Move deps check and add bad dep

.github/workflows/build.yml

@@ -24,19 +24,10 @@ jobs:
   build:
     permissions:
       packages: write
-      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
       - uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # v1.1.0
-      - name: Dependency Review
-        uses: actions/dependency-review-action@v3
-        with:
-          comment-summary-in-pr: true
-          # Think carefully about the implications of adding dependencies with new licence types.
-          # Licence ids: https://spdx.org/licenses/
-          # License risks: https://brainhub.eu/library/open-source-licenses-to-avoid
-          allow-licenses: MIT
       - name: Fetch version history
         # Do NOT want to fetch all tags if building a specific tag.
         # Doing so could result in code published with wrong version, if newer tags have been pushed

.github/workflows/submit-dependencies.yml

@@ -11,7 +11,7 @@ permissions:
   contents: read
 
 jobs:
-  build:
+  submit-deps:
     permissions:
       contents: write
     runs-on: ubuntu-latest
@@ -34,4 +34,18 @@ jobs:
           DEPENDENCY_GRAPH_INCLUDE_PROJECTS: "^:(?!(buildSrc|test-)).*"
         run: ./gradlew allDeps --configuration runtimeClasspath
 
-
+  check-dependencies:
+    needs: submit-deps
+    permissions:
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.0.0
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v3
+        with:
+          comment-summary-in-pr: true
+          # Think carefully about the implications of adding dependencies with new licence types.
+          # Licence ids: https://spdx.org/licenses/
+          # License risks: https://brainhub.eu/library/open-source-licenses-to-avoid
+          allow-licenses: MIT

type/build.gradle.kts

@@ -26,4 +26,8 @@ dependencies {
     implementation("com.github.spotbugs:spotbugs-annotations:$spotBugsVersion")
 
     // Do not add any other non-test runtime dependencies
+
+
+    // Add temp BAD dependency to check depenency checker is working:
+    implementation("commons-collections:commons-collections:3.2.1")
 }