add additional pr checks (unit tests, detekt, and build), update the … #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OWASP Dependency Check | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| workflow_call: | |
| jobs: | |
| dependency-check: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write # Required to upload SARIF to the GitHub Security tab | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 | |
| with: | |
| java-version: '21' | |
| distribution: 'temurin' | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4 | |
| - name: Restore NVD cache | |
| uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: ~/.gradle/dependency-check-data | |
| key: nvd-${{ runner.os }}-seed- | |
| restore-keys: | | |
| nvd-${{ runner.os }}-seed- | |
| nvd-${{ runner.os }}- | |
| - name: Run OWASP Dependency Check | |
| env: | |
| # Set NVD_API_KEY as a GitHub Actions secret for reliable NVD access. | |
| # Free key: https://nvd.nist.gov/developers/request-an-api-key | |
| # Without a key the scan still runs but is rate-limited (slow). | |
| NVD_API_KEY: ${{ secrets.NVD_API_KEY }} | |
| run: ./gradlew dependencyCheckAggregate --no-daemon --no-configuration-cache --info | |
| - name: Print vulnerability summary | |
| if: always() | |
| run: | | |
| report="build/reports/dependency-check-report.json" | |
| if [ ! -f "$report" ]; then | |
| echo "No report generated — scan may have failed before producing output." | |
| exit 0 | |
| fi | |
| count=$(jq '[.dependencies[] | select(.vulnerabilities != null) | .vulnerabilities[]] | length' "$report") | |
| echo "Vulnerabilities found: $count" | |
| if [ "$count" -gt 0 ]; then | |
| echo "" | |
| jq -r ' | |
| .dependencies[] | |
| | select(.vulnerabilities != null) | |
| | . as $dep | |
| | .vulnerabilities[] | |
| | " \($dep.fileName)\n CVE : \(.name)\n CVSS: \(.cvssv3.baseScore // .cvssv2.score // "N/A")\n \(.description | if length > 120 then .[:120] + "…" else . end)" | |
| ' "$report" | |
| fi | |
| - name: Upload HTML report | |
| if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: dependency-check-report | |
| path: build/reports/dependency-check-report.html | |
| if-no-files-found: warn | |
| - name: Upload SARIF to GitHub Security tab | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3 | |
| with: | |
| sarif_file: build/reports/dependency-check-report.sarif |