Dedicated workflow for dependency graph generation generates all possible configurations

[wzieba]

Issue

When using a dedicated workflow for dependency graph generation as described here, the generated dependency graph contains dependencies from all the configurations, instead of only the requested one.

Reproduction

I've prepared MRE here: https://github.com/wzieba/GradleBuildActionTest

The detekt plugin is just an example of some build plugin.

Having a Gradle project

// build.gradle.kts
plugins {
    application
    id("io.gitlab.arturbosch.detekt")
}

repositories {
    mavenCentral()
}

dependencies {
    implementation("javax.inject:javax.inject:1")
}

// settings.gradle.kts
pluginManagement {
    repositories {
        mavenCentral()
        gradlePluginPortal()
    }

    plugins {
        id 'io.gitlab.arturbosch.detekt' version '1.19.0'
    }
}

In such project, the result of dependencies --configuration runtimeClasspath is

❯ ./gradlew dependencies --configuration runtimeClasspath

> Task :dependencies

------------------------------------------------------------
Root project 'GradleBuildActionTest'
------------------------------------------------------------

runtimeClasspath - Runtime classpath of source set 'main'.
\--- javax.inject:javax.inject:1

Then, with GitHub Action

on: push
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Gradle to generate and submit dependency graphs
        uses: gradle/gradle-build-action@v2
        with:
          dependency-graph: generate
      - name: Extract the 'runtimeClasspath' dependencies
        run: ./gradlew dependencies --configuration runtimeClasspath

Expected result

I expect that the generated dependency-graph file will contain only javax.inject:javax.inject:1 dependency (and its transitive dependencies if any).

Current result

The generated dependency-graph (link) contains all project dependencies, including Detekt and Kotlin (transitive dependency of Detekt)

[wzieba]

A possible solution is to additionally set a filter, like

- name: Extract the 'runtimeClasspath' dependencies
  run: ./gradlew dependencies --configuration runtimeClasspath
  env:
    DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS: runtimeClasspath

[bigdaz]

You're right. The documentation is a bit inaccurate. Without an explicit filter, the dependency-graph file will contain all dependencies resolved as part of the build execution. The reason you're seeing Detekt and Kotlin dependencies is because these have to be resolved in order to configure your build and applied plugins.

I'll update the documentation to remove the --configuration filter, to avoid this confusion.