maven-build-pr.yml

name: Maven Pull Request Build

on:
  pull_request:
    branches:
      - "*"
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Source
        uses: actions/checkout@v4
        with:
          # Disabling shallow clone is recommended for improving relevancy of reporting
          fetch-depth: 0

      - name: Cache maven repository
        uses: actions/cache@v4
        with:
          path: |
            ~/.m2/repository
            ~/.sonar/cache
          key: pr-${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            pr-${{ runner.os }}-maven
            ${{ runner.os }}-maven

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'adopt'
          java-version: 17

      - name: Build with Maven
        run: |
          mvn test-compile -P build-ci --settings maven-ci-settings.xml -B

      - name: Test with Coverage
        if: ${{ github.event.pull_request.head.repo.fork == false }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: |
          mvn install sonar:sonar -P coverage -Dsonar.projectKey=FraunhoferIOSB_FAAAST-Registry --settings maven-ci-settings.xml -B

      - name: Restore CVD Database from Cache
        uses: actions/cache/restore@v4
        with:
          path: |
            ~/.m2/repository/org/owasp/dependency-check-data
          key: ${{ runner.os }}-maven-owasp-cvedb

      - name: Update CVD Database
        env:
          OWASP_OSS_INDEX_USERNAME: ${{ secrets.OWASP_OSS_INDEX_USERNAME }}
          OWASP_OSS_INDEX_APIKEY: ${{ secrets.OWASP_OSS_INDEX_APIKEY }}
          NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY }}
        run: |
          mvn -B -P owasp -DnvdApiDelay=6000 --settings maven-ci-settings.xml org.owasp:dependency-check-maven:update-only

      - name: Save CVD Database to Cache
        uses: actions/cache/save@v4
        with:
          path: |
            ~/.m2/repository/org/owasp/dependency-check-data
          key: ${{ runner.os }}-maven-owasp-cvedb
    
      - name: Dependency Vulnerability Check with OWASP
        env:
          OWASP_OSS_INDEX_USERNAME: ${{ secrets.OWASP_OSS_INDEX_USERNAME }}
          OWASP_OSS_INDEX_APIKEY: ${{ secrets.OWASP_OSS_INDEX_APIKEY }}
        run: |
          mvn org.owasp:dependency-check-maven:aggregate -P owasp --settings maven-ci-settings.xml -B