backend_owasp_dependency_check.yml

name: OWASP Dependency Check ensure no vulnerable dependencies
run-name: OWASP Dependency Check
on:
  workflow_call:
    secrets:
      NIST_OWASP_API_KEY:
        description: "API Key for the national vulnerability database used by OWASP Dependency Check"
        required: true
jobs:
  owasp-dependency-check:
    name: OWASP Dependency Check
    runs-on: ubuntu-latest
    timeout-minutes: 100
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up JDK 25
        uses: actions/setup-java@v5
        with:
          java-version: '25'
          distribution: 'corretto'

      - name: Get Date for OWASP Cache
        id: get-cache-date
        run: |
          echo "date=$(/bin/date -u "+%Y%m%d")" >> $GITHUB_OUTPUT
        shell: bash

      - name: check NIST key length
        env:
          NIST_OWASP_API_KEY: ${{ secrets.NIST_OWASP_API_KEY }}
        run: |
          echo "Key length: ${#NIST_OWASP_API_KEY}"

      - name: Restore Maven Cache
        uses: actions/cache/restore@v5
        with:
          path: ~/.m2/repository
          # Using date in cache key as OWASP database may change, without the pom changing
          key: ${{ runner.os }}-owasp-${{ steps.get-cache-date.outputs.date }}-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-owasp-${{ steps.get-cache-date.outputs.date }}
            ${{ runner.os }}-owasp-

      - name: Maven install
        run: mvn -B install -DskipTests -T 1C

      - name: Run OWASP Dependency Check
        run: |
          mvn org.owasp:dependency-check-maven:check \
            -DossindexAnalyzerEnabled=false \
            -DnvdApiKey=${{ secrets.NIST_OWASP_API_KEY }} \
            -DossindexAnalyzerEnabled=false \
            -DpnpmAuditAnalyzerEnabled=false \
            -DnodeAuditAnalyzerEnabled=false \
            -DyarnAuditAnalyzerEnabled=false

      - name: Save Maven Cache
        uses: actions/cache/save@v5
        if: always()
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-owasp-${{ steps.get-cache-date.outputs.date }}-${{ hashFiles('**/pom.xml') }}