Unique job matrix

[david-wiggs]

This addresses #73 - @ebickle would you be able to test this by targeting david-wiggs/maven-dependency-submission-action@unique-job-matrix and give some feedback?

[ebickle]

A few updates here - right now the ${{ matrix.pom-file }} isn't running a different dependency submission. For the repos I work on (e.g. monorepo Java with multiple project roots) Iike to use the directory input like this:

matrix:
  include:
    - java-version: 8
      directory: project1
    - java-version: 11
      directory: project2

Then for submission you could recommend something like this:

   - name: Submit Dependency Snapshot
      uses: advanced-security/maven-dependency-submission-action@v3
      with:
        directory: ${{ matrix.directory }}
        correlator: ${{ github.job }}-${{ matrix.directory }}

A file-based approach is possible but I believe it's more complex since mavenArgs would have to be set. I might be wrong though!

(Note there's no need to specify token: ${{ secrets.GITHUB_TOKEN }} since that's the default).

One thing I'm not sure about is what the character limits are for the correlator in the dependency submission snapshot - might be worth checking to ensure common path characters work. Job Ids are fairly restricted in terms of what they support, but that might not be true for submitted correlators.

Also recommend updating the action versions to the latest (non-deprecated) versions.

[juxtin]

One thing I'm not sure about is what the character limits are for the correlator in the dependency submission snapshot - might be worth checking to ensure common path characters work.

👋🏽 from Dependency Graph! The correlator value can be any string, but we do trim it to 255 characters at most. If you think that limit is too low, we may be able to raise it.

AFAIK, we do not return any kind of error when the correlator is too long, we just silently trim it. So watch out for that.

[ebickle]

@david-wiggs this is going to help out a lot with our more complex configurations, thank you! I'm tossed some ideas in as comments on the draft PR - they're all just rough ideas, nothing necessary at all. Might be a day or two until I can give it a try, but I'll let you know when I do!