From 4043c5152bc2e5400f2824c360869055f525ec53 Mon Sep 17 00:00:00 2001 From: edeleon Date: Wed, 16 Oct 2024 16:39:53 -0700 Subject: [PATCH] update dependency-submission workflow --- .github/workflows/dependency-submission.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml index 5f7a390..fa29f6e 100644 --- a/.github/workflows/dependency-submission.yml +++ b/.github/workflows/dependency-submission.yml @@ -1,3 +1,13 @@ +# Workflow: Dependency Graph Submission and Vulnerability Reporting +# +# Trigger: This workflow runs on every merge to the main branch. +# +# Purpose: It generates and submits a dependency graph to the GitHub Dependency Submission API. The graph is used to +# trigger Dependabot Alerts for vulnerable dependencies, and to populate the Dependency Graph insights view in GitHub. +# +# Excludes: +# - Test-only dependencies + name: Dependency Submission on: @@ -21,9 +31,7 @@ jobs: - name: Generate and submit dependency graph uses: gradle/actions/dependency-submission@d156388eb19639ec20ade50009f3d199ce1e2808 # pin@v4 with: - gradle-version: 7.5.1 dependency-graph-exclude-configurations: '.*[Tt]est(Compile|Runtime)Classpath' - dependency-graph-continue-on-failure: true build-scan-publish: true build-scan-terms-of-use-url: "https://gralde.com/help/legal-terms-of-use" build-scan-terms-of-use-agree: "yes"