Artifact downloaded but 'No dependency graph files found to submit' when using `download-and-submit`

[Pil0tXia]

I tried Integrating dependency-submission and dependency-review-action for pull requests from public forked repositories, the workflow files are as follows:

• https://github.com/Pil0tXia/eventmesh/blob/2f7c34ab75a92871d80b32b841a591ec6ffd846a/.github/workflows/code-scanning.yml
• https://github.com/Pil0tXia/eventmesh/blob/2f7c34ab75a92871d80b32b841a591ec6ffd846a/.github/workflows/dependency-graph.yml
• https://github.com/Pil0tXia/eventmesh/blob/2f7c34ab75a92871d80b32b841a591ec6ffd846a/.github/workflows/license.yml

However, neither dependency-submission@v3 (Commit, Actions log) or setup-gradle@v3 (Commit, Actions log), the following log was output, and the gradle dependencies were not added to the dependency graph of the Repo (that is, the artifacts marked with Detected by GitHub Dependency Graph Gradle Plugin):

Artifact download completed successfully.
Downloading dependency-graph artifact dependency-graph_code_scanning-build-java.json to /home/runner/work/eventmesh/eventmesh
Found dependency graph files:
No dependency graph files found to submit.

When I rolled back to gradle/gradle-build-action@v2, it worked (Commit, Actions log), and the dependency graph of the Repo had been updated.

[bigdaz]

Thanks for your report. The dependency-graph is being generated and saved (you can see the attached artifact here), but it appears that the download-and-submit part of the workflow is not working.

This functionality is difficult to verify with automated testing, so it's possible I introduced a bug as part of this fix in v3.3.1.
Can you please try using v3.3.0 (gradle/actions/dependency-submission@v3.3.0)?

[Pil0tXia]

@bigdaz

Hi! I've made changes in Pil0tXia/eventmesh@b96139c, it seems v3.3.0 works well on master branch and PR branch.

[bigdaz]

Thanks for letting me know. I'll try to get this fixed ASAP.
Once this issue is resolved (and a new release published) you should be able to switch back to using v3.