Set up Dependency graph for Dependencies and Dependents

[vorburger]

While looking at #2185 I noticed something else technically unrelate dwhich would also be good to set-up:

• https://github.com/google/android-fhir/network/dependencies
• https://github.com/google/android-fhir/network/dependents

are empty, but can be interesting to have (for e.g. both security as well as seeing who's using us).

https://github.com/MariaDB4j/MariaDB4j/network/dependencies is how the result would look like.

I'll have a go at seeing if I can this up (it should either be not very hard, or if there is something particular I'm missing that's specific to Gradle for Android that's a big enough PITA that it's not worth pursuing it further).

@fredhersch @jingtang10 @omarismail94 @williamito FYI

[vorburger]

OK, so according to https://github.com/marketplace?query=dependency+submission+gradle, there are apparently (at least) 2-3 choices here:

1. https://github.com/marketplace/actions/gradle-buildjet-action
2. https://github.com/marketplace/actions/gradle-build-action
3. https://github.com/marketplace/actions/gradle-dependency-submission

The 1. looks, to me, like an extremely suspicious rip-off from 2. so let's stay clear of that! (Note it has 0 Stars, and the exact same README... that's kind of textbook what one would do if I tried to take over a popular GitHub Action for malicious purposes! It may also be harmless, of course; but let's not find out.)

The 2. looks great, albeit a bit.. overwhelming? It does lots of great looking stuff (optimized caching; thank you!) - but I'm not 100% convinced we could use it JUST to Generate and Submit a GitHub Dependency Graph ... maybe, or maybe not; I have a hunch that until we sort out that whole Build with Google Kokoro vs. GitHub Action can of worms, it could be overkill. Its doc also refers to https://github.com/gradle/github-dependency-graph-gradle-plugin, with a README that says support coming in a future release, which doesn't inspire confidence in me (and each new Gradle plugin can be a PITA for future upgrades; I've been there).

The 3. looks simpler and focused only on dependency submission, and is apparently essentially based on just e.g. ./gradlew demo:dependencies - without requiring adding any additional Gradle plugins - I like the sound of that! Hear Gradle 7.5 or newer is required but that's cool because we're on 8.0. I'll therefore further pursue this choice!

[vorburger]

I'm dumb... 😺 this project already uses 2. (I just didn't see it at first, because it's in an "included" YAML); #2208 enables it.

[omarismail94]

Im not sure if the Gradle Dependency Plugin supports Kotlin: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph#supported-package-ecosystems

[vorburger]

Im not sure if the Gradle Dependency Plugin supports Kotlin: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph#supported-package-ecosystems

I have a hunch that it will work, because this Kotlin Android project ultimately still just manages it's dependencies using what the doc you are linking to refers to as the Maven Ecosystem...

Review #2208 and if OK for you merge it, and we'll find out!