[ThoSap]

Goal

GitHub does not read Gradle build files, so postgresql-operator gets no Dependabot alerts for its Java dependencies. Today its dependency graph has only the GitHub Actions of its workflows.

What changed

A new workflow submits the resolved Gradle dependency graph to GitHub every Monday and on a manual run. It uses dependency-submission-with-gradle@v4 with java-version: 25 and project-type: quarkus (aboutbits/github-actions-java#12).

Review notes

• The weekly cron fits the merge history: in the last 13 weeks, PRs were merged in bursts on 11 days, and 11 of 32 updated dependencies. GitHub checks new advisories against the last submitted graph without a new run.
• The repository is public. GitHub disables a scheduled workflow after 60 days without activity in a public repository, and then it must be enabled again.
• After the merge, start the workflow once with Run workflow, so the Java alerts do not wait for the next Monday.

Test scope

• The same action passed in a test run on this repository: 574 packages, 207 "runtime" and 367 "development". The conditional dependency quarkus-operator-sdk-helm is "runtime".
• Not run: this workflow file. A scheduled or manual run is possible only after the merge to main.

Risk: needs a human review, assessed at 6a44203

• There is no self-review of this branch.
• The repository has no freshness Action.