[dmihalcik-virtru]

Summary

Adds a workflow that runs advanced-security/maven-dependency-submission-action (v6.0.1, pinned by SHA) to submit the resolved Maven dependency tree to the GitHub dependency graph.

Rationale

GitHub builds the Maven dependency graph by reading the pom.xml files statically. It sees declared dependencies only, so Dependabot never alerts on vulnerable transitive dependencies, such as anything pulled in by grpc, okhttp, or connect-kotlin. This repo has no dependency-submission workflow today, so that part of the tree isn't covered.

How it works

• When it runs: on pushes to main that change a pom.xml or this workflow, and on workflow_dispatch. It also runs on PRs that edit the workflow file, so this PR tests itself; it is skipped for fork PRs, whose token is read-only.
• What it runs: the action calls depgraph-maven-plugin:graph over the reactor. That only resolves dependencies, so the job needs neither buf nor generated sources, and needs no repository secrets.
• Coverage: the default develop profile builds every module, so one snapshot covers sdk-fips-bc (bc-fips) as well as sdk-pqc-bc and cmdline (bcprov). The fips profile only changes which of those two modules cmdline uses at runtime, so it needs no second snapshot.
• Permissions: workflow-level contents: read; the job raises this to contents: write, which the dependency submission API requires.

Test plan

• actionlint passes on the new workflow.
• Locally, ran the action's exact Maven command (mvn -B com.github.ferstl:depgraph-maven-plugin:4.0.3:graph -DgraphFormat=json) against an empty local repository and with no settings.xml. Every module succeeded without codegen or mvn install. The graphs contain transitive artifacts (97 for sdk; cmdline includes sdk's grpc/okhttp/protobuf tree), and sdk-fips-bc's graph includes bc-fips.
• The Submit Maven dependency snapshot job on this PR succeeds and submits a snapshot (run: all six modules resolved, "Snapshot successfully created").
• After merge, the Insights → Dependency graph page lists transitive Maven dependencies.

After merge: new alerts need manual fixes

The first snapshot on main will likely raise new Dependabot alerts for transitive packages GitHub couldn't see before, such as json-smart 2.5.0 and nimbus-jose-jwt 9.37.3 (via oauth2-oidc-sdk).

Dependabot will not open PRs for most of these. Dependabot fixes Maven alerts by editing version strings in pom.xml; it doesn't run Maven. For a dependency that is only in the submitted graph, GitHub's docs say "Dependabot isn't able to find the vulnerable dependency in the repository, and therefore won't create a security update for that alert" (supported ecosystems, troubleshooting). Transitive security updates are npm-only (about security updates).

• Will get PRs: transitive packages already pinned in the root pom's <dependencyManagement>: guava, protobuf-java, error_prone_annotations, commons-codec, gson, byte-buddy, slf4j-api, kotlin-stdlib, grpc-netty-shaded, jspecify, and the Bouncy Castle artifacts.
• Won't get PRs: other transitive-only packages, e.g. json-smart and nimbus-jose-jwt.
• Probably won't get PRs: artifacts managed by an imported BOM (grpc-bom, junit-bom, log4j-bom). Dependabot is unlikely to map an alert on e.g. grpc-core to a grpc-bom bump.
• No fallback through the parent: Dependabot version updates could otherwise bump a parent that pulls in the fix, but .github/dependabot.yml sets open-pull-requests-limit: 0, which disables them.

To fix such an alert, bump the direct dependency that pulls it in (e.g. oauth2-oidc-sdk), or pin the patched version in the root <dependencyManagement>. Once pinned, Dependabot keeps that pin current for future alerts. Dependabot's Maven transitive-update mode is still experimental (dependabot-core#13012).

Public API

None. CI only.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

X-Test Results

✅ js@main-main
✅ go@main-v0.29.0
✅ java@v0.19.1-main
✅ java@pull-427-main
✅ js@main-v0.29.0
✅ java@pull-427-v0.29.0
✅ go@main-main
✅ java@v0.19.1-v0.29.0