chore(ci): add OWASP dependency check scheduled workflow #20228
Conversation
Add a new GitHub Actions workflow that runs the OWASP dependency-check plugin on a weekly schedule (Sundays at 4 AM UTC) to scan for known security vulnerabilities in project dependencies. Features: - Uses the existing dependencycheck Maven profile - Uploads HTML and JSON reports as artifacts (retained for 30 days) - Can be manually triggered via workflow_dispatch - Provides a job summary with basic status information This helps maintain security visibility and catch vulnerable dependencies before they become a problem.
|
Running the dependecy-check locally took a good chunk of time, there is this warning message We can obtain an api key and set it securely in GH secrets. Perhaps Apache Infra already has this api key for other project which we can use ? |
|
@gnodet I think this is good to merge: is there still anything left? |
|
It's ok IMO, but maybe we should get an api key |
I've not tried locally. How much time does it takes to execute? Considering it's a side support weekly action, even if it takes a couple of hours I think it would be fine to accept as it is. And it can be definitely improved along the way reporting a follow up issue in Jira. |
|
Last time I tried it locally and without an api key, I had around 45 minutes. |
|
Okey, I've created this issue: https://issues.apache.org/jira/browse/CAMEL-22959 - I'm in charge to ask for the key and store it secretely for eventually using it. In the while, if @gnodet is okey with it, it's good for me to merge. |
|
I've created the API key which we may include in this PR or at a later stage. It's |
4 participants
Add a new GitHub Actions workflow that runs the OWASP dependency-check plugin on a weekly schedule (Sundays at 4 AM UTC) to scan for known security vulnerabilities in project dependencies.
Features:
This helps maintain security visibility and catch vulnerable dependencies before they become a problem.