owasp-dependency-check.yml

# SPDX-FileCopyrightText: 2024 LibreCode coop and contributors
# SPDX-License-Identifier: AGPL-3.0-or-later

name: "OWASP Dependency-Check"

on: pull_request

jobs:
  dependency-check:
    if: false # temporary disabled
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Run OWASP Dependency-Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          format: 'ALL'
          project: 'LibreSign'
          path: './'
          args: >
            --failOnCVSS 7
            --enableRetired
            --enableExperimental

      - name: Upload Dependency-Check report
        uses: actions/upload-artifact@master
        with:
          name: dependency-check-report
          path: dependency-check-report.html