# Gradle partners with GitHub on supply chain security

DevFeed: [Gradle partners with GitHub on supply chain security](<https://devfeed.tech/articles/gradle-partners-with-github-on-supply-chain-security-24626.md>)

Original publisher: [Read original article](<https://blog.gradle.org/gradle-github-partnership-supply-chain-security>)

Author: Gradle Build Tool

Published: 2024-04-18T04:00:00Z

Content type: news

Language: en

Sources: [The Gradle Blog](<https://devfeed.tech/sources/the-gradle-blog.md>)

Topics: [Gradle](<https://devfeed.tech/topics/gradle.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Dependency management](<https://devfeed.tech/topics/dependency-management.md>), [Security](<https://devfeed.tech/topics/security.md>), [Developer experience](<https://devfeed.tech/topics/developer-experience.md>)

Tags: [dependabot](<https://devfeed.tech/tags/dependabot.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [dependency-management](<https://devfeed.tech/tags/dependency-management.md>), [github](<https://devfeed.tech/tags/github.md>), [github-action](<https://devfeed.tech/tags/github-action.md>), [gradle](<https://devfeed.tech/tags/gradle.md>), [integrity](<https://devfeed.tech/tags/integrity.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

## AI overview

Gradle and GitHub announce a technical partnership focused initially on software supply chain security and developer experience. The first feature is a Gradle dependency submission GitHub Action that automatically sends project dependencies to GitHub's dependency graph, helping users understand dependencies and receive Dependabot alerts.

## Source excerpt

Gradle is happy to announce a technical partnership with GitHub focusing on multiple areas, starting with supply chain security and developer experience. With this partnership, we establish a direct connection between organizations and plan to cooperate on integrations between GitHub and Gradle to promote best security practices among Gradle users. The first feature being released as a part of this partnership is the dependency submission GitHub Action for Gradle, which can be configured to automatically submit dependencies to GitHub's dependency graph, helping users better understand their application and receive Dependabot alerts. This partnership will improve the experience of many users within the shared Gradle and GitHub ecosystem. GitHub is the world's leading AI-powered developer platform to build, scale, and deliver secure software, home to more than 284 million public repositories. Gradle Build Tool is the default build system for Android application development, the most used JVM build system on GitHub, and among the most used build systems on the GitHub platform across public and private repositories. "Gradle is one of the most used build tools among GitHub users, and we're excited to continue to collaborate with them to improve supply chain security for the Gradle community. These updates to the Gradle Build Action will help millions of GitHub users improve the security of their apps by giving them better insights into their dependencies." - Jon Janego, Senior Product Manager at GitHub The problem with vulnerable dependencies Vulnerable project dependencies are a major risk for the software ecosystem. It's critical for developers to quickly detect potential vulnerabilities arising from both direct and transitive dependencies. It is a priority for many modern build systems, including Gradle, to help developers manage their dependencies and protect the supply chain and end users. Gradle Build Tool provides advanced security features like dependency verific