Make use of sbt-dependency-submission

[mkurz]

https://www.scala-lang.org/blog/2022/07/18/secure-your-dependencies-on-github.html

[mkurz]

sbt uses it already: sbt/sbt#6960

See #240

[mkurz]

I set up the workflow in all repositories now.

It's working, however for three repos the workflow is currenty failing, but they should turn green as soon as we release a Play 2.9 version with Scala 3 artifacts, which should automatically fixed those workflows (right now they can't download the _3 deps):

• https://github.com/playframework/anorm/actions/workflows/dependency-graph.yml
• https://github.com/playframework/play-json/actions/workflows/dependency-graph.yml (Done)
• https://github.com/playframework/scalatestplus-play/actions/workflows/dependency-graph.yml (Done)

The only thing which is still missing, because the action does not support it, is to add multiple independent projects within a single repo. I opened an issue for that: scalacenter/sbt-dependency-submission#84
As a reminder: As soon as that issues gets fixed we can set up the action for the misssing projects (except the root one) in following repos:

• https://github.com/playframework/playframework
  • ./documentation/build.sbt can be added separately.
• https://github.com/playframework/play-mailer
  • ./samples/runtimeDI/build.sbt can be added separately.
  • ./samples/compile-timeDI/build.sbt can be added separately.
• https://github.com/playframework/play-ebean
  • ./docs/build.sbt can be added separately.
• https://github.com/playframework/twirl
  • ./docs/build.sbt can be added separately.
• https://github.com/playframework/play-samples
  • All ./play-[java|scala]-*/build.sbt can be added separately.

[mkurz]

...and along the way I fixed scala-steward itself and made sure our repos all get visited again by scala-steward, including independent non-root projects within a repo:

• Check up to 5 nested project folders scala-steward-org/scala-steward#2995
• Make sure remote is always called "origin" when cloning git repo scala-steward-org/scala-steward#2996
• Why is scala-steward never visiting our repo? VirtusLab/scala-steward-repos#179
• PRs not being sent in for various projects VirtusLab/scala-steward-repos#98 (comment)
• [2.8.x] Make scala steward visit this repo again play-samples#201
• [2.8.x] Fix play-[java|scala]-telemetry-example play-samples#202
• Make sure samples are also visited by scala-steward play-mailer#243
• and more...