ci: submit Android release runtime dependencies to the dependency graph

[mattinannt]

Summary

Addresses ENG-3869. GitHub's dependency graph reads Pub packages from pubspec.lock, but not the Maven artifacts behind the Flutter plugins' Android code. Those are the native libraries an app built with the SDK pulls in (for example androidx.webkit via webview_flutter_android), and Dependabot alerts never covered them.

• dependency-submission.yml resolves the playground app's releaseRuntimeClasspath with the Gradle dependency-submission action and submits it to the dependency graph.
  • Runs on main pushes, weekly (keeps the graph fresh), and on demand. Dispatching from another branch is a dry run.
  • Fails instead of submitting a snapshot that is for a different commit/ref, has fewer than 50 components, or lacks androidx.webkit.
  • Keeps the submitted snapshot as dependency-snapshot-<sha> (90 days), so coverage is tied to the commit.
  • Wrapper validated; Actions pinned to commit SHAs; no caching.
• Dependabot gradle entry for plugin versions in settings.gradle.kts.
• dependency-review.yml: fails a PR that introduces a High/Critical vulnerability in Pub packages.
• docs/DEPENDENCY_SECURITY.md: inventory (SDK runtime, native, build/publish, playground), scope, how findings are handled, and limitations.

Scope

Only the release runtime classpath is submitted. Gradle build tooling (Android Gradle Plugin internals, plugin classpaths) and debug/test scaffolding are deliberately excluded, so they raise no alerts. Measured locally at 7345fa5:

Components submitted	93, including androidx.webkit@1.15.0
Match with Gradle's own :app:dependencies --configuration releaseRuntimeClasspath	exact (92 libraries) plus the graph plugin's own entry
Known advisories (OSV) on the submitted components	none
Excluded build tooling	contains High/Critical advisories in AGP internals (netty, bouncycastle, …); they affect build machines, not built apps

The published formbricks package is Dart-only (no android/ or ios/), the release workflow does not run Gradle, and the playground is publish_to: none. iOS uses Swift Package Manager and its plugins have no third-party native dependencies, so there is nothing to submit there. See the doc for how to widen the scope if build-environment exposure matters.

Validation

• actionlint is clean on the new workflows; dart format and the Prettier check pass.
• The snapshot validation script was run against the real filtered snapshot: passes for the right SHA/ref and fails for a wrong SHA, a wrong ref, a partial snapshot, a snapshot without androidx.webkit, and no snapshot.
• The Gradle resolution with the same project/configuration filters was run locally with the pinned Flutter SDK.
• Not yet verified: the Dependency Submission workflow on GitHub Actions (it does not run on pull requests; a manual dispatch from this branch is a dry run), and whether Dependabot can evaluate the Gradle project without local.properties.

Limitations (documented)

• Snapshots are submitted for the default branch only; Dependency Review covers Pub changes on PRs, not Gradle.
• The graph reflects the playground's resolution, not a particular customer's app.
• Not scanned: Flutter SDK, pana, prettier and its npm tree, CI runner images.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TQhEETSsYBHyfowFNUmga6

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3184533f-0175-4b9d-b8f8-24f8ba5d9ac0

---

📥 Commits

Reviewing files that changed from the base of the PR and between 7345fa5 and eb2ed5e.

---

📒 Files selected for processing (5)

• .github/dependabot.yml
• .github/workflows/dependency-review.yml
• .github/workflows/dependency-submission.yml
• .gitignore
• docs/DEPENDENCY_SECURITY.md

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

Walkthrough

The pull request adds weekly Gradle dependency updates and dependency review on pull requests. It also adds a workflow that generates, validates, archives, and conditionally submits an Android dependency snapshot. Documentation describes dependency coverage and finding triage, and .gitignore excludes generated snapshot reports.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to eb2ed

This change adds dependency scanning workflows and documentation without altering SDK runtime behavior. No merge-blocking issue was found; the new workflow and Dependabot behavior should be confirmed after the first runs on main.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the main change: submitting Android release runtime dependencies to the dependency graph.
Description check		The description directly explains the dependency graph workflow, related CI changes, validation, scope, and limitations.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}