diff --git a/.github/workflows/code-quality-check-sonar.yml b/.github/workflows/code-quality-check-sonar.yml index 92963ef..c727eb8 100644 --- a/.github/workflows/code-quality-check-sonar.yml +++ b/.github/workflows/code-quality-check-sonar.yml @@ -42,29 +42,4 @@ jobs: # note that we deliberately turn off the OWASP dependency checker here, it will run in a separate job, # such that its results can be viewed independently of what Sonar has to say run: | - mvn -B verify sonar:sonar -Dsonar.projectKey=siemens_cmp-ra-component -Ddependency-check.skip=true -Dgpg.skip - -# analyze_dependencies_owasp: -# name: Check dependencies with OWASP -# runs-on: ubuntu-latest -# steps: -# - uses: actions/checkout@v4 -# with: -# fetch-depth: 0 -# - name: Set up JDK 17 -# uses: actions/setup-java@v4 -# with: -# java-version: 17 -# distribution: 'temurin' -# - name: Cache Maven packages -# uses: actions/cache@v4 -# with: -# path: ~/.m2 -# key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} -# restore-keys: ${{ runner.os }}-m2 -# - name: Analyze dependencies -# env: -# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} -# OSS_INDEX_PASSWORD: ${{ secrets.OSS_INDEX_PASSWORD }} -# OSS_INDEX_USERNAME: ${{ secrets.OSS_INDEX_USERNAME }} -# run: mvn dependency-check:check -DnvdApiKey=${{ secrets.NVD_TOKEN }} + mvn -B verify sonar:sonar -Dsonar.projectKey=siemens_cmp-ra-component -Dgpg.skip diff --git a/.github/workflows/dependency-check-develop.yml b/.github/workflows/dependency-check-develop.yml deleted file mode 100644 index ff66c32..0000000 --- a/.github/workflows/dependency-check-develop.yml +++ /dev/null @@ -1,139 +0,0 @@ -name: Dependency Check (Develop Cache Builder) - -on: - schedule: - - cron: "0 0 * * *" # midnight daily - workflow_dispatch: - inputs: - force_update: - description: "Force update even if no changes" - required: false - default: "false" - update_only: - description: "Only update cache (skip scan)" - required: false - default: "false" - -jobs: - dependency-check-develop: - runs-on: ubuntu-latest - - env: - NVD_API_KEY: ${{ secrets.NVD_API_KEY }} - - steps: - # Checkout develop branch - - name: Checkout develop - uses: actions/checkout@v4 - with: - ref: develop - - # Get current commit hash - - name: Get current commit - id: current - run: echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - # Restore last processed commit - - name: Restore last state - uses: actions/download-artifact@v4 - with: - name: last-run-state - continue-on-error: true - - - name: Read last commit - id: lastcommit - run: | - if [ -f last_commit.txt ]; then - LAST=$(cat last_commit.txt) - else - LAST="none" - fi - echo "last=$LAST" >> $GITHUB_OUTPUT - - # Detect changes - - name: Detect changes - id: compare - run: | - if [ "${{ steps.current.outputs.commit }}" = "${{ steps.lastcommit.outputs.last }}" ]; then - echo "changed=false" >> $GITHUB_OUTPUT - else - echo "changed=true" >> $GITHUB_OUTPUT - fi - - # Skip unless change OR forced - - name: Skip if no changes - if: steps.compare.outputs.changed == 'false' && github.event.inputs.force_update != 'true' - run: | - echo " No changes and no force → skipping." - exit 0 - - # Restore cache (always) - - name: Restore Dependency-Check cache - uses: actions/cache/restore@v4 - with: - path: ~/.m2/repository/org/owasp/dependency-check-data - key: dependency-check-${{ runner.os }}-${{ runner.arch }} - - # Try updating the DB (safe) - - name: Update NVD DB - id: update - run: | - echo "Checking NVD availability..." - - STATUS=$(curl -s -o /dev/null -w "%{http_code}" \ - "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1") - - echo "NVD status: $STATUS" - - if [ "$STATUS" = "200" ]; then - echo "Updating DB..." - - if mvn org.owasp:dependency-check-maven:12.2.0:update-only \ - -DnvdApiKey=${NVD_API_KEY}; then - echo "success=true" >> $GITHUB_OUTPUT - else - echo "success=false" >> $GITHUB_OUTPUT - fi - else - echo "success=false" >> $GITHUB_OUTPUT - fi - - # Save cache ONLY if update succeeded - - name: Save updated cache - if: steps.update.outputs.success == 'true' - uses: actions/cache/save@v4 - with: - path: ~/.m2/repository/org/owasp/dependency-check-data - key: dependency-check-${{ runner.os }}-${{ runner.arch }} - - # Info for update-only mode - - name: Info (update-only mode) - if: github.event.inputs.update_only == 'true' - run: echo "Update-only mode enabled → skipping scan" - - # Run scan (ONLY if not update-only) - - name: Run Dependency-Check - if: github.event.inputs.update_only != 'true' - run: | - mvn dependency-check:check \ - -Ddependency-check.skipUpdates=true \ - -DfailOnError=false - - # Persist last commit - - name: Save commit state - run: echo "${{ steps.current.outputs.commit }}" > last_commit.txt - - - name: Upload commit state - uses: actions/upload-artifact@v4 - with: - name: last-run-state - path: last_commit.txt - - # Upload report - - name: Upload report - if: github.event.inputs.update_only != 'true' - uses: actions/upload-artifact@v4 - with: - name: dependency-check-report-develop - path: target/dependency-check-report.html - if-no-files-found: ignore \ No newline at end of file diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml deleted file mode 100644 index d6bba78..0000000 --- a/.github/workflows/dependency-check.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Dependency Check (Cached Only) - -on: - push: - pull_request: - -jobs: - dependency-check: - runs-on: ubuntu-latest - - steps: - # Checkout current branch - - name: Checkout - uses: actions/checkout@v4 - - # Restore cache - - name: Restore Dependency-Check cache - id: cache - uses: actions/cache/restore@v4 - with: - path: ~/.m2/repository/org/owasp/dependency-check-data - key: dependency-check-${{ runner.os }}-${{ runner.arch }} - - # Check DB availability - - name: Check DB existence - id: dbcheck - run: | - if [ -d ~/.m2/repository/org/owasp/dependency-check-data ]; then - echo "exists=true" >> $GITHUB_OUTPUT - else - echo "exists=false" >> $GITHUB_OUTPUT - fi - - # Run scan (offline only) - - name: Run Dependency-Check - if: steps.dbcheck.outputs.exists == 'true' - run: | - mvn dependency-check:check \ - -Ddependency-check.skipUpdates=true \ - -DfailOnError=false - - # Skip safely if no DB - - name: Skip if DB missing - if: steps.dbcheck.outputs.exists != 'true' - run: | - echo "⚠️ No cached DB available — skipping scan." - - # Upload report - - name: Upload report - if: always() - uses: actions/upload-artifact@v4 - with: - name: dependency-check-report - path: target/dependency-check-report.html - if-no-files-found: ignore \ No newline at end of file diff --git a/pom.xml b/pom.xml index 63f1a4a..090e410 100644 --- a/pom.xml +++ b/pom.xml @@ -8,7 +8,7 @@ com.siemens.pki CmpRaComponent jar - 4.3.0 + 4.4.0 UTF-8 . @@ -131,24 +131,6 @@ - - org.owasp - dependency-check-maven - 12.2.2 - - - - check - - - - - 0 - resources/dependency-check-suppress.xml - ${env.OSS_INDEX_USERNAME} - ${env.OSS_INDEX_PASSWORD} - - org.jacoco jacoco-maven-plugin @@ -262,7 +244,7 @@ com.fasterxml.jackson.core jackson-databind - 2.20.0 + 2.22.0 com.fasterxml.jackson.datatype @@ -273,7 +255,7 @@ com.fasterxml.jackson.dataformat jackson-dataformat-yaml - 2.20.1 + 2.22.0