From 360fe30a225c10acb6e82308bb7ace1c98036d40 Mon Sep 17 00:00:00 2001 From: Asterios Raptis Date: Wed, 28 Oct 2026 17:00:42 +0100 Subject: [PATCH] ci: submit the Gradle dependency graph to GitHub (#1) GitHub reads no Gradle build, so its dependency graph and Dependabot did not see this build's dependencies. The workflow submits what Gradle resolves on a push to develop, master, and by hand, with every action pinned by commit SHA, gradle/actions 6.4.1, and runtimeClasspath as 'runtime'. The pattern of astrapi69/mystic-crypt-ui#634. Rehearsed locally with the init scripts of gradle/actions 6.4.1 on develop: the graph has 81 packages, 0 of them with scope runtime. Closes #1 --- .github/workflows/dependency-submission.yml | 40 +++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .github/workflows/dependency-submission.yml diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml new file mode 100644 index 0000000..338bddb --- /dev/null +++ b/.github/workflows/dependency-submission.yml @@ -0,0 +1,40 @@ +# Submits the dependency graph Gradle resolves to GitHub, so the repository's dependency graph and +# Dependabot see this build's dependencies; GitHub reads no Gradle build by itself. 'runtime' marks +# runtimeClasspath, everything else - tests, build tools - is 'development'. The same pattern as +# astrapi69/mystic-crypt-ui#634. + +name: Dependency submission + +on: + push: + branches: [ develop, master ] + # by hand, to submit another branch + workflow_dispatch: + +permissions: + contents: write # the dependency submission API + +jobs: + submit: + + runs-on: ubuntu-latest + + steps: + - name: Checkout sources + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Setup Java + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 + with: + java-version: '17' + distribution: 'temurin' + - name: Submit the dependency graph + # 6.4.1 fixes GHSA-chpw-2mqm-95cc, which concerns the two-workflow download-and-submit setup + uses: gradle/actions/dependency-submission@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1 + env: + DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONS: '^runtimeClasspath$' + with: + # The graph plugin registers its resolving task once the projects are evaluated, which + # configure-on-demand does not wait for + # The build reads the credentials of the shut-down OSSRH while configuring; the graph needs + # none, so placeholders let it configure + additional-arguments: -Dorg.gradle.configureondemand=false -PossrhUsername=unused -PossrhPassword=unused