inspectit-ocelot/.github/workflows/configurationserver_security_check.yml at master · inspectIT/inspectit-ocelot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
name: Automatic Security Check Configuration-Server

on:
  workflow_dispatch:
  schedule:
    - cron: "0 8 1,15 * *" # At 08:00 on day-of-month 1 and 15

jobs:
  security-check:
    name: Security Check Configuration-Server
    runs-on: ubuntu-latest
    container: eclipse-temurin:21
    steps:
      - uses: actions/checkout@v4
      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      - name: build Configuration-Server
        run: ./gradlew :inspectit-ocelot-configurationserver:bootJarWithFrontend
      - name: Run DependencyCheck Backend
        uses: dependency-check/Dependency-Check_Action@main
        id: depcheck
        continue-on-error: true
        with:
          project: inspectIT/inspectit-ocelot-configuration-server
          path: 'components/inspectit-ocelot-configurationserver'
          format: 'HTML'
          out: 'reports/configuration-server'
          args: >
            --disableAssembly
            --disableNodeAudit
            --nvdApiKey ${{ secrets.NVD_API_KEY }}
            --nvdApiDelay 10000
      - name: Run DependencyCheck UI
        uses: dependency-check/Dependency-Check_Action@main
        id: depcheck-ui
        continue-on-error: true
        with:
          project: inspectIT/inspectit-ocelot-configuration-server-ui
          path: 'components/inspectit-ocelot-configurationserver-ui'
          format: 'HTML'
          out: 'reports/configuration-server-ui'
          args: >
            --suppression components/inspectit-ocelot-configurationserver-ui/dependencyCheckSuppression.xml
            --disableAssembly
            --disableNodeAudit
            --nvdApiKey ${{ secrets.NVD_API_KEY }}
            --nvdApiDelay 10000
      - name: build ConfigDocsGenerator
        run: ./gradlew :inspectit-ocelot-configdocsgenerator:assemble
      - name: Run DependencyCheck ConfigDocsGenerator
        uses: dependency-check/Dependency-Check_Action@main
        id: depcheck-docs
        continue-on-error: true
        with:
          project: inspectIT/inspectit-ocelot-configdocsgenerator
          path: 'components/inspectit-ocelot-configdocsgenerator'
          format: 'HTML'
          out: 'reports/configdocsgenerator'
          args: >
            --disableAssembly
            --disableNodeAudit
            --nvdApiKey ${{ secrets.NVD_API_KEY }}
            --nvdApiDelay 10000
      - name: build ConfigSchemaGenerator
        run: ./gradlew :inspectit-ocelot-configschemagenerator:assemble
      - name: Run DependencyCheck ConfigSchemaGenerator
        uses: dependency-check/Dependency-Check_Action@main
        id: depcheck-schema
        continue-on-error: true
        with:
          project: inspectIT/inspectit-ocelot-configschemagenerator
          path: 'components/inspectit-ocelot-configschemagenerator'
          format: 'HTML'
          out: 'reports/configschemagenerator'
          args: >
            --disableAssembly
            --disableNodeAudit
            --nvdApiKey ${{ secrets.NVD_API_KEY }}
            --nvdApiDelay 10000
      - name: Upload test results
        uses: actions/upload-artifact@v4
        with:
          name: dependency-check-report-ocelot-configurationserver
          path: ${{ github.workspace }}/reports
      - name: Set DependencyCheck status
        run: |
          if [ ${{ steps.depcheck.outcome == 'failure' || steps.depcheck-ui.outcome == 'failure' || steps.depcheck-docs.outcome == 'failure' || steps.depcheck-schema.outcome == 'failure' }} == "true" ]; then
            echo "DEP_CHECK_STATUS=failure" >> $GITHUB_ENV
          else
            echo "DEP_CHECK_STATUS=success" >> $GITHUB_ENV
          fi
      # Since GitHub cannot send emails directly, we use an external API
      - name: Send Notification via Resend
        run: |
          curl -X POST https://api.resend.com/emails \
            -H "Authorization: Bearer ${{ secrets.RESEND_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{
              "from": "inspectIT Ocelot DepCheck <inspectit-ocelot-depcheck@resend.dev>",
              "to": ["info.inspectit@novatec-gmbh.de"],
              "subject": "Ocelot-Configuration-Server Dependency-Check Report - ${{ steps.depcheck.outcome }}",
              "html": "<p>The Dependency-Check for inspectit-ocelot-configurationserver completed with status: <strong>${{ steps.depcheck.outcome }}</strong></p><p>Please check the report here: <a href='https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'>View Report</a></p>"
            }'
      # if DependencyCheck failed, the job should also fail, but only after the results were uploaded
      - name: Validate DependencyCheck outcome
        if: ${{ env.DEP_CHECK_STATUS == 'failure' }}
        run: |
          echo "DependencyCheck failed"
          exit 1