Merge pull request #182 from braintrustdata/ark/security-hardening #4

	name: Shipped dependency submission

	on:
	workflow_dispatch:
	push:
	branches: [ main ]
	schedule:
	- cron: '17 3 * * *' # Daily at 03:17 UTC.

	permissions:
	contents: read

	concurrency:
	group: shipped-dependency-submission
	cancel-in-progress: false

	jobs:
	dependency-submission:
	# Never replace the default-branch inventory with a manually selected branch.
	if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
	runs-on: ubuntu-24.04
	permissions:
	contents: write

	steps:
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

	- name: Set up JDK 17
	uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
	with:
	java-version: 17
	distribution: 'temurin'

	- name: Load shared dependency scan settings
	run: jq -r 'to_entries[] \| "\(.key)=\(.value)"' .github/dependency-graph.json >> "$GITHUB_ENV"

	- name: Submit shipped dependencies
	uses: gradle/actions/dependency-submission@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
	# Shipped dependency filters are shared with the checkDependencies Gradle task.
	# Includes the agent's internal runtime graph behind its shaded JAR.
	with:
	cache-provider: basic
	additional-arguments: --no-configuration-cache

Navigation Menu