Submit only runtimeClasspath to the dependency graph - #82
Merged
Merged
Conversation
The submission put every configuration the build resolves into the graph: buildSrc with JReleaser, the root buildscript's plugins, annotation processors and test dependencies, 452 packages in all. DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONS only labelled everything but runtimeClasspath as 'development'. Dependabot alerts on development dependencies all the same, and the auto-triage rule the comment counted on to dismiss them was never created, so all 24 open alerts, the critical tika-core one among them, are for build tooling. Filter the graph instead. Everything that ships is built from runtimeClasspath, so the graph keeps the same 24 runtime packages and drops the rest. With no scope parameter the packages carry no scope, which nothing here reads.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All 24 open Dependabot alerts, the critical
tika-coreone (#18) among them, are for build tooling that never ships. This limits the submitted dependency graph toruntimeClasspath.Why the current setting does not help.
dependency-submissionresolves every configuration of every project and submits all of it: 452 packages, among them buildSrc'sbuildScriptClasspathandcompileClasspath(JReleaser 1.26.0 and itstika-core,httpclient5,httpcore5-h2) and the root project's buildscriptclasspath(jsoup, Jackson 2.20.2 and 2.21.0,plexus-utils).DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONSdoes not filter anything: it only labels each packageruntimeordevelopment. Dependabot raises alerts for both, and the auto-triage rule the old comment counted on to dismiss the development ones was never created.Why
runtimeClasspathis enough. Everything that ships is built from it: the published jars and their POMs, the native image (open-java-format-nativecompiles fromruntimeClasspath), the Eclipse plugin (embeds it), and the IntelliJ plugin (bundles it, and itsformatterconfiguration resolves the same 14 packages as:open-java-format'sruntimeClasspath). The plugin matches the regex against the whole configuration name, sotestRuntimeClasspathstays out.The scope label goes: with only runtime configurations in the graph it would say nothing, and without a scope parameter the plugin writes none. Nothing in this repository reads it.
Checked locally with the GitHub Dependency Graph Gradle Plugin 1.4.2 that
gradle/actionsv6.3.0 runs, applied through an init script to:ForceDependencyResolutionPlugin_resolveAllDependencies:Without the filter the local run reproduces the snapshot of the last submission on main (run 36137459303) package for package, except the platform-specific JetBrains Runtime. The action passes the input to Gradle as
DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS(sources/src/dependency-graph.tsat the pinned SHA).The workflow runs only on pushes to main, so this PR's checks do not exercise it. After the merge the next run replaces the snapshot under the same correlator (
submit_dependency_graph-full-build), and the 24 alerts should close as fixed.