gradle / gradle/actions

Provide assistance to users attempting to resolve vulnerable dependencies

Open
#195 0 comments 0 reactions 0 assignees View on GitHub
enhancement in:dependency-submission
Dominant language
TypeScript
Stars
340
Forks
117
Avg merge
1d 9h
Merged PRs (30d)
11

Description

Because [all dependencies are assigned to the settings.gradle.kts file](https://github.com/gradle/github-dependency-graph-gradle-plugin/issues/80), it can be difficult for users to work out how to fix vulnerable dependencies. (Attributing to a particular project would help a bit, but not entirely).

We could provide more assistance to users:
- Add a central documentation page focussed on "understanding the GitHub Dependency Graph for your Gradle project"
- This page should be succinct and point users to other, more complete documentation where necessary.
- Top level, mention enabling Build Scans and running with debug logging.
- Link to this documentation in the generated Job Summary

Although another report with full dependency information could be helpful, I think we already provide a sufficient mechanism via Build Scans, debug logging and existing Gradle dependency tasks. But these need to be more discoverable.

Contributor guide

Open the contributing guide

Research direction

Start with settings.gradle.kts and the generated Job Summary, then review the existing Gradle dependency tasks, Build Scans guidance, and debug logging mentioned in the issue. Document how users can understand and resolve vulnerable dependencies, and link that documentation from the Job Summary.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, kotlin
Domain
devops, documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.