Use 1.0.0 release of dependency graph plugin

Bumps [com.fasterxml.jackson.dataformat:jackson-dataformat-smile](https://github.com/FasterXML/jackson-dataformats-binary) from 2.15.3 to 2.16.0.
- [Commits](https://github.com/FasterXML/jackson-dataformats-binary/compare/jackson-dataformats-binary-2.15.3...jackson-dataformats-binary-2.16.0)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-smile
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflow-samples/gradle-plugin/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=591855b517fc635b9e04de1d05d5e76ada3f89f5fc76f87978d1b245b4f69225
+distributionSha256Sum=3e1af3ae886920c3ac87f7a91f816c0c7c436f276a6eefdb3da152100fef72ae
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

.github/workflow-samples/gradle-plugin/gradlew

@@ -145,7 +145,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -153,7 +153,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -202,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
+# Collect all arguments for the java command:
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
-#     shell script including quotes and variable substitutions, so put them in
+#     and any embedded shellness will be escaped.
-#     double quotes to make sure that they get re-expanded; and
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
-#   * put everything else in single quotes, so that it's not re-expanded.
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \

.github/workflow-samples/groovy-dsl/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=591855b517fc635b9e04de1d05d5e76ada3f89f5fc76f87978d1b245b4f69225
+distributionSha256Sum=3e1af3ae886920c3ac87f7a91f816c0c7c436f276a6eefdb3da152100fef72ae
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

.github/workflow-samples/groovy-dsl/gradlew

@@ -145,7 +145,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -153,7 +153,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -202,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
+# Collect all arguments for the java command:
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
-#     shell script including quotes and variable substitutions, so put them in
+#     and any embedded shellness will be escaped.
-#     double quotes to make sure that they get re-expanded; and
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
-#   * put everything else in single quotes, so that it's not re-expanded.
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \

.github/workflow-samples/groovy-dsl/settings.gradle

@@ -1,6 +1,6 @@
 plugins {
-    id "com.gradle.enterprise" version "3.15"
+    id "com.gradle.enterprise" version "3.15.1"
-    id "com.gradle.common-custom-user-data-gradle-plugin" version "1.11.2"
+    id "com.gradle.common-custom-user-data-gradle-plugin" version "1.12"
 }
 
 gradleEnterprise {

.github/workflow-samples/java-toolchain/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=591855b517fc635b9e04de1d05d5e76ada3f89f5fc76f87978d1b245b4f69225
+distributionSha256Sum=3e1af3ae886920c3ac87f7a91f816c0c7c436f276a6eefdb3da152100fef72ae
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

.github/workflow-samples/java-toolchain/gradlew

@@ -145,7 +145,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -153,7 +153,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -202,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
+# Collect all arguments for the java command:
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
-#     shell script including quotes and variable substitutions, so put them in
+#     and any embedded shellness will be escaped.
-#     double quotes to make sure that they get re-expanded; and
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
-#   * put everything else in single quotes, so that it's not re-expanded.
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \

.github/workflow-samples/kotlin-dsl/build.gradle.kts

@@ -8,9 +8,9 @@ repositories {
 
 dependencies {
     api("org.apache.commons:commons-math3:3.6.1")
-    implementation("com.google.guava:guava:32.1.2-jre")
+    implementation("com.google.guava:guava:32.1.3-jre")
 
-    testImplementation("org.junit.jupiter:junit-jupiter:5.10.0")
+    testImplementation("org.junit.jupiter:junit-jupiter:5.10.1")
 }
 
 tasks.test {

.github/workflow-samples/kotlin-dsl/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=591855b517fc635b9e04de1d05d5e76ada3f89f5fc76f87978d1b245b4f69225
+distributionSha256Sum=3e1af3ae886920c3ac87f7a91f816c0c7c436f276a6eefdb3da152100fef72ae
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

.github/workflow-samples/kotlin-dsl/gradlew

@@ -145,7 +145,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -153,7 +153,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -202,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
+# Collect all arguments for the java command:
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
-#     shell script including quotes and variable substitutions, so put them in
+#     and any embedded shellness will be escaped.
-#     double quotes to make sure that they get re-expanded; and
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
-#   * put everything else in single quotes, so that it's not re-expanded.
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \

.github/workflow-samples/kotlin-dsl/settings.gradle.kts

@@ -1,6 +1,6 @@
 plugins {
-    id("com.gradle.enterprise") version "3.15"
+    id("com.gradle.enterprise") version "3.15.1"
-    id("com.gradle.common-custom-user-data-gradle-plugin") version "1.11.2"
+    id("com.gradle.common-custom-user-data-gradle-plugin") version "1.12"
 }
 
 gradleEnterprise {

.github/workflow-samples/no-wrapper-gradle-5/build.gradle

@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.build-scan" version "3.15" 
+    id "com.gradle.build-scan" version "3.15.1" 
 }
 
 gradleEnterprise {

.github/workflow-samples/no-wrapper/settings.gradle

@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.enterprise" version "3.15"
+    id "com.gradle.enterprise" version "3.15.1"
 }
 
 gradleEnterprise {

.github/workflows/ci-init-script-check.yml

@@ -20,7 +20,7 @@ jobs:
         distribution: temurin
         java-version: 8
     - name: Setup Gradle
-      uses: gradle/gradle-build-action@v2.8.1 # Use a released version to avoid breakages
+      uses: gradle/gradle-build-action@v2.9.0 # Use a released version to avoid breakages
     - name: Run integration tests
       working-directory: test/init-scripts
       run: ./gradlew check

.github/workflows/ci-quick-check.yml

@@ -22,7 +22,7 @@ jobs:
     - name: Configure Gradle as default for unit test
       uses: ./
       with:
-        gradle-version: 8.3
+        gradle-version: 8.4
     - name: Run tests
       run: |
         npm install

.github/workflows/demo-pr-build-scan-comment.yml

@@ -15,7 +15,7 @@ jobs:
       working-directory: .github/workflow-samples/kotlin-dsl
       run: ./gradlew build --scan
     - name: "Add Build Scan URL as PR comment"
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |

.github/workflows/integ-test-action-inputs-caching.yml

@@ -90,7 +90,7 @@ jobs:
       run: gradle help "-DgradleVersionCheck=${{matrix.gradle}}"
     - name: Check Build Scan url is captured
       if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
           core.setFailed('No Build Scan detected')
@@ -113,7 +113,7 @@ jobs:
       run: gradle help "-DgradleVersionCheck=${{matrix.gradle}}"
     - name: Check Build Scan url is captured
       if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
           core.setFailed('No Build Scan detected')

.github/workflows/integ-test-execution.yml

@@ -86,7 +86,7 @@ jobs:
         arguments: help -DgradleVersionCheck=${{matrix.gradle}}
     - name: Check Build Scan url
       if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
           core.setFailed('No Build Scan detected')    

.github/workflows/integ-test-inject-gradle-enterprise.yml

@@ -21,8 +21,8 @@ env:
   GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
   GRADLE_ENTERPRISE_INJECTION_ENABLED: true
   GRADLE_ENTERPRISE_URL: https://ge.solutions-team.gradle.com
-  GRADLE_ENTERPRISE_PLUGIN_VERSION: 3.15
+  GRADLE_ENTERPRISE_PLUGIN_VERSION: 3.15.1
-  GRADLE_ENTERPRISE_CCUD_PLUGIN_VERSION: 1.11.2
+  GRADLE_ENTERPRISE_CCUD_PLUGIN_VERSION: 1.12
   GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
 
 jobs:
@@ -54,7 +54,7 @@ jobs:
       run: gradle help
     - name: Check Build Scan url
       if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
           core.setFailed('No Build Scan detected')   

.github/workflows/integ-test-provision-gradle-versions.yml

@@ -62,7 +62,7 @@ jobs:
         gradle-version: current
     - name: Check current version output parameter
       if: ${{ !startsWith(steps.gradle-current.outputs.gradle-version , '8.') }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
           core.setFailed('Gradle version parameter not set correctly: value was "${{ steps.gradle-current.outputs.gradle-version }}"')    
@@ -98,7 +98,7 @@ jobs:
         gradle-version: ${{ matrix.gradle }}
     - name: Check output parameter
       if: ${{ steps.setup-gradle.outputs.gradle-version != matrix.gradle }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
           core.setFailed('Gradle version parameter not set correctly: value was "${{ steps.setup-gradle.outputs.gradle-version }}"')    
@@ -108,7 +108,7 @@ jobs:
       run: gradle help "-DgradleVersionCheck=${{matrix.gradle}}"
     - name: Check Build Scan url
       if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
           core.setFailed('No Build Scan detected')    

.github/workflows/integ-test-restore-configuration-cache.yml

@@ -60,7 +60,7 @@ jobs:
       working-directory: .github/workflow-samples/groovy-dsl
       run: ./gradlew test --configuration-cache
     - name: Check that configuration-cache was used
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
           const fs = require('fs')
@@ -156,7 +156,7 @@ jobs:
       working-directory: .github/workflow-samples/kotlin-dsl
       run: ./gradlew test --configuration-cache
     - name: Check that configuration-cache was used
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
           const fs = require('fs')

.tool-versions

@@ -1,3 +1,3 @@
 # Configuration file for asdf version manager
 nodejs 16.18.1
-gradle 8.3
+gradle 8.4

README.md

@@ -19,7 +19,7 @@ These features work both when Gradle is executed via the `gradle-build-action` a
 
 ## Use the action to setup Gradle
 
-The recommended way to use the `gradle-build-action` is in an initial "Setup Gradle" step, with subsquent steps invoking Gradle directly with a `run` step. This makes the action minimally invasive, and allows a workflow to configure and execute a Gradle execution in any way.
+The recommended way to use the `gradle-build-action` is in an initial "Setup Gradle" step, with subsequent steps invoking Gradle directly with a `run` step. This makes the action minimally invasive, and allows a workflow to configure and execute a Gradle execution in any way.
 
 The `gradle-build-action` works by configuring environment variables and by adding a set of Gradle init-scripts to the Gradle User Home. These will apply to all Gradle executions on the runner, no matter how Gradle is invoked. 
 This means that if you have an existing workflow that executes Gradle with a `run` step, you can add an initial "Setup Gradle" Step to benefit from caching, build-scan capture and other features of the gradle-build-action.
@@ -35,7 +35,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - uses: actions/setup-java@v3
       with:
         distribution: temurin
@@ -84,7 +84,7 @@ jobs:
   gradle-rc:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - uses: actions/setup-java@v3
       with:
         distribution: temurin
@@ -174,7 +174,7 @@ Using either of these mechanisms may interfere with the caching provided by this
 ### Cache debugging and analysis
 
 A report of all cache entries restored and saved is printed to the Job Summary when saving the cache entries. 
-This report can provide valuable insignt into how much cache space is being used.
+This report can provide valuable insight into how much cache space is being used.
 
 It is possible to enable additional debug logging for cache operations. You do via the `GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED` environment variable:
 
@@ -213,7 +213,7 @@ In certain cases a particular section of Gradle User Home will be too large to m
 ### Cache keys
 
 The actual content of the Gradle User Home after a build is the result of many factors, including:
-- Core Gradle build files (`settngs.gradle[.kts]`, `build.gradle[.kts]`, `gradle.properties`)
+- Core Gradle build files (`settings.gradle[.kts]`, `build.gradle[.kts]`, `gradle.properties`)
 - Associated Gradle configuration files (`gradle-wrapper.properties`, `dependencies.toml`, etc)
 - The entire content of `buildSrc` or any included builds that provide plugins.
 - The entire content of the repository, in the case of the local build cache.
@@ -300,7 +300,7 @@ without writing private cache entries that could lead to evicting shared entries
 
 If you have other long-lived development branches that would benefit from writing to the cache, 
 you can configure these by overriding the `cache-read-only` action parameter. 
-See [Using the caches read-only](#using-the-caches-read-only) for more details.
+See [Using the cache read-only](#using-the-cache-read-only) for more details.
 
 Similarly, you could use `cache-read-only` for certain jobs in the workflow, and instead have these jobs reuse the cache content from upstream jobs.
 
@@ -376,7 +376,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout project sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Setup Gradle
       uses: gradle/gradle-build-action@v2
     - name: Run build with Gradle wrapper
@@ -410,7 +410,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout project sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Setup Gradle
       uses: gradle/gradle-build-action@v2
     - name: Run build with Gradle wrapper
@@ -438,7 +438,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - uses: actions/setup-java@v3
       with:
         distribution: temurin
@@ -533,7 +533,7 @@ The `gradle-build-action` has support for submitting a [GitHub Dependency Graph]
 
 The dependency graph snapshot is generated via integration with the [GitHub Dependency Graph Gradle Plugin](https://plugins.gradle.org/plugin/org.gradle.github-dependency-graph-gradle-plugin), and saved as a workflow artifact. The generated snapshot files can be submitted either in the same job, or in a subsequent job (in the same or a dependent workflow).
 
-The generated dependency graph snapshot reports all of the dependencies that were resolved during a bulid execution, and is used by GitHub to generate [Dependabot Alerts](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts) for vulnerable dependencies, as well as to populate the [Dependency Graph insights view](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#viewing-the-dependency-graph).
+The generated dependency graph snapshot reports all of the dependencies that were resolved during a build execution, and is used by GitHub to generate [Dependabot Alerts](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts) for vulnerable dependencies, as well as to populate the [Dependency Graph insights view](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#viewing-the-dependency-graph).
 
 ## Enable Dependency Graph generation for a workflow
  
@@ -559,7 +559,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Setup Gradle to generate and submit dependency graphs
       uses: gradle/gradle-build-action@v2
       with:
@@ -603,7 +603,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Setup Gradle to generate and submit dependency graphs
       uses: gradle/gradle-build-action@v2
       with:
@@ -646,7 +646,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Setup Gradle to generate and submit dependency graphs
       uses: gradle/gradle-build-action@v2
       with:
@@ -678,7 +678,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Setup Gradle to generate and submit dependency graphs
       uses: gradle/gradle-build-action@v2
       with:
@@ -702,7 +702,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Setup Gradle to generate and submit dependency graphs
       uses: gradle/gradle-build-action@v2
       with:
@@ -735,20 +735,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Setup Gradle to generate and submit dependency graphs
       uses: gradle/gradle-build-action@v2
       with:
         dependency-graph: generate # Only generate in this job
     - name: Run a build, generating the dependency graph snapshot which will be submitted
       run: ./gradlew build
-
-  dependency-review:
-    needs: build
-    runs-on: ubuntu-latest
-    - name: Perform dependency review
-      uses: actions/dependency-review-action@v3
-      
 ```
 
 ***Dependent workflow file***
@@ -816,6 +809,21 @@ limited to Gradle "8.1.0" and later:
 To use this plugin with versions of Gradle older than "8.1.0", you'll need to invoke Gradle with the
 configuration-cache disabled.
 
+## Reducing storage costs for saved dependency graph artifacts
+
+When `generate` or `generate-and-submit` is used with the action, the dependency graph that is generated is stored as a workflow artifact. 
+By default, these artifacts are retained for a period of 30 days (or as configured for the repository).
+To reduce storage costs for these artifacts, you can set the `artifact-retention-days` value to a lower number.
+
+```yaml
+    steps:
+    - name: Generate dependency graph, but only retain artifact for one day
+      uses: gradle/gradle-build-action@v2
+      with:
+        dependency-graph: generate
+        artifact-retention-days: 1
+```
+
 # Gradle Enterprise plugin injection
 
 The `gradle-build-action` provides support for injecting and configuring the Gradle Enterprise Gradle plugin into any Gradle build, without any modification to the project sources.
@@ -835,21 +843,21 @@ name: Run build with Gradle Enterprise injection
 env:
   GRADLE_ENTERPRISE_INJECTION_ENABLED: true
   GRADLE_ENTERPRISE_URL: https://ge.gradle.org
-  GRADLE_ENTERPRISE_PLUGIN_VERSION: 3.15
+  GRADLE_ENTERPRISE_PLUGIN_VERSION: 3.15.1
   GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_KEY }} # Required to publish scans to ge.gradle.org
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Setup Gradle
       uses: gradle/gradle-build-action@v2
     - name: Run a Gradle build with Gradle Enterprise injection enabled
       run: ./gradlew build
 ```
 
-This configuration will automatically apply `v3.15` of the [Gradle Enterprise Gradle plugin](https://docs.gradle.com/enterprise/gradle-plugin/), and publish build scans to https://ge.gradle.org.
+This configuration will automatically apply `v3.15.1` of the [Gradle Enterprise Gradle plugin](https://docs.gradle.com/enterprise/gradle-plugin/), and publish build scans to https://ge.gradle.org.
 
 Note that the `ge.gradle.org` server requires authentication in order to publish scans. The provided `GRADLE_ENTERPRISE_ACCESS_KEY` isn't required by the Gradle Enterprise injection script, 
 but will be used by the GE plugin in order to authenticate with the server.

action.yml

@@ -54,6 +54,11 @@ inputs:
   #      gradle-home-cache-excludes: |
   #           caches/build-cache-1
 
+  gradle-home-cache-cleanup:
+    description: When 'true', the action will attempt to remove any stale/unused entries from the Gradle User Home prior to saving to the GitHub Actions cache.
+    required: false
+    default: false
+
   arguments:
     description: Gradle command line arguments (supports multi-line input)
     required: false
@@ -68,6 +73,10 @@ inputs:
     required: false
     default: 'disabled'
 
+  artifact-retention-days:
+    description: Specifies the number of days to retain any artifacts generated by the action. If not set, the default retention settings for the repository will apply.
+    required: false
+
   # EXPERIMENTAL & INTERNAL ACTION INPUTS
   # The following action properties allow fine-grained tweaking of the action caching behaviour.
   # These properties are experimental and not (yet) designed for production use, and may change without notice in a subsequent release of `gradle-build-action`.
@@ -80,10 +89,6 @@ inputs:
     description: Used to uniquely identify the current job invocation. Defaults to the matrix values for this job; this should not be overridden by users (INTERNAL).
     required: false
     default: ${{ toJSON(matrix) }}
-  gradle-home-cache-cleanup:
-    description: When 'true', the action will attempt to remove any stale/unused entries from the Gradle User Home prior to saving to the GitHub Actions cache.
-    required: false
-    default: false
 
   github-token:
     description: The GitHub token used to authenticate when submitting via the Dependency Submission API.

package.json

@@ -36,7 +36,7 @@
     "@actions/exec": "1.1.1",
     "@actions/github": "5.1.1",
     "@actions/glob": "0.4.0",
-    "@actions/http-client": "2.1.1",
+    "@actions/http-client": "2.2.0",
     "@actions/tool-cache": "2.0.1",
     "@octokit/rest": "19.0.13",
     "@octokit/webhooks-types": "7.3.1",
@@ -44,19 +44,19 @@
   },
   "devDependencies": {
     "@types/node": "16.18.38",
-    "@types/jest": "29.5.5",
+    "@types/jest": "29.5.8",
-    "@types/unzipper": "0.10.7",
+    "@types/unzipper": "0.10.9",
-    "@typescript-eslint/parser": "6.7.3",
+    "@typescript-eslint/parser": "6.12.0",
-    "@vercel/ncc": "0.38.0",
+    "@vercel/ncc": "0.38.1",
-    "eslint": "8.50.0",
+    "eslint": "8.54.0",
-    "eslint-plugin-github": "4.10.0",
+    "eslint-plugin-github": "4.10.1",
-    "eslint-plugin-jest": "27.4.0",
+    "eslint-plugin-jest": "27.6.0",
-    "eslint-plugin-prettier": "5.0.0",
+    "eslint-plugin-prettier": "5.0.1",
     "jest": "29.7.0",
     "js-yaml": "4.1.0",
     "patch-package": "8.0.0",
-    "prettier": "3.0.3",
+    "prettier": "3.1.0",
     "ts-jest": "29.1.1",
-    "typescript": "5.2.2"
+    "typescript": "5.3.2"
   }
 }

src/dependency-graph.ts

@@ -11,7 +11,7 @@ import * as path from 'path'
 import fs from 'fs'
 
 import * as layout from './repository-layout'
-import {DependencyGraphOption, getJobMatrix} from './input-params'
+import {DependencyGraphOption, getJobMatrix, getArtifactRetentionDays} from './input-params'
 
 const DEPENDENCY_GRAPH_ARTIFACT = 'dependency-graph'
 
@@ -60,7 +60,9 @@ async function uploadDependencyGraphs(): Promise<string[]> {
     core.info(`Uploading dependency graph files: ${relativeGraphFiles}`)
 
     const artifactClient = artifact.create()
-    artifactClient.uploadArtifact(DEPENDENCY_GRAPH_ARTIFACT, graphFiles, workspaceDirectory)
+    artifactClient.uploadArtifact(DEPENDENCY_GRAPH_ARTIFACT, graphFiles, workspaceDirectory, {
+        retentionDays: getArtifactRetentionDays()
+    })
 
     return graphFiles
 }

src/input-params.ts

@@ -88,6 +88,23 @@ export function getDependencyGraphOption(): DependencyGraphOption {
     )
 }
 
+export function getArtifactRetentionDays(): number {
+    const val = core.getInput('artifact-retention-days')
+    return parseNumericInput('artifact-retention-days', val, 0)
+    // Zero indicates that the default repository settings should be used
+}
+
+export function parseNumericInput(paramName: string, paramValue: string, paramDefault: number): number {
+    if (paramValue.length === 0) {
+        return paramDefault
+    }
+    const numericValue = parseInt(paramValue)
+    if (isNaN(numericValue)) {
+        throw TypeError(`The value '${paramValue}' is not a valid numeric value for '${paramName}'.`)
+    }
+    return numericValue
+}
+
 function getBooleanInput(paramName: string, paramDefault = false): boolean {
     const paramValue = core.getInput(paramName)
     switch (paramValue.toLowerCase().trim()) {

src/resources/init-scripts/gradle-build-action.github-dependency-graph-gradle-plugin-apply.groovy

@@ -3,7 +3,7 @@ buildscript {
     maven { url "https://plugins.gradle.org/m2/" }
   }
   dependencies {
-    classpath "org.gradle:github-dependency-graph-gradle-plugin:0.4.1"
+    classpath "org.gradle:github-dependency-graph-gradle-plugin:1.0.0"
   }
 }
 apply plugin: org.gradle.github.GitHubDependencyGraphPlugin

test/init-scripts/build.gradle

@@ -20,7 +20,7 @@ dependencies {
     testImplementation ('io.ratpack:ratpack-groovy-test:1.9.0') {
         exclude group: 'org.codehaus.groovy', module: 'groovy-all'
     }
-    testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.15.2'
+    testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.16.0'
 }
 
 test {

test/init-scripts/settings.gradle

@@ -1,6 +1,6 @@
 plugins {
-    id "com.gradle.enterprise" version "3.15"
+    id "com.gradle.enterprise" version "3.15.1"
-    id "com.gradle.common-custom-user-data-gradle-plugin" version "1.11.2"
+    id "com.gradle.common-custom-user-data-gradle-plugin" version "1.12"
 }
 
 gradleEnterprise {

test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/BaseInitScriptTest.groovy

@@ -16,8 +16,8 @@ import java.nio.file.Files
 import java.util.zip.GZIPOutputStream
 
 class BaseInitScriptTest extends Specification {
-    static final String GE_PLUGIN_VERSION = '3.15'
+    static final String GE_PLUGIN_VERSION = '3.15.1'
-    static final String CCUD_PLUGIN_VERSION = '1.11.2'
+    static final String CCUD_PLUGIN_VERSION = '1.12'
 
     static final TestGradleVersion GRADLE_3_X = new TestGradleVersion(GradleVersion.version('3.5.1'), 7, 9)
     static final TestGradleVersion GRADLE_4_X = new TestGradleVersion(GradleVersion.version('4.10.3'), 7, 10)
@@ -26,7 +26,7 @@ class BaseInitScriptTest extends Specification {
     static final TestGradleVersion GRADLE_6_X = new TestGradleVersion(GradleVersion.version('6.9.4'), 8, 15)
     static final TestGradleVersion GRADLE_7_X = new TestGradleVersion(GradleVersion.version('7.6.2'), 8, 19)
     static final TestGradleVersion GRADLE_8_0 = new TestGradleVersion(GradleVersion.version('8.0.2'), 8, 19)
-    static final TestGradleVersion GRADLE_8_X = new TestGradleVersion(GradleVersion.version('8.3'), 8, 19)
+    static final TestGradleVersion GRADLE_8_X = new TestGradleVersion(GradleVersion.version('8.4'), 8, 19)
 
     static final List<TestGradleVersion> ALL_VERSIONS = [
         GRADLE_3_X, // First version where TestKit supports environment variables

test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/TestBuildResultRecorder.groovy

@@ -154,7 +154,7 @@ class TestBuildResultRecorder extends BaseInitScriptTest {
         when:
         settingsFile.text = """
             plugins {
-                id 'com.gradle.enterprise' version '3.15' apply(false)
+                id 'com.gradle.enterprise' version '3.15.1' apply(false)
             }
             gradle.settingsEvaluated {
                 apply plugin: 'com.gradle.enterprise'

test/jest/cache-cleanup.test.ts

@@ -49,7 +49,7 @@ test('will cleanup unused gradle versions', async () => {
 
     const gradle802 = path.resolve(gradleUserHome, "caches/8.0.2")
     const wrapper802 = path.resolve(gradleUserHome, "wrapper/dists/gradle-8.0.2-bin")
-    const gradleCurrent = path.resolve(gradleUserHome, "caches/8.3")
+    const gradleCurrent = path.resolve(gradleUserHome, "caches/8.4")
 
     expect(fs.existsSync(gradle802)).toBe(true)
     expect(fs.existsSync(wrapper802)).toBe(true)

test/jest/input-params.test.ts

@@ -0,0 +1,22 @@
+import * as inputParams from '../../src/input-params'
+
+describe('input params', () => {
+    describe('parses numeric input', () => {
+        it('uses default value', () => {
+            const val = inputParams.parseNumericInput('param-name', '', 88)
+            expect(val).toBe(88)
+        })
+        it('parses numeric input', () => {
+            const val = inputParams.parseNumericInput('param-name', '34', 88)
+            expect(val).toBe(34)
+        })
+        it('fails on non-numeric input', () => {
+            const t = () => {
+                inputParams.parseNumericInput('param-name', 'xyz', 88)
+            };
+
+            expect(t).toThrow(TypeError)
+            expect(t).toThrow("The value 'xyz' is not a valid numeric value for 'param-name'.")
+        })
+    })
+})