improve owasp dependency check (#3859)

apache · Jul 12, 2024 · fc856b0 · fc856b0
1 parent ec38a12
commit fc856b0
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 3 deletions.
diff --git a/.github/workflows/owasp-dependency-check.yaml b/.github/workflows/owasp-dependency-check.yaml
@@ -21,7 +21,7 @@ on:
   push:
     branches:
       - dev
-  pull_request:
+  pull_request_target:
     paths:
       - '**/pom.xml'
 
@@ -30,6 +30,9 @@ env:
 
 jobs:
   build:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
@@ -42,7 +45,13 @@ jobs:
           java-version: 8
           distribution: 'adopt'
       - name: Run OWASP Dependency Check
-        run: ./mvnw -B clean install dependency-check:check -Dowasp.skip=false -Dspotless.skip=true -Drat.skip=true
+        run: |
+          ./mvnw -B clean install dependency-check:check \
+          -Dowasp.skip=false \
+          -Dspotless.skip=true \
+          -Drat.skip=true
+        env:
+          NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY }}
       - name: Upload report
         uses: actions/upload-artifact@v4
         if: ${{ cancelled() || failure() }}

diff --git a/pom.xml b/pom.xml
@@ -136,7 +136,7 @@
         <spotless.scalafmt.version>3.7.5</spotless.scalafmt.version>
         <maven-checkstyle-plugin.version>3.2.0</maven-checkstyle-plugin.version>
         <maven-scalastyle-plugin.version>1.0.0</maven-scalastyle-plugin.version>
-        <owasp-dependency-check-maven.version>9.2.0</owasp-dependency-check-maven.version>
+        <owasp-dependency-check-maven.version>10.0.2</owasp-dependency-check-maven.version>
         <build-helper-maven-plugin.version>3.3.0</build-helper-maven-plugin.version>
         <streampark.shaded.package>org.apache.streampark.shaded</streampark.shaded.package>
         <flink.table.uber.artifact.id>flink-table-uber_${scala.binary.version}</flink.table.uber.artifact.id>
@@ -831,6 +831,7 @@
                         <skipRuntimeScope>true</skipRuntimeScope>
                         <skipSystemScope>true</skipSystemScope>
                         <failBuildOnCVSS>7</failBuildOnCVSS>
+                        <nvdApiKeyEnvironmentVariable>NIST_NVD_API_KEY</nvdApiKeyEnvironmentVariable>
                     </configuration>
                     <executions>
                         <execution>