dependency-check.yml

name: Dependency Check
on:
  push:
  pull_request:
  schedule:
    - cron: '0 0 * * 4'
permissions: read-all

env:
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
  GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
  JAVA_VERSION: 20

jobs:
  dependency-check:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.adoptium.net:443
            api.github.com:443
            caffeine.gradle-enterprise.cloud:443
            downloads.gradle.org:443
            downloads.gradle-dn.com:443
            github.com:443
            jcenter.bintray.com:443
            jeremylong.github.io:443
            nvd.nist.gov:443
            objects.githubusercontent.com:443
            ossindex.sonatype.org:443
            plugins.gradle.org:443
            plugins-artifacts.gradle.org:443
            repo.maven.apache.org:443
            repo1.maven.org:443
            raw.githubusercontent.com:443
            services.gradle.org:443
            www.cisa.gov:443
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - name: Run dependency-check
        uses: ./.github/actions/run-gradle
        continue-on-error: true
        with:
          java: ${{ env.JAVA_VERSION }}
          arguments: dependencyCheckAggregate --no-configuration-cache
      - name: Check file existence
        id: check_files
        uses: andstor/file-existence-action@20b4d2e596410855db8f9ca21e96fbe18e12930b # v2.0.0
        with:
          files: build/reports/dependency-check-report.sarif
      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
        if: steps.check_files.outputs.files_exists == 'true'
        with:
          sarif_file: build/reports/dependency-check-report.sarif