Submit Maven dependency snapshots; drop counterproductive dependency-review retry

[AndreasIgel]

Summary

Fixes the confusing "No snapshots were found for the head SHA" warning that dependency-review posts in PR comments. The check is not actually failing — it's green — but the warning is prominent and looks like a failure. Fixes #212 (follow-up to #160 / #182).

Root cause: this Maven repo's dependency graph is populated only by GitHub's static pom.xml parsing. No dependency submission snapshots exist, so dependency-review-action emits the snapshot warning while still passing via the manifest-derived graph. The retry-on-snapshot-warnings: true added in #182 is counterproductive here — with no submission workflow it retries ~2 min for a snapshot that never arrives, then proceeds with the warning anyway.

Changes:

1. New dependency-submission.yml — on push to main (+ manual dispatch), submits the full transitive Maven dependency snapshot to the dependency graph via advanced-security/maven-dependency-submission-action (SHA-pinned @v5.0.0, contents: write). This improves vulnerability coverage (transitive, not just declared deps) and gives main real snapshot data for reviews to compare against.

2. dependency-review.yml — remove the counterproductive retry-on-snapshot-warnings, and document that the head-SHA warning on fork PRs is expected/benign:

   comment-summary-in-pr: always
+  # Fork PR head SHAs may show "No snapshots were found for the head SHA" because
+  # submitting a snapshot would require building untrusted fork code with a write
+  # token. Expected & benign: the check uses the manifest-derived graph and passes.
   fail-on-severity: high
   deny-licenses: GPL-1.0-or-later, ...
-  # Snapshot dependency data can lag right after a push; retry instead of failing spuriously.
-  retry-on-snapshot-warnings: true

Why the head-SHA warning can't be fully removed for fork PRs: submitting a snapshot for a fork PR's head commit would require building untrusted fork code with a contents: write token — the exact pattern the fork-CI design deliberately avoids. So the base side (main) gets snapshots; the fork PR head warning remains but is harmless and now documented.

Related

• dependency-review posts benign 'missing snapshots' warning; submit Maven dependency snapshots #212 (this issue), Enforce severity and license gates in dependency-review workflow #160 / Enforce severity and license gates in dependency-review workflow #182 (original dependency-review work)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 151eb56.

Ensure that dependencies are being submitted on PR branches. Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	34e114876b0b11c390a56381ad16ebd13914f8d5	🟢 6.9	Details Check Score Reason Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches
actions/actions/setup-java	c1e323688fd81a25caa38c78aa6df2d33d3e20d9	🟢 5.3	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 3 Found 7/21 approved changesets -- score normalized to 3 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9 Security-Policy 🟢 9 security policy file detected
actions/advanced-security/maven-dependency-submission-action	b275d12641ac2d2108b2cbb7598b154ad2f2cee8	🟢 6.3	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed Security-Policy 🟢 10 security policy file detected Maintained 🟢 8 10 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 8 Binary-Artifacts 🟢 9 binaries present in source code Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST 🟢 3 SAST tool is not run on all commits -- score normalized to 3

Scanned Files

• .github/workflows/dependency-submission.yml

[AndreasIgel]

Superseded by #216. The Maven dependency-submission approach here doesn't fix the reported problem — submitting on main can't create a snapshot for a fork PR's head SHA, so the "No snapshots were found" warning would still show on PRs. #216 instead sets comment-summary-in-pr: on-failure so the benign warning stops being posted as a PR comment. Closing this.

[AndreasIgel]

Correction: this PR was already merged (2026-07-20), so it's already on main — my earlier "closing this" note was inaccurate. The submission workflow it added is harmless and stays. #216 builds on top of it to flip comment-summary-in-pr from always to on-failure, which is what actually stops the benign "No snapshots were found for the head SHA" warning from appearing on PRs.