# Dependency Management

We use [Sonatype Lifecycle](/content/products/open-source-security-dependency-management/index.html) to ensure our Community Projects use only the best open-source dependencies.

Each project should include Sonatype Lifecycle analysis scans during each Pull Request and upon each Release.

You can check out the real world implementation for this handbook - here [for Continuous Integration](https://github.com/sonatype-nexus-community/the-cla/blob/main/.github/workflows/ci.yml) and here [for Release](https://github.com/sonatype-nexus-community/the-cla/blob/main/.github/workflows/release.yml).

When implementing your scans, do reference the [official Sonatype Lifecycle documentation](https://help.sonatype.com/en/analysis.html) that relates to the languages and ecosystems in the project.

## Example GitHub Action for Continuous Integration [Heading self-link](https://contribute.sonatype.com/docs/standards/dependency-management/#example-github-action-for-continuous-integration)

```yaml
env:
    LC_APPLICATION_ID: community-handbook.sonatype.com # <-- Our standard is to use the GitHub Repository Name

jobs:
    release:
        ...
        steps:
        ...
            - name: Sonatype Lifecycle Evaluation
              id: evaluate
              uses: sonatype/actions/evaluate@v1.0.1
              with:
                  iq-server-url: ${{ vars.SONATYPE_PLATFORM_URL }}
                  username: ${{ secrets.SONATYPE_LIFECYCLE_USERNAME }}
                  password: ${{ secrets.SONATYPE_LIFECYCLE_PASSWORD }}
                  application-id: ${{ env.LC_APPLICATION_ID }}
                  scan-targets: '.'
                  stage: build # <!-- Set to 'build' for the Continuous Integration
    ...
```

## Example GitHub Action for Release [Heading self-link](https://contribute.sonatype.com/docs/standards/dependency-management/#example-github-action-for-release)

```yaml
env:
    LC_APPLICATION_ID: community-handbook.sonatype.com # <-- Our standard is to use the GitHub Repository Name

jobs:
    release:
        ...
        steps:
        ...
            - name: Sonatype Lifecycle Evaluation
              id: evaluate
              uses: sonatype/actions/evaluate@v1.0.1
              with:
                  iq-server-url: ${{ vars.SONATYPE_PLATFORM_URL }}
                  username: ${{ secrets.SONATYPE_LIFECYCLE_USERNAME }}
                  password: ${{ secrets.SONATYPE_LIFECYCLE_PASSWORD }}
                  application-id: ${{ env.LC_APPLICATION_ID }}
                  scan-targets: '.'
                  stage: release # <!-- Set to 'release' for the Release Workflow
    ...
```

Last modified September 2, 2024: [typo (7c452a8)](https://github.com/sonatype-nexus-community/contribute.sonatype.com/commit/7c452a879504dc2c8386ae02237db23638ce17d3)