dependency submission Integrating the dependency-review-action example doesn't seem to require a second job

[tspascoal]

dependency submission Integrating the dependency-review-action example doesn't seem to require a second job

[bigdaz]

The dependency-submission action is currently a thin wrapper over gradle/actions/setup-gradle, setting dependency-graph: generate-and-submit as a default.

When executed the action will:

1. Configure Gradle with an init-script that will write a dependency graph file to disk for each Gradle execution.
2. Execute Gradle with a "resolve all dependencies" task. This will generate a dependency graph file.
3. In the post-action, submit the dependency graph file

The third step happens at the end of the job. This is why you need to configure dependency review in a separate Job.

Note that using download-and-submit will indeed submit the dependency graph immediately, but it will not generate the dependency graph. This is designed for workflows where the Job generating the graph doesn't have sufficient permissions to submit the graph, so it assumes that the graph has been generated and uploaded in a previous job (or workflow).

You can read more about the various permutations here.

[tspascoal]

Yes, you are completely right. I missed this on my analysis.

This leads me to another question, why would we want to submit this as a post job and not on the dependency submission action itself? this would allow dependency-review-action to run immediately without adding the latency to wait for another job to be schedule (and the added cost)

I understand this is layered on top of gradle/actions/setup-gradle which was built (and build-graddle before that) with the assumption/need that gradle would be invoked after the setup/build. But since in this case we are skipping the graddle invocation such optimization would be very nice.

Happy to open an enhancement issue if you think this makes sense.

[bigdaz]

The only reason for submitting the dependency graph in the post-action job is because this action is a composite action reusing the implementation of setup-gradle.

At some stage I'd like to migrate dependency-submission to be a Typescript action in it's own right. That would permit improvements like submitting the dependency graph immediately on generation.

[bigdaz]

This behaviour will be changed with #123