| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849 |
- # the benefit of this over dependabot is that this also analyzes transitive dependencies
- # while dependabot (at least currently) only analyzes top-level dependencies
- name: OWASP dependency check (daily)
- on:
- schedule:
- # daily at 1:30 UTC
- - cron: "30 1 * * *"
- workflow_dispatch:
- jobs:
- analyze:
- runs-on: ubuntu-latest
- steps:
- - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
- - name: Free disk space
- run: .github/scripts/gha-free-disk-space.sh
- - name: Set up JDK for running Gradle
- uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
- with:
- distribution: temurin
- java-version: 17.0.6
- - name: Increase gradle daemon heap size
- run: |
- sed -i "s/org.gradle.jvmargs=/org.gradle.jvmargs=-Xmx3g /" gradle.properties
- - uses: gradle/actions/setup-gradle@750cdda3edd6d51b7fdfc069d2e2818cf3c44f4c # v3.3.1
- with:
- arguments: ":javaagent:dependencyCheckAnalyze"
- env:
- NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
- - name: Upload report
- if: always()
- uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba # v4.3.2
- with:
- path: javaagent/build/reports
- workflow-notification:
- needs:
- - analyze
- if: always()
- uses: ./.github/workflows/reusable-workflow-notification.yml
- with:
- success: ${{ needs.analyze.result == 'success' }}
|
