Question

A platform team builds Java services with Gradle, where many runtime dependencies are only resolved during the build and are not listed explicitly in the checked-in build files. The security lead notices that GitHub's dependency graph for these repositories misses these transitively resolved dependencies, so Dependabot alerts are incomplete. Which approach lets GitHub include the full, build-resolved dependency set in the dependency graph?

Accepted Answer

Use the Dependency Submission API (for example via a build-time action) to submit the resolved dependencies to the dependency graph

Answer

Enable Dependabot version updates so it re-parses the Gradle files on a schedule and fills in the missing dependencies

Answer

Export an SPDX SBOM from the repository and re-import it so the graph reflects the SBOM contents

Answer

Add the Dependency Review action to the pull request workflow so it discovers the build-resolved dependencies during CI