owasp-check.yml

name: "OWASP Dependency Check"

on:
  workflow_dispatch:
  schedule:
    - cron: '0 0 * * 0,3'

jobs:
  owasp:
    name: OWASP Dependency Check Report
    runs-on: ubuntu-latest
    if: github.repository == 'quarkusio/quarkus'

    strategy:
      fail-fast: false
    
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        ref: main
    - name: Setup Java JDK
      uses: actions/setup-java@v3
      with:
        distribution: temurin
        java-version: 11


    - name: Build Java
      run: ./mvnw -B --settings .github/mvn-settings.xml -Dquickly-ci install

    - name: Perform OWASP Dependency Check Report
      run: ./mvnw -Dowasp-report

    - uses: actions/upload-artifact@v3
      with:
        name: dependency-check-report
        path: target/dependency-check-report.html
        retention-days: 5