Provide assistance to users attempting to resolve vulnerable dependencies
- Dominant language
- TypeScript
- Stars
- 340
- Forks
- 117
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 11
Description
Because [all dependencies are assigned to the settings.gradle.kts file](https://github.com/gradle/github-dependency-graph-gradle-plugin/issues/80), it can be difficult for users to work out how to fix vulnerable dependencies. (Attributing to a particular project would help a bit, but not entirely).
We could provide more assistance to users:
- Add a central documentation page focussed on "understanding the GitHub Dependency Graph for your Gradle project"
- This page should be succinct and point users to other, more complete documentation where necessary.
- Top level, mention enabling Build Scans and running with debug logging.
- Link to this documentation in the generated Job Summary
Although another report with full dependency information could be helpful, I think we already provide a sufficient mechanism via Build Scans, debug logging and existing Gradle dependency tasks. But these need to be more discoverable.
Contributor guide
Research direction
Start with settings.gradle.kts and the generated Job Summary, then review the existing Gradle dependency tasks, Build Scans guidance, and debug logging mentioned in the issue. Document how users can understand and resolve vulnerable dependencies, and link that documentation from the Job Summary.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, kotlin
- Domain
- devops, documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100