Add Build Backend Module CI and OWASP dependency check

[wikumChamith]

• Add OWASP dependency check workflow and integrate it into the CI pipeline
• Fix ChromeHeadless sandbox issue in GitHub Actions by switching to a custom ChromeHeadlessNoSandbox launcher
• Disable Node Audit Analyzer due to incompatible npm-shrinkwrap.json

[dkayiwa]

Are we going to duplicate this in every module?

[wikumChamith]

Nope. We can simplify this after the PR in the openmrs/openmrs-contrib-gha-workflows gets merged.

name: Build with Maven

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

jobs:
  build:
    uses: openmrs/openmrs-contrib-gha-workflows/.github/workflows/build-backend-module.yml@main
    with:
      java_versions: '[8, 11, 17, 21]'
      main_java_version: '8'
    secrets:
      NVD_API_KEY: ${{ secrets.NVD_API_KEY }}

[ibacher]

@dkayiwa My goal here was to have a smaller blast radius to look at the effects this will have. My concern is that there will be vulnerable dependencies marked in this module, but which are included as part of openmrs-core and not directly as part of this module. This is is a useful testbed because coreapps literally has no dependencies that it bundles itself, so everything is transitive and should be excluded.

[dkayiwa]

Oh i see. 😊

[ibacher]

@wikumChamith However, can we inline this so that the build can be done on the PR? That way we don't need to merge this in to get a result.

[wikumChamith]

@ibacher Since the PR for the reusable OWASP check has been merged, we can use that here instead. We can remove the OWASP build from this module 🙂

openmrs/openmrs-contrib-gha-workflows@ba65e5f