Merge pull request #1756 from uhafner/dependency-check

Add an action to run the dependency check in a separate process

Author: uhafner

.github/workflows/quality-monitor-dependency-check.yml

@@ -0,0 +1,49 @@
+name: 'Quality Monitor Dependency Check'
+
+on:
+  push:
+      branches:
+      - main
+  pull_request_target:
+
+jobs:
+  build:
+    runs-on: [ubuntu-latest]
+    name: Create dependency check report
+
+    steps:
+      - name: Checkout project
+        uses: actions/checkout@v6
+      - name: Set up JDK
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'temurin'
+          java-version: 25
+          check-latest: true
+          cache: 'maven'
+      - name: Set up Maven
+        uses: stCarolas/setup-maven@v5
+        with:
+          maven-version: 3.9.12
+      - name: Cache the NVD database
+        uses: actions/cache@v5
+        with:
+          path: ~/.m2/repository/org/owasp/dependency-check-data
+          key: dependency-check
+      - name: Build with Maven
+        env:
+          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+          OSS_INDEX_TOKEN: ${{ secrets.OSS_INDEX_TOKEN }}
+        run: |
+          mvn -V --color always -ntp validate -Pci -Powasp
+          if [ "${PIPESTATUS[0]}" != "0" ]; then
+             exit 1;
+          fi
+          mv -fv maven.log target/maven.log
+      - name: Upload Quality Reports
+        uses: actions/upload-artifact@v6
+        with:
+          name: quality-reports
+          path: |
+            **/target/**/*.json
+