.github/workflows/owasp.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: OWASP checkup

on:
  # Not a required check, so path filtering cannot leave a pull request blocked.
  pull_request:
    paths:
      - '**/pom.xml'
      - 'src/etc/project-suppression.xml'
      - '.github/workflows/owasp.yml'
  push:
    branches:
      - 'main'
      - 'develop'
      - 'release/*'
      - 'support/*'
  workflow_dispatch: #Allow manual triggers

permissions: read-all

# Pull requests cancel superseded runs; pushes get unique groups so none is dropped.
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

env:
  MAVEN_OPTS: -Xmx2048m -Xms1024m
  LANG: en_US.utf8

jobs:
  owasp:
    name: OWASP
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      HAVE_NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY != '' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
      - name: Detect changes
        id: changes
        uses: ./.github/actions/detect-changes
      - name: Setup Java 25
        if: steps.changes.outputs.code == 'true'
        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 25
          cache: 'maven'

      - name: Cache NVD Database
        id: cache-nvd
        if: steps.changes.outputs.code == 'true'
        uses: actions/cache/restore@v6
        with:
          path: ~/.m2/repository/org/owasp/dependency-check-data
          key: nvd-cache-${{ runner.os }}-owasp-${{ github.run_id }}
          restore-keys: |
            nvd-cache-${{ runner.os }}-owasp-
            nvd-cache-${{ runner.os }}-

      - name: OWASP Dependency check update cache via NIST_NVD_API_KEY
        id: nvd-api-update
        if: ${{ steps.changes.outputs.code == 'true' && env.HAVE_NIST_NVD_API_KEY == 'true' }}
        continue-on-error: true
        run:  mvn -N -V -DskipAssembly -Dmaven.test.skip=true -Powasp-nvd-api -Pdependency-update-only --no-transfer-progress
        env:
          NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY}}

      - name: OWASP Dependency check update cache via Mirror
        if: ${{ steps.changes.outputs.code == 'true' && (env.HAVE_NIST_NVD_API_KEY == 'false' || steps.nvd-api-update.outcome == 'failure') }}
        run:  mvn -N -V -DskipAssembly -Dmaven.test.skip=true -Powasp-nvd-mirror -Pdependency-update-only --no-transfer-progress

      - name: Cache NVD Database
        uses: actions/cache/save@v6
        if: ${{ always() && steps.changes.outputs.code == 'true' }}
        with:
          path: ~/.m2/repository/org/owasp/dependency-check-data
          key: nvd-cache-${{ runner.os }}-owasp-${{ github.run_id }}

      - name: OWASP check (Without running tests)
        if: steps.changes.outputs.code == 'true'
        run: mvn -B org.owasp:dependency-check-maven:aggregate -Pdependency-check -Pjakartaee11 -DautoUpdate=false --no-transfer-progress

      - name: Upload Dependency Check reports
        uses: actions/upload-artifact@v7
        if: always() && steps.changes.outputs.code == 'true'
        with:
          name: dependency-check
          path: target/dependency-check*

      - name: Add OWASP summary
        if: always() && steps.changes.outputs.code == 'true'
        run: |
          {
            echo "## OWASP Dependency Check"
            echo ""
            echo "The HTML report has been uploaded as the **dependency-check** artifact."
            echo "Download it from the Artifacts section of this workflow run."
          } >> "$GITHUB_STEP_SUMMARY"