From 454837bcecd7c8c01f7372c84966d2da2bcfc21c Mon Sep 17 00:00:00 2001 From: Alex Abashev Date: Fri, 25 Sep 2026 18:54:51 +0300 Subject: [PATCH] Submit only runtimeClasspath to the dependency graph The submission put every configuration the build resolves into the graph: buildSrc with JReleaser, the root buildscript's plugins, annotation processors and test dependencies, 452 packages in all. DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONS only labelled everything but runtimeClasspath as 'development'. Dependabot alerts on development dependencies all the same, and the auto-triage rule the comment counted on to dismiss them was never created, so all 24 open alerts, the critical tika-core one among them, are for build tooling. Filter the graph instead. Everything that ships is built from runtimeClasspath, so the graph keeps the same 24 runtime packages and drops the rest. With no scope parameter the packages carry no scope, which nothing here reads. --- .github/workflows/dependency-submission.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml index b79245174..f25a4ff13 100644 --- a/.github/workflows/dependency-submission.yml +++ b/.github/workflows/dependency-submission.yml @@ -21,8 +21,11 @@ jobs: - name: Submit Dependency Snapshot uses: gradle/actions/dependency-submission@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 - env: - # Only runtime-classpath dependencies of the published modules count as 'runtime'; - # annotation processors, Gradle plugin classpaths and test-only dependencies are - # reported as 'development' so Dependabot auto-triage rules can dismiss their alerts. - DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONS: 'runtimeClasspath' + with: + # Only what ships goes into the graph. The published jars, the native image and the IntelliJ and + # Eclipse plugins are all built from runtimeClasspath, and the formatter configuration the IntelliJ + # plugin also bundles is open-java-format's runtimeClasspath again. The name is matched whole, so + # testRuntimeClasspath stays out. Without the filter the graph holds every configuration the build + # resolves, buildSrc with JReleaser and the root buildscript's plugins included, and Dependabot + # raises alerts for all of it: marking a dependency 'development' does not stop an alert. + dependency-graph-include-configurations: 'runtimeClasspath'