[ThoSap]

Why

The weekly run left the dependency graph up to a week old after a dependency update, unless someone started the workflow by hand. GitHub checks new advisories against the last submitted graph, so a run is needed only when the dependencies change.

What changed

With the new triggers, the dependency submission workflow runs on a push to main that changes a file which can change the resolved dependencies or the Gradle version, and on a manual run. The weekly cron is removed.

Review notes

• The paths list covers every file that declares versions in this repository today: the build scripts, gradle.properties, the version catalog and the Gradle wrapper. It also covers other version catalogs, dependency lock files and buildSrc, for later. A version that changes in a file outside the list does not start a run.
• A new release of dependency-submission-with-gradle@v4 can change the excluded configurations or the scopes without a change in this repository. The comment says to start the workflow by hand then.

Test scope

• The workflow file loads as YAML, with the triggers push and workflow_dispatch.
• Not run: the new trigger. It runs only after the merge to main, on the next change of a listed file.

Risk: needs a human review, assessed at 10d7dc1

• The self-review is current and has no open finding, and every changed file had a full review by GPT as well.
• The repository has no freshness Action, so the PR cannot get risk:low.