cve-scanning-maven.yml

name: CVE Scanning for Maven

on:
  workflow_dispatch:
  schedule:
    - cron: '0 8,18 * * 1-5'
  push:
    paths:
      - '**/pom.xml'
      - '.github/workflows/maven-cve-ignore-list.xml'
      - '.github/workflows/cve-scanning-maven.yml'
  pull_request:
    paths:
      - '**/pom.xml'
      - '.github/workflows/maven-cve-ignore-list.xml'
      - '.github/workflows/cve-scanning-maven.yml'

jobs:
  depchecktest:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        java-version: [ '21' ]
        module-folder: [
          'translator'
        ]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup JDK
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java-version }}
          cache: maven
          distribution: 'adopt'
      - name: Build with Maven
        run: mvn clean install -Dmaven.test.skip=true
        working-directory: ${{ matrix.module-folder }}
      - name: Depcheck
        uses: dependency-check/Dependency-Check_Action@main
        id: Depcheck
        env:
          JAVA_HOME: /opt/jdk
        with:
          project: '${{ matrix.module-folder }}'
          path: '${{ matrix.module-folder }}'
          format: 'HTML'
          out: '${{ matrix.module-folder }}-reports' # this is the default, no need to specify unless you wish to override it
          args: >
            --suppression .github/maven-cve-ignore-list.xml
            --failOnCVSS 5
            --enableRetired

      - name: Upload Test results
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: Depcheck report ${{ github.job }} ${{ matrix.module-folder }}
          path: ${{ github.workspace }}/${{ matrix.module-folder }}-reports