This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch ci/owasp-timeout-fix in repository https://gitbox.apache.org/repos/asf/struts.git
commit b39dbd4ad887dc5933b3bd6889d64520ae56eedf Author: Lukasz Lenart <[email protected]> AuthorDate: Wed Jul 22 17:09:06 2026 +0200 ci(owasp): cap job timeout and disable NVD auto-update in check step The OWASP job intermittently failed with no reason other than timeouts. Root cause is the unreliable NIST NVD feed (see dependency-check#8633): keyless NVD downloads are heavily rate-limited and stall. Two fixes: - Add timeout-minutes: 30 so a hung NVD download fails fast instead of dragging to the 6h GitHub Actions default. - Add -DautoUpdate=false to the check step so it reads only the cache populated by the preceding update-only step. Previously the check step carried neither the mirror datafeed URL nor the API key, so on any cache staleness/miss it synced directly against NIST - the unreliable path. Co-Authored-By: Claude Opus 4.8 <[email protected]> --- .github/workflows/owasp.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/owasp.yml b/.github/workflows/owasp.yml index 2ede21325..8acf72980 100644 --- a/.github/workflows/owasp.yml +++ b/.github/workflows/owasp.yml @@ -37,6 +37,7 @@ jobs: owasp: name: OWASP runs-on: ubuntu-latest + timeout-minutes: 30 env: HAVE_NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY != '' }} steps: @@ -77,7 +78,7 @@ jobs: key: nvd-cache-${{ runner.os }}-owasp-${{ github.run_id }} - name: OWASP check (Without running tests) - run: mvn -B org.owasp:dependency-check-maven:aggregate -Pdependency-check -Pjakartaee11 --no-transfer-progress + run: mvn -B org.owasp:dependency-check-maven:aggregate -Pdependency-check -Pjakartaee11 -DautoUpdate=false --no-transfer-progress - name: Upload Dependency Check reports uses: actions/upload-artifact@v7
