FrankChen021 commented on code in PR #20126:
URL: https://github.com/apache/druid/pull/20126#discussion_r3853027823
##########
.github/workflows/cron-job-its.yml:
##########
@@ -45,20 +50,64 @@ jobs:
distribution: 'zulu'
cache: maven
+ - name: Restore Dependency-Check data
+ id: dependency-check-cache
+ uses: actions/cache/restore@v4
+ with:
+ path: ~/.cache/dependency-check
+ key: dependency-check-data-${{ runner.os }}-odc-${{
env.DEPENDENCY_CHECK_CACHE_VERSION }}-${{ github.run_id }}
+ restore-keys: |
+ dependency-check-data-${{ runner.os }}-odc-${{
env.DEPENDENCY_CHECK_CACHE_VERSION }}-
+
+ - name: Report Dependency-Check cache status
+ run: |
+ echo "Dependency-Check cache-hit=${{
steps.dependency-check-cache.outputs.cache-hit }}"
+ echo "Dependency-Check cache-matched-key=${{
steps.dependency-check-cache.outputs.cache-matched-key }}"
+
- name: maven build # needed to rebuild in case of maven snapshot
resolution fails
run: mvn clean install -P dist -P skip-static-checks,skip-tests
-Dmaven.javadoc.skip=true -Dcyclonedx.skip=true -Dweb.console.skip=true
+ - name: Update Dependency-Check data
+ id: dependency-check-update
+ env:
+ NVD_API_KEY: ${{ secrets.NVD_API_KEY || secrets.NIST_NVD_API_KEY }}
+ run: |
+ if [ -n "$NVD_API_KEY" ]; then
+ echo "NVD API key is available to the update"
+ else
+ echo "NVD API key is unavailable to the update"
+ fi
+ mvn -B dependency-check:update-only \
+ -DdataDirectory="$HOME/.cache/dependency-check" \
+ -DnvdValidForHours=24 \
+ -DnvdApiKey="$NVD_API_KEY"
+
- name: security vulnerabilities check
+ if: always()
env:
OSS_INDEX_USERNAME: ${{ secrets.OSS_INDEX_USERNAME }}
OSS_INDEX_PASSWORD: ${{ secrets.OSS_INDEX_PASSWORD }}
- NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+ NVD_API_KEY: ${{ secrets.NVD_API_KEY || secrets.NIST_NVD_API_KEY }}
run: |
- mvn -B dependency-check:purge dependency-check:check
-DnvdApiKey=$NVD_API_KEY -DossIndexUsername=$OSS_INDEX_USERNAME
-DossIndexPassword=$OSS_INDEX_PASSWORD || { echo "
+ if [ -n "$NVD_API_KEY" ]; then
+ echo "NVD API key is available to the scan"
+ else
+ echo "NVD API key is unavailable to the scan"
+ fi
+ mvn -B --fail-at-end dependency-check:check -DautoUpdate=false
-DdataDirectory="$HOME/.cache/dependency-check" -DnvdApiKey="$NVD_API_KEY"
-DossIndexUsername="$OSS_INDEX_USERNAME"
-DossIndexPassword="$OSS_INDEX_PASSWORD" || { echo "
The OWASP dependency check has found security vulnerabilities.
Please use a newer version
of the dependency that does not have vulnerabilities. To see a
report run
`mvn dependency-check:check`
If the analysis has false positives,
they can be suppressed by adding entries to
owasp-dependency-check-suppressions.xml (for more
information, see
https://jeremylong.github.io/DependencyCheck/general/suppression.html).
" && false; }
+
+ - name: Save Dependency-Check data
+ # A pull_request run uses an isolated merge-ref cache that cannot be
+ # reused by branch, scheduled, or workflow_dispatch runs.
+ if: steps.dependency-check-update.outcome == 'success' &&
github.event_name != 'pull_request'
Review Comment:
[P1] Updated cache is skipped when the scan fails
Because this condition has no status function, GitHub Actions implicitly
requires success(). The preceding security scan intentionally fails when
vulnerabilities are found, so this save step is skipped even when
dependency-check-update succeeded. The workflow therefore cannot persist the
refreshed database on the observed failure path and will repeatedly download
the full NVD dataset. Include an explicit always() or equivalent status
condition while retaining the update-success and non-PR checks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
