Skip to main content
← Back to workflows

How to Execute Gradle builds in GitHub Actions workflows?

gradle-build-action -
GitHub Action
v3.3.2
671
Contributors
Contributor - bigdazContributor - eskatos
Categories
CICUBE ANALYTICS INSIGHTS
Engineering Velocity: 25% Team Time Lost to CI Issues
View Platform →
3.5h
Time Saved/Dev/Week
40%
Faster Releases
Click for next insight
Usage
name: Build

on: [ push ]

jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout sources
uses: actions/checkout@v4
- name: Setup Gradle
uses: gradle/gradle-build-action@v3
- name: Build with Gradle
run: ./gradlew build

gradle-build-action logo

gradle-build-action

Execute your Gradle build and trigger dependency submission


With this action you can use a private plugin repository for GitHub Actions and a dependency-review-action for guarding your dependencies by watching changes in dependencies and the security implications behind that. It also specially said different workflows to manage permission securely, when pull is requested from public forked repositories.

This allows us to have some flexibility with how we configure GitHub Actions, with a single common setup for all repositories, most useful in restricted environments. Add this dependency-review-action to better serve the ability to follow through and manage the changes in the dependencies to build a better security path for our project. Dynamic: Enabling the dual workflow approach on public forked repositories is both secure and functional.

How to Generate and Submit a Dependency Graph for a Gradle Project

The dependency-submission action generates and submits a dependency graph for a Gradle project, enabling GitHub to alert you about reported issues regarding dependencies from your project. To set this up, follow the steps below:

Add the following workflow file to your repository (e.g., .github/workflows/dependency-submission.yml).

name: Dependency Submission

on:
push:
branches: [ 'main' ]

permissions:
contents: write

jobs:
dependency-submission:
runs-on: ubuntu-latest
steps:
- name: Checkout sources
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: 17
- name: Generate and submit dependency graph
uses: gradle/actions/dependency-submission@v3

This workflow generates a dependency graph for a Gradle project and submits it to the repository using the Dependency Submission API. The default configuration should work for most projects; however, the full action documentation supports more advanced use cases as needed.

How to Validate Gradle Wrapper JAR Files

The wrapper-validation action validates the checksums of all Gradle Wrapper JAR files in the repository and can fail if any unknown Gradle Wrapper JAR files are found. Here is how to set it up:

Add the following workflow file to your repository (e.g., .github/workflows/validate-gradle-wrapper.yml).

name: "Validate Gradle Wrapper"

on:
push:
pull_request:

jobs:
validation:
name: "Validation"
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: gradle/actions/wrapper-validation@v3

This action should be run in the root of the repo, as it will walk the directory tree, searching for any files named gradle-wrapper.jar, ensuring that all files in the repository are known and validated. This enhances security by ensuring that no tampered or otherwise untrusted or unverified files are used.

How to Integrate the dependency-review-action with pull request actions

Workflow example that builds and runs the dependency-review-action

name: Pull Request Dependency Review

on:
pull_request:
permissions:
contents: write
jobs:
dependency-submission:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
distribution: temurin
java-version: 17
- name: Generate and submit Dependency Graph
uses: gradle/dependency-submission@v3
- name: Dependency review
uses: actions/dependency-review-action@v1

This gives us visibility into dependency changes, and their security impacts from the PR level by diffing the dependency graph against the HEAD commit.

How to approve pull requests from public forked repositories?

Because workflows can only have restricted write permissions for workflows triggered by pull requests from forks, we need a 2nd workflow.

name: Create and Save Dependency Visualization
on:
pull_request:
permissions:
contents: read
jobs:
dependency-submission:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
distribution: temurin
java-version: 17
- name: Generate dependency graph and save it
uses: gradle/actions/dependency-[email protected]
with:
dependency-graph: generate-and-deploy
name: download and submit dependency graph
on:
workflow_run:
workflows: [ Name: 'Generate and save dependency graph' ]
types: [completed]
permissions:
actions: read
contents: write
jobs:
submit-dependency-graph:
runs-on: ubuntu-latest
steps:
- name: Download and upload dependency graph
uses: gradle/subject-action/dependency-submission@v3
with:
download-and-submit

These workflows make sure dependency graphs are built and published in a secure manner, from public forks as well, by splitting the tasks in two different workflows.

How to integrate dependency-review-action to run only on public pull requests from forked repositories

One more workflow is needed to wait for the dependency graph results to perform the dependency review.

name: dependency-review
on:
pull_request:
permissions:
contents: read
jobs:
dependency-review:
runs-on: ubuntu-latest
steps:
- name: 'Dependency Review'
uses: github/codeql-action/analyze@von
with:
restart-on-snapshot-warnings: true
retry-on-snapshot-warnings-timeout: 600

This workflow will wait up to 10 minutes for previous workflows to be completed, to make sure that the dependency review has the latest accurate information.