Skip to content

Commit 3da3587

Browse files
taoliulttaoliult
committed
Add scheduled org.owasp:dependency-check workflow
Add a GitHub Actions workflow to run the org.owasp dependency-check on a schedule. Use GitHub Actions cache to store the vulnerability database between runs to reduce download time and improve workflow reliability. Upload the generated dependency-check report as an artifact. Signed-off-by: Tao Liu <tao.liu@ibm.com>
1 parent 49d5ea8 commit 3da3587

2 files changed

Lines changed: 133 additions & 0 deletions

File tree

‎.github/workflows/dependency-check.yml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
###############################################################################
2+
#
3+
# Copyright IBM Corp. 2026, 2026
4+
#
5+
# This code is free software; you can redistribute it and/or modify it
6+
# under the terms provided by IBM in the LICENSE file that accompanied
7+
# this code, including the "Classpath" Exception described therein.
8+
###############################################################################
9+
10+
name: GitHub Actions OpenJCEPlus Dependency Check
11+
run-name: ${{ github.actor }} is running scheduled dependency check 🚀
12+
on:
13+
schedule:
14+
- cron: '0 10 */2 * *' # 10:00 UTC = 6:00 AM EDT, every other day.
15+
workflow_dispatch:
16+
jobs:
17+
Dependency-Check-OpenJCEPlus:
18+
name: Scheduled OpenJCEPlus Dependency Check
19+
runs-on: ${{ matrix.os }}
20+
permissions:
21+
actions: write
22+
checks: write
23+
contents: read
24+
strategy:
25+
matrix:
26+
os: [ubuntu-22.04]
27+
include:
28+
- os: ubuntu-22.04
29+
github_actions_runner_root: /
30+
steps:
31+
- run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event."
32+
- run: echo "🐧 This job is now running on a ${{ runner.os }} server."
33+
- run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
34+
- name: Check out repository code
35+
uses: actions/checkout@v4
36+
- run: echo "💡 The ${{ github.repository }} repository has been cloned to the runner."
37+
- run: echo "🖥️ The workflow is now ready to run dependency check on the runner."
38+
- name: List files in the repository
39+
run: |
40+
tree ${{ github.workspace }}
41+
- name: Setup Semeru JDK
42+
uses: actions/setup-java@v4
43+
with:
44+
java-version: '25.0.2'
45+
distribution: 'semeru'
46+
architecture: 'x64'
47+
- name: Compute Current OWASP Dependency-Check DB Cache Key
48+
id: cache-key
49+
run: |
50+
KEY="${{ runner.os }}-dependency-check-data-$(date +%F)-${{ github.run_number }}-${{ github.run_attempt }}"
51+
PREFIX="${{ runner.os }}-dependency-check-data-"
52+
echo "Computed key: $KEY"
53+
echo "Computed prefix: $PREFIX"
54+
echo "key=$KEY" >> "$GITHUB_OUTPUT"
55+
echo "prefix=$PREFIX" >> "$GITHUB_OUTPUT"
56+
- name: List Existing OWASP Dependency-Check DB Caches
57+
if: always()
58+
env:
59+
GH_TOKEN: ${{ github.token }}
60+
REPO: ${{ github.repository }}
61+
PREFIX: ${{ steps.cache-key.outputs.prefix }}
62+
run: |
63+
echo "Listing existing DB caches with prefix: $PREFIX"
64+
gh cache list --repo "$REPO" --key "$PREFIX" --limit 100
65+
- name: Restore OWASP Dependency-Check DB Cache
66+
uses: actions/cache/restore@v4
67+
with:
68+
path: ~/.m2/repository/org/owasp/dependency-check-data
69+
key: ${{ steps.cache-key.outputs.key }}
70+
restore-keys: |
71+
${{ steps.cache-key.outputs.prefix }}
72+
- name: Run OWASP Dependency-Check update-only
73+
id: dc-update
74+
run: >
75+
mvn
76+
--batch-mode
77+
dependency-check:update-only
78+
-DnvdApiDelay=12000
79+
- name: Save Current OWASP Dependency-Check DB Cache
80+
id: dc-save
81+
if: steps.dc-update.outcome == 'success'
82+
uses: actions/cache/save@v4
83+
with:
84+
path: ~/.m2/repository/org/owasp/dependency-check-data
85+
key: ${{ steps.cache-key.outputs.key }}
86+
- name: Run OWASP Dependency-Check check
87+
if: steps.dc-update.outcome == 'success'
88+
run: >
89+
mvn
90+
--batch-mode
91+
dependency-check:check
92+
-DnvdApiDelay=12000
93+
- name: Delete Older OWASP Dependency-Check DB Caches
94+
if: steps.dc-save.outcome == 'success'
95+
env:
96+
GH_TOKEN: ${{ github.token }}
97+
REPO: ${{ github.repository }}
98+
CURRENT_KEY: ${{ steps.cache-key.outputs.key }}
99+
PREFIX: ${{ steps.cache-key.outputs.prefix }}
100+
run: |
101+
gh cache list --repo "$REPO" --key "$PREFIX" --limit 100 | while read -r id key size created last_accessed ref; do
102+
if [ "$key" != "$CURRENT_KEY" ]; then
103+
echo "Deleting old cache: $key"
104+
gh cache delete "$key" --repo "$REPO" || true
105+
fi
106+
done
107+
- name: Upload OWASP Dependency-Check Report
108+
if: always()
109+
uses: actions/upload-artifact@v4
110+
with:
111+
name: dependency-check-report
112+
path: target/dependency-check-report.html
113+
- name: Add OWASP Dependency-Check Summary
114+
if: always()
115+
run: |
116+
echo "The Dependency Check Report was uploaded as artifact: \`dependency-check-report\`." >> $GITHUB_STEP_SUMMARY
117+
- run: echo "🍏 This job's status is ${{ job.status }}."

‎pom.xml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -668,6 +668,22 @@
668668
</execution>
669669
</executions>
670670
</plugin>
671+
<plugin>
672+
<groupId>org.owasp</groupId>
673+
<artifactId>dependency-check-maven</artifactId>
674+
<version>12.2.0</version>
675+
<configuration>
676+
<!-- disable those analyzer OpenJCEPlus don't use -->
677+
<nodeAnalyzerEnabled>false</nodeAnalyzerEnabled>
678+
<nodeAuditAnalyzerEnabled>false</nodeAuditAnalyzerEnabled>
679+
<retireJsAnalyzerEnabled>false</retireJsAnalyzerEnabled>
680+
<yarnAuditAnalyzerEnabled>false</yarnAuditAnalyzerEnabled>
681+
<pnpmAuditAnalyzerEnabled>false</pnpmAuditAnalyzerEnabled>
682+
<nuspecAnalyzerEnabled>false</nuspecAnalyzerEnabled>
683+
<assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
684+
<cocoapodsAnalyzerEnabled>false</cocoapodsAnalyzerEnabled>
685+
</configuration>
686+
</plugin>
671687
</plugins>
672688
<resources>
673689
<resource>

0 commit comments

Comments
 (0)