feat(dependabot): add DependencyGuard baseline on PRs (#924)

.github/workflows/dependabot-dependency-guard.yml

@@ -0,0 +1,36 @@
+name: 🤖 Dependabot Dependency Guard baseline
+on:
+  pull_request:
+    paths:
+      - '**.gradle.kts'
+      - 'gradle/libs.versions.toml'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  baseline:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]' && startsWith(github.head_ref, 'dependabot/gradle/')
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          token: ${{ secrets.PAT_SPARK }}
+      - uses: ./.github/actions/setup-java
+      - uses: ./.github/actions/setup-gradle
+      - uses: ./.github/actions/setup-gradle-properties
+      - run: ./gradlew dependencyGuardBaseline
+      - run: |
+          if ! git diff --quiet --exit-code -- ':(glob)**/dependencies/*.txt';
+          then
+            git config --global user.name "dependabot[bot]"
+            git config --global user.email "49699333+dependabot[bot]@users.noreply.github.com"
+            git commit -m "🤖 Update dependencies baseline" -m "[dependabot skip]" -- ':(glob)**/dependencies/*.txt'
+            git show
+            git push
+            echo "::notice::UPDATED"
+          else
+            echo "::notice::UP-TO-DATE"
+          fi