Add reusable dependency-graph workflow

.github/workflows/dependency-graph.yml

@@ -0,0 +1,55 @@
+# Submits the sbt dependency graph to GitHub's Dependency Submission API. GitHub cannot parse
+# build.sbt natively, so without this an sbt repository gets no Dependabot alerts at all.
+# Callers should trigger it on push to their default branch only.
+name: Submit a dependency graph
+
+on:
+  workflow_call:
+    inputs:
+      java_version:
+        description: 'JDK version'
+        type: string
+        default: '17'
+      java_distribution:
+        description: 'JDK distribution'
+        type: string
+        default: 'temurin'
+      modules_ignore:
+        description: >-
+          Space-separated module names to skip, typically unpublished ones. A name includes the
+          binary version, e.g. `docs_2.13 foo-it-tests_2.13`.
+        type: string
+        default: ''
+      configs_ignore:
+        description: 'Space-separated configurations to skip'
+        type: string
+        default: 'test integration-test scala-tool scala-doc-tool'
+
+permissions:
+  contents: write
+
+jobs:
+  submit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v7
+
+      - uses: coursier/cache-action@v8
+
+      - name: setup Java ${{ inputs.java_version }}
+        uses: actions/setup-java@v5
+        with:
+          java-version: ${{ inputs.java_version }}
+          distribution: ${{ inputs.java_distribution }}
+          cache: 'sbt'
+
+      - name: setup SBT
+        uses: sbt/setup-sbt@v1
+
+      - name: submit dependency graph
+        uses: scalacenter/sbt-dependency-submission@v3
+        with:
+          modules-ignore: ${{ inputs.modules_ignore }}
+          configs-ignore: ${{ inputs.configs_ignore }}

README.md

@@ -121,6 +121,50 @@ Note that the SonarQube Cloud GitHub App creates a check suite on every commit e
 it never analyses, which leaves a check permanently queued and reporting no result. Repositories not
 being analysed should have the app removed rather than left in that state.
 
+## Dependency graph workflow
+
+Submits the sbt dependency graph to GitHub. GitHub cannot parse `build.sbt` natively, so a repo
+that skips this gets **zero Dependabot alerts** and looks falsely clean. Every repo adopting these
+workflows MUST include it.
+
+### Setup
+
+Create `.github/workflows/dependency-graph.yml`, triggered on push to the default branch only:
+
+```yaml
+name: Dependency graph
+
+on:
+  push:
+    branches: [ master ]
+
+jobs:
+  submit:
+    uses: evolution-gaming/scala-github-actions/.github/workflows/dependency-graph.yml@<sha> # v6.2.0
+```
+
+Resolve `<sha>` the same way as for the CI workflow above.
+
+### Inputs
+
+| input               | default                                        | notes                                                              |
+|---------------------|------------------------------------------------|--------------------------------------------------------------------|
+| `java_version`      | `'17'`                                         |                                                                    |
+| `java_distribution` | `'temurin'`                                    |                                                                    |
+| `modules_ignore`    | `''`                                           | unpublished modules, with binary version, e.g. `docs_2.13`         |
+| `configs_ignore`    | `'test integration-test scala-tool scala-doc-tool'` | configurations excluded from the submitted graph             |
+
+Ignore modules that are never published (documentation, integration tests), so their dependencies
+do not generate alerts for artifacts nobody consumes:
+
+```yaml
+jobs:
+  submit:
+    uses: evolution-gaming/scala-github-actions/.github/workflows/dependency-graph.yml@<sha> # v6.2.0
+    with:
+      modules_ignore: 'docs_2.13 docs_3 foo-it-tests_2.13 foo-it-tests_3'
+```
+
 ## Scala Release workflow (v3, v4, v5)
 
 ### Setup