Support manual Gradle dependency graph submission

Author: whyoleg

.github/actions/setup-environment/action.yml

@@ -7,6 +7,9 @@ inputs:
   cache-read-only:
     description: 'gradle.cache-read-only'
     default: 'true'
+  submit-dependency-graph:
+    description: 'gradle.dependency-graph.generate-and-submit'
+    default: 'false'
 runs:
   using: 'composite'
   steps:
@@ -36,6 +39,8 @@ runs:
 
         cache-disabled: ${{ inputs.cache-disabled }}
         cache-read-only: ${{ inputs.cache-read-only }}
+
+        dependency-graph: ${{ (inputs.submit-dependency-graph == 'true') && 'generate-and-submit' || 'disabled' }}
     - if: runner.os == 'Windows'
       uses: msys2/setup-msys2@v2
       with:

.github/workflows/ci-branch.yml

@@ -9,3 +9,5 @@ on:
 jobs:
   checks:
     uses: ./.github/workflows/run-checks.yml
+    permissions:
+      contents: write

.github/workflows/ci-main.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   checks:
     uses: ./.github/workflows/run-checks.yml
+    permissions:
+      contents: write
 
   publish:
     needs: [ checks ]

.github/workflows/run-build-project.yml

@@ -19,6 +19,7 @@ jobs:
       - uses: ./.github/actions/setup-environment
         with:
           cache-read-only: ${{ github.ref_name != 'main' }}
+          submit-dependency-graph: true
       - run: >
           ./gradlew
           build publishToMavenLocal

.github/workflows/run-checks.yml

@@ -6,6 +6,8 @@ on:
 jobs:
   build-project:
     uses: ./.github/workflows/run-build-project.yml
+    permissions:
+      contents: write
 
   build-website:
     needs: [ build-project ]