From 689d33cb721eb450babff17d795014a800193fc1 Mon Sep 17 00:00:00 2001
From: Christoph Obexer <cobexer@gradle.com>
Date: Tue, 12 Nov 2024 12:31:16 +0100
Subject: [PATCH] GitHub Actions updates

Signed-off-by: Christoph Obexer <cobexer@gradle.com>
---
 .github/dependabot.yml                        | 13 ++++++++++
 .../workflows/dependency-review-action.yml    | 24 +++++++++++++++++++
 .github/workflows/dependency-submission.yml   | 24 +++++++++++++++++++
 .github/workflows/gradle.yml                  |  2 +-
 4 files changed, 62 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/dependency-review-action.yml
 create mode 100644 .github/workflows/dependency-submission.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3a0943c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "@dev-productivity"
diff --git a/.github/workflows/dependency-review-action.yml b/.github/workflows/dependency-review-action.yml
new file mode 100644
index 0000000..9084b7c
--- /dev/null
+++ b/.github/workflows/dependency-review-action.yml
@@ -0,0 +1,24 @@
+name: Dependency review for pull requests
+
+on:
+  workflow_dispatch:
+  pull_request:
+
+permissions:
+  contents: write
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-java@v4
+      with:
+        distribution: temurin
+        java-version: 21
+
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3
+
+    - name: Perform dependency review
+      uses: actions/dependency-review-action@v3
diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
new file mode 100644
index 0000000..648d1f5
--- /dev/null
+++ b/.github/workflows/dependency-submission.yml
@@ -0,0 +1,24 @@
+name: Dependency Submission
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: 21
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index f78f165..50a7942 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3
-    - name: Set up JDK 11
+    - name: Setup Java
       uses: actions/setup-java@v3
       with:
         java-version: '11'