scan-with-owasp-dependency-check.yml

# Name of the GitHub Actions workflow
name: Scan with OWASP Dependency Check

# Define environment variables
env:
  PROJECT_NAME: Mutillidae
  OUTPUT_DIR: .

# Define when the workflow should be triggered
on:
  push:
    branches:
      - development
      - main

# Define the job(s) to be executed within the workflow
jobs:
  depchecktest:
    name: Scan with OWASP Dependency Check
    runs-on: ubuntu-latest
    timeout-minutes: 30

    # Define permissions for specific actions
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Scan with OWASP Dependency Check
        id: owasp-dependency-check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: $PROJECT_NAME
          path: ${{ env.OUTPUT_DIR }}
          format: SARIF
          out: ${{ env.OUTPUT_DIR }}
          args: >
            --enableRetired
        continue-on-error: true

      - name: Upload results from OWASP Dependency Check to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@main
        with:
          sarif_file: ${{ env.OUTPUT_DIR }}/dependency-check-report.sarif
          category: "Scan-dependencies-code-with-OWASP-Dependency-Check"