vuu/.github/workflows/cve-scanning.yml at 964f5c26304e5f9791edd3135db67fbbc3807f32 · finos/vuu · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
name: Maven CVE Scanning

on:
  workflow_dispatch:
  push:
    branches:
      - "main"
      - "release-*"

jobs:

  depchecktest:
    runs-on: ubuntu-latest

    env:
      OSS_INDEX_USERNAME: ${{ secrets.OSS_INDEX_USERNAME }}
      OSS_INDEX_API_KEY: ${{ secrets.OSS_INDEX_API_KEY }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Make mvnw executable
        run: chmod +x mvnw

      - name: Build project with Maven
        run: ./mvnw -B -ntp clean install -DskipTests

      - name: Run OWASP Dependency-Check on Maven subprojects
        if: ${{ env.OSS_INDEX_USERNAME != '' && env.OSS_INDEX_API_KEY != '' }}
        uses: dependency-check/Dependency-Check_Action@1e54355a8b4c8abaa8cc7d0b70aa655a3bb15a6c
        id: Depcheck
        with:
          project: "vuu"
          path: "vuu"
          format: "HTML"
          out: "reports" # this is the default, no need to specify unless you wish to override it
          args: >
            --ossIndexUsername ${{ env.OSS_INDEX_USERNAME }}
            --ossIndexPassword ${{ env.OSS_INDEX_API_KEY }}
            --suppression allow-list.xml
            --failOnCVSS 7
            --enableRetired

      - name: Upload Test results
        if: ${{ always() }}
        uses: actions/upload-artifact@v5
        with:
          name: Depcheck report
          path: ${{ github.workspace }}/reports