ci: preserve runtime and build dependencies in GitHub graphs

.github/CI_SECURITY.md

@@ -61,6 +61,14 @@ development dependencies. Graph reports and submission JSON are retained for
 inspection. Inspect representative ESAPI/AntiSamy HTTP transitives and Jakarta
 Spring/Tomcat dependencies in the resulting graph; alert counts are not gates.
 
+All four submissions use detector `encoder-maven-build-graph` with distinct,
+stable correlators. Keep the action's detector inputs synchronized with the
+Python build snapshot: GitHub [merges correlators from the same detector](https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-graph-data#prioritization),
+but selects between different detectors for a POM. Different detectors can hide
+runtime dependencies behind build-only results despite successful submissions.
+Check the final SBOM after both matrix jobs finish, including runtime versions
+and development dependencies together, not just the snapshot API status.
+
 Dependabot checks all library POMs, the parent and optional app weekly, with
 separate Maven and SHA-pinned Actions groups and grouped Maven security updates.
 Normal review and complete CI apply to automated PRs; no automatic merging is

.github/workflows/dependency-submission.yaml

@@ -49,6 +49,12 @@ jobs:
           # Package in the same invocation so the optional app resolves reactor JARs.
           maven-args: -B -ntp ${{ matrix.profile }} -DskipTests package
           correlator: encoder-${{ matrix.graph }}
+          # Match build-dependency-snapshot.py: GitHub merges correlators from one
+          # detector, but selects between different detectors for the same POM.
+          # Separate detectors would hide runtime dependencies behind build ones.
+          detector-name: encoder-maven-build-graph
+          detector-version: '1.0.0'
+          detector-url: https://github.com/OWASP/owasp-java-encoder
       - name: Resolve build plugins and their dependencies
         env:
           PROFILE: ${{ matrix.profile }}

releases/batch-02-validation.md

@@ -32,6 +32,14 @@ release tags, library algorithms or dependency versions were changed.
   correlators. Default-branch delivery and final SBOM verification are recorded
   in #169 after merge; an arbitrary number of alerts is not an acceptance gate.
 
+The first live default-branch run exposed GitHub's cross-detector manifest
+precedence: build-only submissions hid runtime dependencies for the same POM.
+The follow-up uses one detector with four separate correlators, which GitHub
+merges, preserving the real source POM paths and all runtime/test/build scopes.
+Final SBOM and follow-up delivery evidence are recorded in #169. A transient
+Dependabot security-update attempt during the initial incomplete graph reported
+`dependency_not_found`; no alert was manually dismissed or suppressed.
+
 All **26 checks** passed on the initial PR head, including the two new gates,
 all ten ESAPI versions, every packaged runtime, Java 8 unit tests, the browser
 build, three CodeQL analyses and both advisory build probes: