Submit the Gradle dependency graph to GitHub #1
Description
What is the case
GitHub reads no Gradle build by itself, so neither its dependency graph nor Dependabot knows what this build depends on. A read-only survey of the dependency graph on 2026-10-28 found no manifest with Gradle dependencies here, and the same in all 178 Gradle builds of the family (astrapi69/mystic-crypt-ui#634). There, Dependabot never saw commons-beanutils 1.9.4 in a released application.
The pattern (as in astrapi69/mystic-crypt-ui#634)
.github/workflows/dependency-submission.ymlrunsgradle/actions/dependency-submissionon a push todevelop,master, and by hand.- Every action is pinned by commit SHA;
gradle/actionsis 6.4.1, which fixes GHSA-chpw-2mqm-95cc. That advisory concerns the two-workflowdownload-and-submitsetup, which this workflow does not use. runtimeClasspathgets the scoperuntime; everything else, tests and build tools, getsdevelopment.- Configure-on-demand is off for this run: the graph plugin registers its resolving task once the projects are evaluated.
- Java 17, as this repository's CI uses.
The build reads the credentials of the shut-down OSSRH while it configures, so the workflow passes placeholders for ossrhUsername, ossrhPassword. A move to the Central Portal, as astrapi69/xstream-extensions#3 did, makes them unnecessary.
Rehearsed locally with the init scripts of gradle/actions 6.4.1 on develop: the graph has 81 packages, 0 of them with scope runtime.
Done when
The first run after the merge submits the graph, and GitHub's dependency graph for this repository shows the Gradle dependencies.
Activity
Merge pull request #2 from astrapi69/ci/dependency-submission
astrapi69 commentedon Oct 28, 2026
Done, measured 2026-10-28 after the merge (#2):
develop(run 40721743724, push of 34167b7): green, 1 snapshot(s) submitted (gh run view 40721743724 --log).gh api repos/astrapi69/throwable/dependency-graph/sbom).