Set up Dependency graph for Dependencies and Dependents about android-fhir HOT 4 CLOSED

OK, so according to https://github.com/marketplace?query=dependency+submission+gradle, there are apparently (at least) 2-3 choices here:

1. https://github.com/marketplace/actions/gradle-buildjet-action
2. https://github.com/marketplace/actions/gradle-build-action
3. https://github.com/marketplace/actions/gradle-dependency-submission

The 1. looks, to me, like an extremely suspicious rip-off from 2. so let's stay clear of that! (Note it has 0 Stars, and the exact same README... that's kind of textbook what one would do if I tried to take over a popular GitHub Action for malicious purposes! It may also be harmless, of course; but let's not find out.)

The 2. looks great, albeit a bit.. overwhelming? It does lots of great looking stuff (optimized caching; thank you!) - but I'm not 100% convinced we could use it JUST to Generate and Submit a GitHub Dependency Graph ... maybe, or maybe not; I have a hunch that until we sort out that whole Build with Google Kokoro vs. GitHub Action can of worms, it could be overkill. Its doc also refers to https://github.com/gradle/github-dependency-graph-gradle-plugin, with a README that says support coming in a future release, which doesn't inspire confidence in me (and each new Gradle plugin can be a PITA for future upgrades; I've been there).

The 3. looks simpler and focused only on dependency submission, and is apparently essentially based on just e.g. ./gradlew demo:dependencies - without requiring adding any additional Gradle plugins - I like the sound of that! Hear Gradle 7.5 or newer is required but that's cool because we're on 8.0. I'll therefore further pursue this choice!

from android-fhir.

I'm dumb... 😺 this project already uses 2. (I just didn't see it at first, because it's in an "included" YAML); #2208 enables it.

from android-fhir.

Im not sure if the Gradle Dependency Plugin supports Kotlin: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph#supported-package-ecosystems

from android-fhir.

Im not sure if the Gradle Dependency Plugin supports Kotlin: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph#supported-package-ecosystems

I have a hunch that it will work, because this Kotlin Android project ultimately still just manages it's dependencies using what the doc you are linking to refers to as the Maven Ecosystem...

Review #2208 and if OK for you merge it, and we'll find out!

from android-fhir.