Build outputs

When changing workflow names or when changing to the new 'dependency-submission'
action, it can be useful to clear existing dependency graph snapshots from previous
submissions. While the old graphs will eventually "age out", the 'clear' option will
submit an empty dependency graph for an existing Job correlator, ensuring that old
dependency graphs don't linger.

.github/workflows/ci-full-check.yml

@@ -9,6 +9,7 @@ on:
   push:
     branches: 
       - main
+      - release/**
     paths:
       - '.github/**'
       - 'dist/**'

.github/workflows/ci-quick-check.yml

@@ -3,7 +3,9 @@ name: CI-quick-check
 on:
   workflow_dispatch:
   push:
-    branches-ignore: main
+    branches-ignore: 
+    - main
+    - release/**
 
 jobs:
   build-distribution:

.github/workflows/ci-verify-outputs.yml

@@ -8,6 +8,7 @@ on:
   push:
     branches: 
       - main
+      - release/**
       - dependabot/**
 
 jobs:

README.md

@@ -547,9 +547,9 @@ You enable GitHub Dependency Graph support by setting the `dependency-graph` act
 | `generate-and-submit` | As per `generate`, but any generated dependency graph snapshots will be submitted at the end of the job. |
 | `download-and-submit` | Download any previously saved dependency graph snapshots, submitting them via the Dependency Submission API. This can be useful to collect all snapshots in a matrix of builds and submit them in one step. |
 
-Example of a simple workflow that generates and submits a dependency graph:
+Example of a CI workflow that generates and submits a dependency graph:
 ```yaml
-name: Submit dependency graph
+name: CI build
 on:
   push:
   
@@ -565,11 +565,12 @@ jobs:
       uses: gradle/gradle-build-action@v2
       with:
         dependency-graph: generate-and-submit
-    - name: Run a build and generate the dependency graph which will be submitted post-job
+    - name: Run the usual CI build (dependency-graph will be generated and submitted post-job)
       run: ./gradlew build
 ```
 
-The `contents: write` permission is not required to generate the dependency graph, but is required in order to submit the graph via the GitHub API. This permission will need to be explicitly enabled in the workflow file for dependency graph submission to succeed.
+The `contents: write` permission is required in order to submit (but not generate) the dependency graph file. 
+Depending on [repository settings](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token), this permission may be available by default or may need to be explicitly enabled in the workflow file (as above).
 
 > [!IMPORTANT]
 > The above configuration will work for workflows that run as a result of commits to a repository branch, 

action.yml

@@ -69,7 +69,7 @@ inputs:
     default: true
 
   dependency-graph:
-    description: Specifies if a GitHub dependency snapshot should be generated for each Gradle build, and if so, how. Valid values are 'disabled' (default), 'generate', 'generate-and-submit' and 'download-and-submit'.
+    description: Specifies if a GitHub dependency snapshot should be generated for each Gradle build, and if so, how. Valid values are 'disabled' (default), 'generate', 'generate-and-submit', 'download-and-submit' and 'clear'.
     required: false
     default: 'disabled'
 

actions/clear-dependency-graph/action.yml

@@ -1,24 +0,0 @@
-name: 'Clear dependency graph for a correlator'
-
-inputs:
-  job-correlator:
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-  - name: Set current timestamp as env variable
-    shell: bash
-    run: echo "NOW=$(date -Iseconds)" >> $GITHUB_ENV
-  - name: Submit empty dependency graph
-    shell: bash
-    run: |
-      curl -L \
-      -X POST \
-      -H "Accept: application/vnd.github+json" \
-      -H "Authorization: Bearer ${{ github.token }}" \
-      -H "X-GitHub-Api-Version: 2022-11-28" \
-      https://api.github.com/repos/${{ github.repository }}/dependency-graph/snapshots \
-      -d '{ "version" : 0, "job" : { "id" : "${{ github.run_id }}", "correlator" : "${{ inputs.job-correlator }} " }, "sha" : "${{ github.sha }}", "ref" : "${{ github.ref }}",  "detector" : { "name" : "GitHub Dependency Graph Gradle Plugin", "version" : "0.0.3", "url" : "https://github.com/gradle/github-dependency-graph-gradle-plugin" }, "manifests" : {}, "scanned" : "${{ env.NOW }}" }'
-  - run: echo "::notice ::Cleared dependency graph for job correlator '${{ inputs.job-correlator }}'"
-    shell: bash

dist/main/index.js

@@ -93650,6 +93650,10 @@ function setup(option) {
         core.exportVariable('GITHUB_DEPENDENCY_GRAPH_SHA', getShaFromContext());
         core.exportVariable('GITHUB_DEPENDENCY_GRAPH_WORKSPACE', layout.workspaceDirectory());
         core.exportVariable('DEPENDENCY_GRAPH_REPORT_DIR', path.resolve(layout.workspaceDirectory(), 'dependency-graph-reports'));
+        if (option === input_params_1.DependencyGraphOption.Clear) {
+            core.exportVariable('DEPENDENCY_GRAPH_INCLUDE_PROJECTS', '');
+            core.exportVariable('DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS', '');
+        }
     });
 }
 exports.setup = setup;
@@ -93663,6 +93667,7 @@ function complete(option) {
                 yield uploadDependencyGraphs();
                 return;
             case input_params_1.DependencyGraphOption.GenerateAndSubmit:
+            case input_params_1.DependencyGraphOption.Clear:
                 yield submitDependencyGraphs(yield uploadDependencyGraphs());
                 return;
         }
@@ -93696,10 +93701,7 @@ function submitDependencyGraphs(dependencyGraphFiles) {
             }
             catch (error) {
                 if (error instanceof request_error_1.RequestError) {
-                    const relativeJsonFile = getRelativePathFromWorkspace(jsonFile);
-                    core.warning(`Failed to submit dependency graph ${relativeJsonFile}.\n` +
-                        "Please ensure that the 'contents: write' permission is available for the workflow job.\n" +
-                        "Note that this permission is never available for a 'pull_request' trigger from a repository fork.");
+                    core.warning(buildWarningMessage(jsonFile, error));
                 }
                 else {
                     throw error;
@@ -93708,6 +93710,17 @@ function submitDependencyGraphs(dependencyGraphFiles) {
         }
     });
 }
+function buildWarningMessage(jsonFile, error) {
+    const relativeJsonFile = getRelativePathFromWorkspace(jsonFile);
+    const mainWarning = `Failed to submit dependency graph ${relativeJsonFile}.\n${String(error)}`;
+    if (error.message === 'Resource not accessible by integration') {
+        return `${mainWarning}
+Please ensure that the 'contents: write' permission is available for the workflow job.
+Note that this permission is never available for a 'pull_request' trigger from a repository fork.
+        `;
+    }
+    return mainWarning;
+}
 function submitDependencyGraphFile(jsonFile) {
     return __awaiter(this, void 0, void 0, function* () {
         const octokit = getOctokit();
@@ -94069,6 +94082,8 @@ function getDependencyGraphOption() {
             return DependencyGraphOption.GenerateAndSubmit;
         case 'download-and-submit':
             return DependencyGraphOption.DownloadAndSubmit;
+        case 'clear':
+            return DependencyGraphOption.Clear;
     }
     throw TypeError(`The value '${val} is not valid for 'dependency-graph. Valid values are: [disabled, generate-and-upload, generate-and-submit, download-and-submit]. The default value is 'disabled'.`);
 }
@@ -94107,6 +94122,7 @@ var DependencyGraphOption;
     DependencyGraphOption[DependencyGraphOption["Generate"] = 1] = "Generate";
     DependencyGraphOption[DependencyGraphOption["GenerateAndSubmit"] = 2] = "GenerateAndSubmit";
     DependencyGraphOption[DependencyGraphOption["DownloadAndSubmit"] = 3] = "DownloadAndSubmit";
+    DependencyGraphOption[DependencyGraphOption["Clear"] = 4] = "Clear";
 })(DependencyGraphOption || (exports.DependencyGraphOption = DependencyGraphOption = {}));
 
 

dist/post/index.js

@@ -93650,6 +93650,10 @@ function setup(option) {
         core.exportVariable('GITHUB_DEPENDENCY_GRAPH_SHA', getShaFromContext());
         core.exportVariable('GITHUB_DEPENDENCY_GRAPH_WORKSPACE', layout.workspaceDirectory());
         core.exportVariable('DEPENDENCY_GRAPH_REPORT_DIR', path.resolve(layout.workspaceDirectory(), 'dependency-graph-reports'));
+        if (option === input_params_1.DependencyGraphOption.Clear) {
+            core.exportVariable('DEPENDENCY_GRAPH_INCLUDE_PROJECTS', '');
+            core.exportVariable('DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS', '');
+        }
     });
 }
 exports.setup = setup;
@@ -93663,6 +93667,7 @@ function complete(option) {
                 yield uploadDependencyGraphs();
                 return;
             case input_params_1.DependencyGraphOption.GenerateAndSubmit:
+            case input_params_1.DependencyGraphOption.Clear:
                 yield submitDependencyGraphs(yield uploadDependencyGraphs());
                 return;
         }
@@ -93696,10 +93701,7 @@ function submitDependencyGraphs(dependencyGraphFiles) {
             }
             catch (error) {
                 if (error instanceof request_error_1.RequestError) {
-                    const relativeJsonFile = getRelativePathFromWorkspace(jsonFile);
-                    core.warning(`Failed to submit dependency graph ${relativeJsonFile}.\n` +
-                        "Please ensure that the 'contents: write' permission is available for the workflow job.\n" +
-                        "Note that this permission is never available for a 'pull_request' trigger from a repository fork.");
+                    core.warning(buildWarningMessage(jsonFile, error));
                 }
                 else {
                     throw error;
@@ -93708,6 +93710,17 @@ function submitDependencyGraphs(dependencyGraphFiles) {
         }
     });
 }
+function buildWarningMessage(jsonFile, error) {
+    const relativeJsonFile = getRelativePathFromWorkspace(jsonFile);
+    const mainWarning = `Failed to submit dependency graph ${relativeJsonFile}.\n${String(error)}`;
+    if (error.message === 'Resource not accessible by integration') {
+        return `${mainWarning}
+Please ensure that the 'contents: write' permission is available for the workflow job.
+Note that this permission is never available for a 'pull_request' trigger from a repository fork.
+        `;
+    }
+    return mainWarning;
+}
 function submitDependencyGraphFile(jsonFile) {
     return __awaiter(this, void 0, void 0, function* () {
         const octokit = getOctokit();
@@ -93937,6 +93950,8 @@ function getDependencyGraphOption() {
             return DependencyGraphOption.GenerateAndSubmit;
         case 'download-and-submit':
             return DependencyGraphOption.DownloadAndSubmit;
+        case 'clear':
+            return DependencyGraphOption.Clear;
     }
     throw TypeError(`The value '${val} is not valid for 'dependency-graph. Valid values are: [disabled, generate-and-upload, generate-and-submit, download-and-submit]. The default value is 'disabled'.`);
 }
@@ -93975,6 +93990,7 @@ var DependencyGraphOption;
     DependencyGraphOption[DependencyGraphOption["Generate"] = 1] = "Generate";
     DependencyGraphOption[DependencyGraphOption["GenerateAndSubmit"] = 2] = "GenerateAndSubmit";
     DependencyGraphOption[DependencyGraphOption["DownloadAndSubmit"] = 3] = "DownloadAndSubmit";
+    DependencyGraphOption[DependencyGraphOption["Clear"] = 4] = "Clear";
 })(DependencyGraphOption || (exports.DependencyGraphOption = DependencyGraphOption = {}));
 
 

src/dependency-graph.ts

@@ -36,6 +36,12 @@ export async function setup(option: DependencyGraphOption): Promise<void> {
         'DEPENDENCY_GRAPH_REPORT_DIR',
         path.resolve(layout.workspaceDirectory(), 'dependency-graph-reports')
     )
+
+    // To clear the dependency graph, we generate an empty graph by excluding all projects and configurations
+    if (option === DependencyGraphOption.Clear) {
+        core.exportVariable('DEPENDENCY_GRAPH_INCLUDE_PROJECTS', '')
+        core.exportVariable('DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS', '')
+    }
 }
 
 export async function complete(option: DependencyGraphOption): Promise<void> {
@@ -47,6 +53,7 @@ export async function complete(option: DependencyGraphOption): Promise<void> {
             await uploadDependencyGraphs()
             return
         case DependencyGraphOption.GenerateAndSubmit:
+        case DependencyGraphOption.Clear: // Submit the empty dependency graph
             await submitDependencyGraphs(await uploadDependencyGraphs())
             return
     }
@@ -78,12 +85,7 @@ async function submitDependencyGraphs(dependencyGraphFiles: string[]): Promise<v
             await submitDependencyGraphFile(jsonFile)
         } catch (error) {
             if (error instanceof RequestError) {
-                const relativeJsonFile = getRelativePathFromWorkspace(jsonFile)
-                core.warning(
-                    `Failed to submit dependency graph ${relativeJsonFile}.\n` +
-                        "Please ensure that the 'contents: write' permission is available for the workflow job.\n" +
-                        "Note that this permission is never available for a 'pull_request' trigger from a repository fork."
-                )
+                core.warning(buildWarningMessage(jsonFile, error))
             } else {
                 throw error
             }
@@ -91,6 +93,18 @@ async function submitDependencyGraphs(dependencyGraphFiles: string[]): Promise<v
     }
 }
 
+function buildWarningMessage(jsonFile: string, error: RequestError): string {
+    const relativeJsonFile = getRelativePathFromWorkspace(jsonFile)
+    const mainWarning = `Failed to submit dependency graph ${relativeJsonFile}.\n${String(error)}`
+    if (error.message === 'Resource not accessible by integration') {
+        return `${mainWarning}
+Please ensure that the 'contents: write' permission is available for the workflow job.
+Note that this permission is never available for a 'pull_request' trigger from a repository fork.
+        `
+    }
+    return mainWarning
+}
+
 async function submitDependencyGraphFile(jsonFile: string): Promise<void> {
     const octokit = getOctokit()
     const jsonContent = fs.readFileSync(jsonFile, 'utf8')

src/input-params.ts

@@ -82,6 +82,8 @@ export function getDependencyGraphOption(): DependencyGraphOption {
             return DependencyGraphOption.GenerateAndSubmit
         case 'download-and-submit':
             return DependencyGraphOption.DownloadAndSubmit
+        case 'clear':
+            return DependencyGraphOption.Clear
     }
     throw TypeError(
         `The value '${val} is not valid for 'dependency-graph. Valid values are: [disabled, generate-and-upload, generate-and-submit, download-and-submit]. The default value is 'disabled'.`
@@ -122,5 +124,6 @@ export enum DependencyGraphOption {
     Disabled,
     Generate,
     GenerateAndSubmit,
-    DownloadAndSubmit
+    DownloadAndSubmit,
+    Clear
 }

src/resources/init-scripts/gradle-build-action.inject-gradle-enterprise.init.gradle

@@ -168,7 +168,7 @@ if (GradleVersion.current() < GradleVersion.version('6.0')) {
     }
 }
 
-void applyPluginExternally(PluginManager pluginManager, String pluginClassName) {
+void applyPluginExternally(def pluginManager, String pluginClassName) {
     def externallyApplied = 'gradle.enterprise.externally-applied'
     def oldValue = System.getProperty(externallyApplied)
     System.setProperty(externallyApplied, 'true')