gradle/actions
1
0
Fork 0
mirror of https://github.com/gradle/actions.git synced 2025-04-20 09:49:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

Introduce dependency graph params (#304)

Browse Source 
Fixes #193
This commit is contained in:
Daz DeBoer 2024-07-19 19:40:42 -06:00 committed by GitHub
commit 2289da045c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
6 changed files with 156 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
.github/workflows/integ-test-dependency-submission.yml vendored
View File

@ -262,6 +262,40 @@ jobs:
exit 1
fi
with-includes-and-excludes:
runs-on: ubuntu-latest # Test is not compatible with Windows
steps:
- name: Checkout sources
uses: actions/checkout@v4
- name: Initialize integ-test
uses: ./.github/actions/init-integ-test
- name: Generate and submit dependencies
id: dependency-submission
uses: ./dependency-submission
with:
build-root-directory: .github/workflow-samples/groovy-dsl
dependency-graph-exclude-projects: excluded-project
dependency-graph-include-projects: included-project
dependency-graph-exclude-configurations: excluded-configuration
dependency-graph-include-configurations: included-configuration
- name: Check generated dependency graph and env vars
shell: bash
run: |
if [ ! -e "${{ steps.dependency-submission.outputs.dependency-graph-file }}" ]; then
echo "Did not find generated dependency graph file"
exit 1
fi
if [ "$DEPENDENCY_GRAPH_EXCLUDE_PROJECTS" != "excluded-project" ] ||
[ "$DEPENDENCY_GRAPH_INCLUDE_PROJECTS" != "included-project" ] ||
[ "$DEPENDENCY_GRAPH_EXCLUDE_CONFIGURATIONS" != "excluded-configuration" ] ||
[ "$DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS" != "included-configuration" ]; then
echo "Did not set expected environment variables"
exit 1
fi
custom-report-dir-submit:
strategy:
fail-fast: false
@ -279,9 +313,8 @@ jobs:
uses: ./dependency-submission
with:
dependency-graph: generate-and-submit
dependency-graph-report-dir: '${{ github.workspace }}/custom/report-dir'
build-root-directory: .github/workflow-samples/groovy-dsl
env:
DEPENDENCY_GRAPH_REPORT_DIR: '${{ github.workspace }}/custom/report-dir'
- name: Check generated dependency graphs
shell: bash
run: |
@ -310,9 +343,8 @@ jobs:
uses: ./dependency-submission
with:
dependency-graph: generate-and-upload
dependency-graph-report-dir: '${{ github.workspace }}/custom/report-dir'
build-root-directory: .github/workflow-samples/groovy-dsl
env:
DEPENDENCY_GRAPH_REPORT_DIR: '${{ github.workspace }}/custom/report-dir'
custom-report-dir-download-and-submit:
needs: custom-report-dir-upload
@ -327,10 +359,10 @@ jobs:
uses: ./dependency-submission
with:
dependency-graph: download-and-submit
dependency-graph-report-dir: '${{ github.workspace }}/custom/report-dir'
build-root-directory: .github/workflow-samples/groovy-dsl
env:
DEPENDENCY_GRAPH_REPORT_DIR: '${{ github.workspace }}/custom/report-dir'
DEPENDENCY_GRAPH_DOWNLOAD_ARTIFACT_NAME: custom-report-dir-upload
DEPENDENCY_GRAPH_DOWNLOAD_ARTIFACT_NAME: custom-report-dir-upload # For testing, to avoid downloading artifacts from other worklfows
- name: Check downloaded dependency graph
shell: bash

31
dependency-submission/action.yml
View File

@ -108,11 +108,42 @@ inputs:
required: false
default: 'generate-and-submit'
dependency-graph-report-dir:
description: |
Specifies where the dependency graph report will be generated.
Paths can relative or absolute. Relative paths are resolved relative to the workspace directory.
required: false
default: 'dependency-graph-reports'
dependency-graph-continue-on-failure:
description: When 'false' a failure to generate or submit a dependency graph will fail the Step or Job. When 'true' a warning will be emitted but no failure will result.
required: false
default: false
dependency-graph-exclude-projects:
description: |
Gradle projects that should be excluded from dependency graph (regular expression).
When set, any matching project will be excluded.
required: false
dependency-graph-include-projects:
description: |
Gradle projects that should be included in dependency graph (regular expression).
When set, only matching projects will be included.
required: false
dependency-graph-exclude-configurations:
description: |
Gradle configurations that should be included in dependency graph (regular expression).
When set, anymatching configurations will be excluded.
required: false
dependency-graph-include-configurations:
description: |
Gradle configurations that should be included in dependency graph (regular expression).
When set, only matching configurations will be included.
required: false
artifact-retention-days:
description: Specifies the number of days to retain any artifacts generated by the action. If not set, the default retention settings for the repository will apply.
required: false

39
docs/dependency-submission.md
View File

@ -102,6 +102,13 @@ In some cases, the default action configuration will not be sufficient, and addi
# Do not attempt to submit the dependency-graph. Save it as a workflow artifact.
dependency-graph: generate-and-upload
# Specify the location where dependency graph files will be generated.
dependency-graph-report-dir: custom-report-dir
# By default, failure to generate a dependency graph will cause the workflow to fail
dependency-graph-continue-on-failure: true
```
See the [Action Metadata file](../dependency-submission/action.yml) for a more detailed description of each input parameter.
@ -235,26 +242,26 @@ contribute to the dependency graph.
> These dependencies would be assigned to different scopes (eg development, runtime, testing) and the GitHub UI would make it easy to opt-in to security alerts for different dependency scopes.
> However, this functionality does not yet exist.
### Excluding certain Gradle projects from the dependency graph
### Selecting Gradle projects that will contribute to the dependency graph
If you do not want the dependency graph to include dependencies from every project in your build,
you can easily exclude certain projects from the dependency extraction process.
you can easily exclude or include certain projects from the dependency extraction process.
To restrict which Gradle subprojects contribute to the report, specify which projects to exclude via a regular expression.
You can provide this value via the `DEPENDENCY_GRAPH_EXCLUDE_PROJECTS` environment variable or system property.
To restrict which Gradle subprojects contribute to the report, specify which projects to exclude or include via a regular expression.
You can use the `dependency-graph-exclude-projects` and `dependency-graph-include-projects` input parameters for this purpose.
Note that excluding a project in this way only removes dependencies that are _resolved_ as part of that project, and may
not necessarily remove all dependencies _declared_ in that project. If another project depends on the excluded project
then it may transitively resolve dependencies declared in the excluded project: these dependencies will still be included
in the generated dependency graph.
### Excluding certain Gradle configurations from the dependency graph
### Selecting Gradle configurations that will contribute to the dependency graph
Similarly to Gradle projects, it is possible to exclude a set of configuration instances from dependency graph generation,
so that dependencies resolved by those configurations are not included.
Similarly to Gradle projects, it is possible to exclude or include a set of dependency configurations from dependency graph generation,
so that only dependencies resolved by the included configurations are reported.
To restrict which Gradle configurations contribute to the report, specify which configurations to exclude via a regular expression.
You can provide this value via the `DEPENDENCY_GRAPH_EXCLUDE_CONFIGURATIONS` environment variable or system property.
To restrict which Gradle configurations contribute to the report, specify which configurations to exclude or include via a regular expression.
You can use the `dependency-graph-exclude-configurations` and `dependency-graph-include-configurations` input parameters for this purpose.
Note that configuration exclusion applies to the configuration in which the dependency is _resolved_ which is not necessarily
the configuration where the dependency is _declared_. For example if you decare a dependency as `implementation` in
@ -262,24 +269,18 @@ a Java project, that dependency will be resolved in `compileClasspath`, `runtime
### Example of project and configuration filtering
For example, if you want to exclude dependencies in the `buildSrc` project, and exclude dependencies from the `testCompileClasspath` and `testRuntimeClasspath` configurations, you would use the following configuration:
For example, if you want to exclude dependencies resolved by the `buildSrc` project, and exclude dependencies from the `testCompileClasspath` and `testRuntimeClasspath` configurations, you would use the following configuration:
```yaml
- name: Generate and submit dependency graph
uses: gradle/actions/dependency-submission@v3
env:
with:
# Exclude all dependencies that originate solely in the 'buildSrc' project
DEPENDENCY_GRAPH_EXCLUDE_PROJECTS: ':buildSrc'
dependency-graph-exclude-projets: ':buildSrc'
# Exclude dependencies that are only resolved in test classpaths
DEPENDENCY_GRAPH_EXCLUDE_CONFIGURATIONS: '.*[Tt]est(Compile|Runtime)Classpath'
dependency-graph-exclude-configurations: '.*[Tt]est(Compile|Runtime)Classpath'
```
### Other filtering options
The [GitHub Dependency Graph Gradle Plugin](https://plugins.gradle.org/plugin/org.gradle.github-dependency-graph-gradle-plugin)
has other filtering options that may be useful.
See [the docs](https://github.com/gradle/github-dependency-graph-gradle-plugin?tab=readme-ov-file#filtering-which-gradle-configurations-contribute-to-the-dependency-graph) for details.
# Advance usage scenarios
## Using a custom plugin repository

31
setup-gradle/action.yml
View File

@ -84,11 +84,42 @@ inputs:
required: false
default: 'disabled'
dependency-graph-report-dir:
description: |
Specifies where the dependency graph report will be generated.
Paths can relative or absolute. Relative paths are resolved relative to the workspace directory.
required: false
default: 'dependency-graph-reports'
dependency-graph-continue-on-failure:
description: When 'false' a failure to generate or submit a dependency graph will fail the Step or Job. When 'true' a warning will be emitted but no failure will result.
required: false
default: true
dependency-graph-exclude-projects:
description: |
Gradle projects that should be excluded from dependency graph (regular expression).
When set, any matching project will be excluded.
required: false
dependency-graph-include-projects:
description: |
Gradle projects that should be included in dependency graph (regular expression).
When set, only matching projects will be included.
required: false
dependency-graph-exclude-configurations:
description: |
Gradle configurations that should be included in dependency graph (regular expression).
When set, anymatching configurations will be excluded.
required: false
dependency-graph-include-configurations:
description: |
Gradle configurations that should be included in dependency graph (regular expression).
When set, only matching configurations will be included.
required: false
artifact-retention-days:
description: Specifies the number of days to retain any artifacts generated by the action. If not set, the default retention settings for the repository will apply.
required: false

27
sources/src/configuration.ts
View File

@ -43,13 +43,30 @@ export class DependencyGraphConfig {
}
getReportDirectory(): string {
return path.resolve(getWorkspaceDirectory(), 'dependency-graph-reports')
const param = core.getInput('dependency-graph-report-dir')
return path.resolve(getWorkspaceDirectory(), param)
}
getDownloadArtifactName(): string | undefined {
return process.env['DEPENDENCY_GRAPH_DOWNLOAD_ARTIFACT_NAME']
}
getExcludeProjects(): string | undefined {
return getOptionalInput('dependency-graph-exclude-projects')
}
getIncludeProjects(): string | undefined {
return getOptionalInput('dependency-graph-include-projects')
}
getExcludeConfigurations(): string | undefined {
return getOptionalInput('dependency-graph-exclude-configurations')
}
getIncludeConfigurations(): string | undefined {
return getOptionalInput('dependency-graph-include-configurations')
}
static constructJobCorrelator(workflow: string, jobId: string, matrixJson: string): string {
const matrixString = this.describeMatrix(matrixJson)
const label = matrixString ? `${workflow}-${jobId}-${matrixString}` : `${workflow}-${jobId}`
@ -371,6 +388,14 @@ export function parseNumericInput(paramName: string, paramValue: string, paramDe
return numericValue
}
function getOptionalInput(paramName: string): string | undefined {
const paramValue = core.getInput(paramName)
if (paramValue.length > 0) {
return paramValue
}
return undefined
}
function getBooleanInput(paramName: string, paramDefault = false): boolean {
const paramValue = core.getInput(paramName)
switch (paramValue.toLowerCase().trim()) {

13
sources/src/dependency-graph.ts
View File

@ -31,16 +31,23 @@ export async function setup(config: DependencyGraphConfig): Promise<void> {
core.exportVariable('GITHUB_DEPENDENCY_GRAPH_ENABLED', 'true')
maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_CONTINUE_ON_FAILURE', config.getDependencyGraphContinueOnFailure())
maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR', config.getJobCorrelator())
maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_JOB_ID', github.context.runId)
maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_JOB_ID', github.context.runId.toString())
maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_REF', github.context.ref)
maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_SHA', getShaFromContext())
maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_WORKSPACE', getWorkspaceDirectory())
maybeExportVariable('DEPENDENCY_GRAPH_REPORT_DIR', config.getReportDirectory())
maybeExportVariable('DEPENDENCY_GRAPH_EXCLUDE_PROJECTS', config.getExcludeProjects())
maybeExportVariable('DEPENDENCY_GRAPH_INCLUDE_PROJECTS', config.getIncludeProjects())
maybeExportVariable('DEPENDENCY_GRAPH_EXCLUDE_CONFIGURATIONS', config.getExcludeConfigurations())
maybeExportVariable('DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS', config.getIncludeConfigurations())
}
function maybeExportVariable(variableName: string, value: unknown): void {
function maybeExportVariable(variableName: string, value: string | boolean | undefined): void {
if (!process.env[variableName]) {
core.exportVariable(variableName, value)
if (value !== undefined) {
core.exportVariable(variableName, value)
}
}
}