Submit Maven dependency snapshots; drop counterproductive dependency-review retry

.github/workflows/dependency-review.yml

@@ -50,9 +50,11 @@ jobs:
         # Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options.
         with:
           comment-summary-in-pr: always
+          # Fork PR head SHAs may show "No snapshots were found for the head SHA" because
+          # submitting a snapshot would require building untrusted fork code with a write
+          # token. This is expected and benign: the check uses the manifest-derived graph
+          # and still passes. dependency-submission.yml provides snapshots for main.
           # Fail the PR when it introduces a vulnerability at or above this severity.
           fail-on-severity: high
           # Block copyleft / incompatible licenses that conflict with this MIT project.
           deny-licenses: GPL-1.0-or-later, GPL-2.0-or-later, GPL-3.0-or-later, LGPL-2.0-or-later, LGPL-2.1-or-later, LGPL-3.0-or-later, AGPL-3.0-or-later
-          # Snapshot dependency data can lag right after a push; retry instead of failing spuriously.
-          retry-on-snapshot-warnings: true

.github/workflows/dependency-submission.yml

@@ -0,0 +1,34 @@
+# Submit the full transitive Maven dependency snapshot to the repository's dependency graph.
+# This improves vulnerability detection beyond static manifest parsing and provides snapshots
+# for main so dependency review has real snapshot data to compare against.
+name: Dependency submission
+
+on:
+  push:
+    branches: [ "main" ]
+  workflow_dispatch:
+
+# Cancel superseded runs for the same ref to save runner minutes.
+concurrency:
+  group: dependency-submission-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+        with:
+          java-version: '17'
+          distribution: 'zulu'
+          cache: maven
+
+      - name: Submit Maven dependency snapshot
+        uses: advanced-security/maven-dependency-submission-action@b275d12641ac2d2108b2cbb7598b154ad2f2cee8 # v5.0.0