From e4ecc3992ea0df5f63c0ca1f4590aa0de10773a6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 9 Sep 2026 18:39:02 +0000
Subject: [PATCH 1/2] Initial plan


From c487ae2c52f0b8e4dd513aee681c61ecfd5b9cce Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 9 Sep 2026 18:44:07 +0000
Subject: [PATCH 2/2] fix(ci): submit dependency snapshots on PRs

Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com>
---
 .github/workflows/dependency-review.yml       | 15 +++++++
 tests/unit/test_dependency_review_workflow.py | 41 +++++++++++++++++++
 2 files changed, 56 insertions(+)
 create mode 100644 tests/unit/test_dependency_review_workflow.py

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 56bf29340..8a113bcef 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -27,13 +27,28 @@ concurrency:
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+
+      - name: Submit dependency snapshots
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: advanced-security/component-detection-dependency-submission-action@31f25a8de68ae5ce2ca274bc28546a78683c15ce # v0.1.4
+        with:
+          snapshot-sha: ${{ github.event.pull_request.head.sha }}
+          snapshot-ref: ${{ format('refs/heads/{0}', github.event.pull_request.head.ref) }}
 
       - name: Dependency Review
         uses: actions/dependency-review-action@v5
         with:
+          retry-on-snapshot-warnings: true
+          retry-on-snapshot-warnings-timeout: 300
           fail-on-severity: moderate
           # GHSA-w5hq-g745-h8pq: transitive uuid@8.3.2 pulled by next-auth@4.24 (which pins uuid ^8.3.2).
           # The moderate advisory affects uuid v3/v5/v6 when a caller-provided buffer is passed; next-auth
diff --git a/tests/unit/test_dependency_review_workflow.py b/tests/unit/test_dependency_review_workflow.py
new file mode 100644
index 000000000..4efacbfd2
--- /dev/null
+++ b/tests/unit/test_dependency_review_workflow.py
@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+WORKFLOW_PATH = Path(__file__).resolve().parents[2] / ".github/workflows/dependency-review.yml"
+
+
+def _load_workflow() -> dict:
+    assert WORKFLOW_PATH.exists(), "dependency-review workflow should exist"
+    workflow = yaml.safe_load(WORKFLOW_PATH.read_text())
+    return workflow if "on" in workflow else {**workflow, "on": workflow[True]}
+
+
+def test_dependency_review_submits_pr_head_snapshot_and_retries_warnings() -> None:
+    workflow = _load_workflow()
+    job = workflow["jobs"]["dependency-review"]
+    steps = job["steps"]
+
+    checkout = next(step for step in steps if step["name"] == "Checkout code")
+    assert checkout["with"]["ref"] == "${{ github.event.pull_request.head.sha }}"
+
+    submission = next(
+        step
+        for step in steps
+        if step.get("uses", "").startswith(
+            "advanced-security/component-detection-dependency-submission-action@"
+        )
+    )
+    assert submission["if"] == (
+        "${{ github.event.pull_request.head.repo.full_name == github.repository }}"
+    )
+    assert submission["with"]["snapshot-sha"] == "${{ github.event.pull_request.head.sha }}"
+    assert submission["with"]["snapshot-ref"] == (
+        "${{ format('refs/heads/{0}', github.event.pull_request.head.ref) }}"
+    )
+
+    review = next(step for step in steps if step["name"] == "Dependency Review")
+    assert review["with"]["retry-on-snapshot-warnings"] is True
+    assert review["with"]["retry-on-snapshot-warnings-timeout"] == 300