Hi, this is a bit of a long shot, but does anyone here happen to know how to get GitHub's dependency graph to recognise artifacts produced by a repository (or if that's even possible)? From what I understand, this works fine with a Maven (as GitHub scans POMs) but I'm not sure if it can be made to work with Gradle. I know some projects (e.g. LWJGL) added a dummy `pom.xml` at top-level to get this to work but, ideally, I'd like to avoid this because it causes other tools (IDEs, ...) to assume that it's a Maven project.

not according to the github documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph#support[…]systems

I've read the documentation but what got me curious is that is seems to work (somewhat) for some projects (eg. dokka, JUnit 5). I'm not sure if they are doing anything special or if this is just handwired by GitHub for some large projects.

https://docs.github.com/en/code-security/supply-chain-security/understanding-your-so[…]tware-supply-chain/exploring-the-dependencies-of-a-repository perhaps, if you have a publicly published package which points to your github repo, you can specify it in the settings? Gradle artifacts do publish a maven pom by default as well, so it would make sense that that works.

Don't you just have to use the dependency submission action to make it work? https://github.com/gradle/actions/blob/main/docs/dependency-submission.md

AFAIK the action just communicates the artifacts that a build depends on to GitHub. Not the artifacts produced (/published) by a project. For example, when I have a project A that depends on B, I can see artifact B in the dependencies of A, but the link back to the repository of B does not work. Similarly, I cannot see the dependents of project A.