From 151eb56e00b666f00c78b58f6bf3a6b73a167a49 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 23:38:28 +0000
Subject: [PATCH] Submit Maven dependency snapshots and stop counterproductive
 dependency-review retry (#160)

Co-Authored-By: Andreas Igel <andreas.igel@computacenter.com>
---
 .github/workflows/dependency-review.yml     |  6 ++--
 .github/workflows/dependency-submission.yml | 34 +++++++++++++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/dependency-submission.yml

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 9e8129dd..19d92324 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -50,9 +50,11 @@ jobs:
         # Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options.
         with:
           comment-summary-in-pr: always
+          # Fork PR head SHAs may show "No snapshots were found for the head SHA" because
+          # submitting a snapshot would require building untrusted fork code with a write
+          # token. This is expected and benign: the check uses the manifest-derived graph
+          # and still passes. dependency-submission.yml provides snapshots for main.
           # Fail the PR when it introduces a vulnerability at or above this severity.
           fail-on-severity: high
           # Block copyleft / incompatible licenses that conflict with this MIT project.
           deny-licenses: GPL-1.0-or-later, GPL-2.0-or-later, GPL-3.0-or-later, LGPL-2.0-or-later, LGPL-2.1-or-later, LGPL-3.0-or-later, AGPL-3.0-or-later
-          # Snapshot dependency data can lag right after a push; retry instead of failing spuriously.
-          retry-on-snapshot-warnings: true
diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
new file mode 100644
index 00000000..beca634a
--- /dev/null
+++ b/.github/workflows/dependency-submission.yml
@@ -0,0 +1,34 @@
+# Submit the full transitive Maven dependency snapshot to the repository's dependency graph.
+# This improves vulnerability detection beyond static manifest parsing and provides snapshots
+# for main so dependency review has real snapshot data to compare against.
+name: Dependency submission
+
+on:
+  push:
+    branches: [ "main" ]
+  workflow_dispatch:
+
+# Cancel superseded runs for the same ref to save runner minutes.
+concurrency:
+  group: dependency-submission-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+        with:
+          java-version: '17'
+          distribution: 'zulu'
+          cache: maven
+
+      - name: Submit Maven dependency snapshot
+        uses: advanced-security/maven-dependency-submission-action@b275d12641ac2d2108b2cbb7598b154ad2f2cee8 # v5.0.0