512-obkYzIgEC75r8+9Pnfiiqy3y/x1bc3QLE5B7qvv9wi9Kj0R5tGQFC6QMBg1154WQ9lAVypuQDGyp3hNpp15gQQ==",
+      "dependencies": {
+        "@octokit/types": "^9.0.0",
+        "bottleneck": "^2.15.3"
+      },
+      "engines": {
+        "node": ">= 14"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=3"
+      }
+    },
     "node_modules/octokit/node_modules/@octokit/types": {
       "version": "9.2.3",
       "resolved": "https://registry.npmjs.org/@octokit/types/-/types-9.2.3.tgz",

package.json

@@ -27,10 +27,10 @@
   "dependencies": {
     "@actions/core": "^1.10.0",
     "@actions/github": "^5.1.1",
-    "@octokit/plugin-retry": "^4.1.1",
+    "@octokit/plugin-retry": "^5.0.0",
     "@octokit/request-error": "^2.1.0",
     "ansi-styles": "^6.2.1",
-    "got": "^12.6.0",
+    "got": "^13.0.0",
     "nodemon": "^2.0.22",
     "octokit": "^2.0.16",
     "packageurl-js": "^1.0.2",
@@ -51,7 +51,7 @@
     "@vercel/ncc": "^0.36.1",
     "esbuild-register": "^3.4.2",
     "eslint": "^8.41.0",
-    "eslint-plugin-github": "^4.7.0",
+    "eslint-plugin-github": "^4.8.0",
     "eslint-plugin-jest": "^27.2.1",
     "jest": "^27.5.1",
     "js-yaml": "^4.1.0",

scripts/create_summary.ts

@@ -28,7 +28,9 @@ const defaultConfig: ConfigurationOptions = {
     'pkg:pip/certifi',
     'pkg:pip/[email protected]'
   ],
-  comment_summary_in_pr: true
+  comment_summary_in_pr: true,
+  retry_on_snapshot_warnings: true,
+  retry_on_snapshot_warnings_timeout: 120
 }
 
 const tmpDir = path.resolve(__dirname, '../tmp')

src/config.ts

@@ -39,6 +39,12 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   const base_ref = getOptionalInput('base-ref')
   const head_ref = getOptionalInput('head-ref')
   const comment_summary_in_pr = getOptionalBoolean('comment-summary-in-pr')
+  const retry_on_snapshot_warnings = getOptionalBoolean(
+    'retry-on-snapshot-warnings'
+  )
+  const retry_on_snapshot_warnings_timeout = getOptionalNumber(
+    'retry-on-snapshot-warnings-timeout'
+  )
 
   validatePURL(allow_dependencies_licenses)
   validateLicenses('allow-licenses', allow_licenses)
@@ -55,7 +61,9 @@ function readInlineConfig(): ConfigurationOptionsPartial {
     vulnerability_check,
     base_ref,
     head_ref,
-    comment_summary_in_pr
+    comment_summary_in_pr,
+    retry_on_snapshot_warnings,
+    retry_on_snapshot_warnings_timeout
   }
 
   return Object.fromEntries(
@@ -63,6 +71,12 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   )
 }
 
+function getOptionalNumber(name: string): number | undefined {
+  const value = core.getInput(name)
+  const parsed = z.string().regex(/^\d+$/).transform(Number).safeParse(value)
+  return parsed.success ? parsed.data : undefined
+}
+
 function getOptionalBoolean(name: string): boolean | undefined {
   const value = core.getInput(name)
   return value.length > 0 ? core.getBooleanInput(name) : undefined

src/dependency-graph.ts

@@ -28,7 +28,7 @@ export async function compare({
   const changes = await octo.paginate(
     {
       method: 'GET',
-      url: '/repos/{owner}/{repo}/dependency-graph/compare/{basehead}',
+      url: '/repos/{owner}/{repo}/dependency-graph/compare/{basehead}?includes_dependency_snapshots=true',
       owner,
       repo,
       basehead: `${baseRef}...${headRef}`

src/main.ts

@@ -17,18 +17,60 @@ import {getRefs} from './git-refs'
 import {groupDependenciesByManifest} from './utils'
 import {commentPr} from './comment-pr'
 
+async function delay(ms: number): Promise<void> {
+  return new Promise(resolve => setTimeout(resolve, ms))
+}
+
+async function getComparison(
+  baseRef: string,
+  headRef: string,
+  retryOpts?: {
+    retryUntil: number
+    retryDelay: number
+  }
+): ReturnType<typeof dependencyGraph.compare> {
+  const comparison = await dependencyGraph.compare({
+    owner: github.context.repo.owner,
+    repo: github.context.repo.repo,
+    baseRef,
+    headRef
+  })
+
+  if (comparison.snapshot_warnings.trim() !== '') {
+    core.info(comparison.snapshot_warnings)
+    if (retryOpts !== undefined) {
+      if (retryOpts.retryUntil < Date.now()) {
+        core.info(`Retry timeout exceeded. Proceeding...`)
+        return comparison
+      } else {
+        core.info(`Retrying in ${retryOpts.retryDelay} seconds...`)
+        await delay(retryOpts.retryDelay * 1000)
+        return getComparison(baseRef, headRef, retryOpts)
+      }
+    }
+  }
+
+  return comparison
+}
+
 async function run(): Promise<void> {
   try {
     const config = await readConfig()
 
     const refs = getRefs(config, github.context)
 
-    const comparison = await dependencyGraph.compare({
-      owner: github.context.repo.owner,
-      repo: github.context.repo.repo,
-      baseRef: refs.base,
-      headRef: refs.head
-    })
+    const comparison = await getComparison(
+      refs.base,
+      refs.head,
+      config.retry_on_snapshot_warnings
+        ? {
+            retryUntil:
+              Date.now() + config.retry_on_snapshot_warnings_timeout * 1000,
+            retryDelay: 10
+          }
+        : undefined
+    )
+
     const changes = comparison.changes
     const snapshot_warnings = comparison.snapshot_warnings
 

src/schemas.ts

@@ -47,7 +47,9 @@ export const ConfigurationOptionsSchema = z
     config_file: z.string().optional(),
     base_ref: z.string().optional(),
     head_ref: z.string().optional(),
-    comment_summary_in_pr: z.boolean().default(false)
+    comment_summary_in_pr: z.boolean().default(false),
+    retry_on_snapshot_warnings: z.boolean().default(true),
+    retry_on_snapshot_warnings_timeout: z.number().default(120)
   })
   .superRefine((config, context) => {
     if (config.allow_licenses && config.deny_licenses) {