Fully Featured Gradle Support with the Gradle Tooling API

*Foreward* I'm not intimately familiar with how Dependabot works so please excuse me if I wildly misrepresent something about Dependabot. ## Problem Currently, Dependabot is attempting to parse `build.gradle` files as text files instead of fully understanding the complexities of Gradle Builds. This is because the dependencies declared in a `build.gradle` file doesn't tell the full story. Additionally, since Gradle now supports the Gradle Kotlin DSL, there are now `build.gradle.kts` files. On top of that, users can also change the name of their build files so that they call the files `my-project.gradle.kts` and Gradle will handle that fine. This current methodology completely misses any dependencies added by plugins, transitive dependencies, and dependencies added using Gradle in abnormal but valid ways. Fundamentally this issue arises because unlike NPM and Yarn, where dependency declaration files are static, Gradle & Maven both require code execution to fully resolve the dependency graph. ## Solution Gradle offers something called the [Gradle Tooling API](https://docs.gradle.org/current/userguide/embedding.html). This tooling API is already in use in IntelliJ, Eclipse, and the Gradle Test Kit. The Tooling API exposes the entire dependency graph for the repositories build in a way that can be transformed into a format Dependabot can understand. The Tooling API executes the Gradle Build and can be used to extract metadata about the build for consumption by external t

Posted by JLLeitschuh on May 23, 2019, 6:58 PM

Tags

• support (Other)

Related issues

• some bike vendor told me that the biggest problem with regular to ebike conversion was that regular bike frames were not strong enough to...
• I think of this as the kiosk economy.
• What a goofy comment.
• There's lots of evidence for positive influences of Caffeine on the body (some negative as well), especially the brain.
• Compose support in WSLc
• [RFC] Roadmap to v2.0