From de64d8e123627b165cd7b2f0421bb61cc06391ad Mon Sep 17 00:00:00 2001
From: daz <daz@gradle.com>
Date: Tue, 30 Jan 2024 12:00:30 -0700
Subject: [PATCH] Add separate dependency-submission workflow

With the introduction of `gradle/actions/dependency-submission`, it is now
simpler (and recommended) to use a separate workflow for generation and
submission of GitHub Dependency Graph.

This workflow attempts to detect and submit all dependencies that would
be resolved during build execution, without requiring the execution of any
particular task. In basic testing it appears that the generated dependency
graph contains the same dependencies as before.

A few things to note:
The new workflow will submit a dependency graph with a different "correlator" to
the previous one. This means that duplicate dependencies (and alerts) may appear
until the older graph ages out and is automatically purged. (Period of hours to days).

Manually dismissed Dependabot Alerts may need to be re-dismissed after
switching to the new workflow.
---
 .github/actions/main-build/action.yml         |  5 ----
 .github/actions/run-gradle/action.yml         |  5 ----
 .../gradle-dependency-submission.yml          | 25 +++++++++++++++++++
 .github/workflows/main.yml                    |  1 -
 4 files changed, 25 insertions(+), 11 deletions(-)
 create mode 100644 .github/workflows/gradle-dependency-submission.yml

diff --git a/.github/actions/main-build/action.yml b/.github/actions/main-build/action.yml
index 8d282cd1502f..1de62dd7267c 100644
--- a/.github/actions/main-build/action.yml
+++ b/.github/actions/main-build/action.yml
@@ -5,10 +5,6 @@ inputs:
     required: true
     description: Gradle arguments
     default: build
-  dependency-graph:
-    required: false
-    description: 'see https://github.com/gradle/gradle-build-action#enable-dependency-graph-generation-for-a-workflow'
-    default: disabled
 runs:
   using: "composite"
   steps:
@@ -16,7 +12,6 @@ runs:
     - uses: ./.github/actions/run-gradle
       with:
         arguments: ${{ inputs.arguments }}
-        dependency-graph: ${{ inputs.dependency-graph }}
     - uses: actions/upload-artifact@v4
       if: ${{ always() }}
       with:
diff --git a/.github/actions/run-gradle/action.yml b/.github/actions/run-gradle/action.yml
index da52b9aad5e8..856f81a89947 100644
--- a/.github/actions/run-gradle/action.yml
+++ b/.github/actions/run-gradle/action.yml
@@ -5,10 +5,6 @@ inputs:
     required: true
     description: Gradle arguments
     default: build
-  dependency-graph:
-    required: false
-    description: 'see https://github.com/gradle/gradle-build-action#enable-dependency-graph-generation-for-a-workflow'
-    default: disabled
 runs:
   using: "composite"
   steps:
@@ -21,7 +17,6 @@ runs:
       env:
         JAVA_HOME: ${{ steps.setup-gradle-jdk.outputs.path }}
       with:
-        dependency-graph: ${{ inputs.dependency-graph }}
         arguments: |
           -Porg.gradle.java.installations.auto-download=false
           -Pjunit.develocity.predictiveTestSelection.enabled=${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/gradle-dependency-submission.yml b/.github/workflows/gradle-dependency-submission.yml
new file mode 100644
index 000000000000..d2c4433356d4
--- /dev/null
+++ b/.github/workflows/gradle-dependency-submission.yml
@@ -0,0 +1,25 @@
+name: Gradle Dependency Submission
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check out repository
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 1
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        distribution: temurin
+        java-version: 21
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index faaf42d87fd8..2a15cdc34545 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -37,7 +37,6 @@ jobs:
     - name: Build
       uses: ./.github/actions/main-build
       with:
-        dependency-graph: generate-and-submit
         arguments: |
           -Ptesting.enableJaCoCo
           build