ci: submit the Gradle dependency graph to GitHub (#1)

.github/workflows/dependency-submission.yml

@@ -0,0 +1,40 @@
+# Submits the dependency graph Gradle resolves to GitHub, so the repository's dependency graph and
+# Dependabot see this build's dependencies; GitHub reads no Gradle build by itself. 'runtime' marks
+# runtimeClasspath, everything else - tests, build tools - is 'development'. The same pattern as
+# astrapi69/mystic-crypt-ui#634.
+
+name: Dependency submission
+
+on:
+  push:
+    branches: [ develop, master ]
+  # by hand, to submit another branch
+  workflow_dispatch:
+
+permissions:
+  contents: write # the dependency submission API
+
+jobs:
+  submit:
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup Java
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+      - name: Submit the dependency graph
+        # 6.4.1 fixes GHSA-chpw-2mqm-95cc, which concerns the two-workflow download-and-submit setup
+        uses: gradle/actions/dependency-submission@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
+        env:
+          DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONS: '^runtimeClasspath$'
+        with:
+          # The graph plugin registers its resolving task once the projects are evaluated, which
+          # configure-on-demand does not wait for
+          # The build reads the credentials of the shut-down OSSRH while configuring; the graph needs
+          # none, so placeholders let it configure
+          additional-arguments: -Dorg.gradle.configureondemand=false -PossrhUsername=unused -PossrhPassword=unused