Skip to content

Commit

Permalink
Add separate dependency-submission workflow
Browse files Browse the repository at this point in the history
With the introduction of `gradle/actions/dependency-submission`, it is now
simpler (and recommended) to use a separate workflow for generation and
submission of GitHub Dependency Graph.

This workflow attempts to detect and submit all dependencies that would
be resolved during build execution, without requiring the execution of any
particular task. In basic testing it appears that the generated dependency
graph contains the same dependencies as before.

A few things to note:
The new workflow will submit a dependency graph with a different "correlator" to
the previous one. This means that duplicate dependencies (and alerts) may appear
until the older graph ages out and is automatically purged. (Period of hours to days).

Manually dismissed Dependabot Alerts may need to be re-dismissed after
switching to the new workflow.
  • Loading branch information
bigdaz authored and marcphilipp committed Apr 16, 2024
1 parent f188238 commit 062214f
Show file tree
Hide file tree
Showing 4 changed files with 25 additions and 11 deletions.
5 changes: 0 additions & 5 deletions .github/actions/main-build/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,18 +5,13 @@ inputs:
required: true
description: Gradle arguments
default: build
dependency-graph:
required: false
description: 'see https://github.com/gradle/gradle-build-action#enable-dependency-graph-generation-for-a-workflow'
default: disabled
runs:
using: "composite"
steps:
- uses: ./.github/actions/setup-test-jdk
- uses: ./.github/actions/run-gradle
with:
arguments: ${{ inputs.arguments }}
dependency-graph: ${{ inputs.dependency-graph }}
- uses: actions/upload-artifact@v4
if: ${{ always() }}
with:
Expand Down
5 changes: 0 additions & 5 deletions .github/actions/run-gradle/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,6 @@ inputs:
required: true
description: Gradle arguments
default: build
dependency-graph:
required: false
description: 'see https://github.com/gradle/gradle-build-action#enable-dependency-graph-generation-for-a-workflow'
default: disabled
runs:
using: "composite"
steps:
Expand All @@ -21,7 +17,6 @@ runs:
env:
JAVA_HOME: ${{ steps.setup-gradle-jdk.outputs.path }}
with:
dependency-graph: ${{ inputs.dependency-graph }}
arguments: |
-Porg.gradle.java.installations.auto-download=false
-Pjunit.develocity.predictiveTestSelection.enabled=${{ github.event_name == 'pull_request' }}
Expand Down
25 changes: 25 additions & 0 deletions .github/workflows/gradle-dependency-submission.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: Gradle Dependency Submission

on:
push:
branches:
- main

permissions:
contents: write

jobs:
dependency-submission:
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@v4
with:
fetch-depth: 1
- name: Setup Java
uses: actions/setup-java@v4
with:
distribution: temurin
java-version: 21
- name: Generate and submit dependency graph
uses: gradle/actions/dependency-submission@v3
1 change: 0 additions & 1 deletion .github/workflows/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@ jobs:
- name: Build
uses: ./.github/actions/main-build
with:
dependency-graph: generate-and-submit
arguments: |
-Ptesting.enableJaCoCo
build
Expand Down

0 comments on commit 062214f

Please sign in to comment.