endive/.github/workflows/dependency-check.yaml at main · bytecodealliance/endive · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
name: Dependency Check

on:
  schedule:
    - cron: "30 2 * * *" # every day at 2:30 AM
  workflow_dispatch: # allow manual triggering

permissions:
  contents: read

jobs:
  dependency-check:
    name: OWASP Dependency Check
    runs-on: ubuntu-latest
    if: github.repository_owner == 'bytecodealliance'
    steps:
      - name: Checkout sources
        uses: actions/checkout@v7
      - name: Set up Java
        uses: actions/setup-java@v6
        with:
          distribution: 'temurin'
          java-version: '21'
          cache: maven
      - name: Build
        run: ./mvnw -B -Dquickly
      - name: Cache dependency-check data
        uses: actions/cache@v6
        with:
          path: ~/.m2/repository/org/owasp/dependency-check-data
          key: dependency-check-data-${{ github.run_id }}
          restore-keys: |
            dependency-check-data-
      - name: Run OWASP Dependency Check
        run: |
          ./mvnw -B org.owasp:dependency-check-maven:check \
            -DfailBuildOnCVSS=7 \
            -DsuppressedPaths=./dependency-check-suppressions.xml \
            -Dformats=HTML,JSON \
            -Danalyzer.ossindexAnalyzerEnabled=true \
            -DnvdDatafeedUrl=https://dependency-check.github.io/DependencyCheck_Builder/nvd_cache/nvdcve-{0}.json.gz \
            -DnvdApiKey=${{ secrets.NVD_API_KEY }}
        env:
          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
      - name: Upload report
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: dependency-check-report
          path: target/dependency-check-report.*
          retention-days: 30
          if-no-files-found: ignore