dependency-scan.yml

name: Dependency Vulnerability Scan

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    # Run weekly on Monday at 6 AM UTC to catch newly disclosed vulnerabilities
    - cron: '0 6 * * 1'
  workflow_dispatch:

permissions:
  contents: read
  issues: write
  pull-requests: write
  security-events: write

jobs:
  # ──────────────────────────────────────────────
  # Maven (Desktop) - OWASP Dependency-Check
  # ──────────────────────────────────────────────
  maven-dependency-check:
    name: Maven OWASP Dependency-Check
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: maven

      - name: Cache NVD database
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository/org/owasp/dependency-check-data
          key: ${{ runner.os }}-nvd-${{ github.run_id }}
          restore-keys: |
            ${{ runner.os }}-nvd-

      - name: Run OWASP Dependency-Check
        id: owasp
        continue-on-error: true
        run: |
          mvn dependency-check:check -B \
            -DfailBuildOnCVSS=9 \
            -DskipTests \
            2>&1 | tee owasp-output.log
          echo "exit_code=${PIPESTATUS[0]}" >> $GITHUB_OUTPUT
        env:
          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}

      - name: Parse OWASP results
        if: always()
        id: parse-owasp
        run: |
          if [ -f target/dependency-check-report.xml ]; then
            TOTAL=$(grep -c '<vulnerability' target/dependency-check-report.xml 2>/dev/null || echo "0")
            CRITICAL=$(grep -c 'severity="CRITICAL"' target/dependency-check-report.xml 2>/dev/null || echo "0")
            HIGH=$(grep -c 'severity="HIGH"' target/dependency-check-report.xml 2>/dev/null || echo "0")
            MEDIUM=$(grep -c 'severity="MEDIUM"' target/dependency-check-report.xml 2>/dev/null || echo "0")
            LOW=$(grep -c 'severity="LOW"' target/dependency-check-report.xml 2>/dev/null || echo "0")
          else
            TOTAL=0
            CRITICAL=0
            HIGH=0
            MEDIUM=0
            LOW=0
          fi

          echo "total=${TOTAL}" >> $GITHUB_OUTPUT
          echo "critical=${CRITICAL}" >> $GITHUB_OUTPUT
          echo "high=${HIGH}" >> $GITHUB_OUTPUT
          echo "medium=${MEDIUM}" >> $GITHUB_OUTPUT
          echo "low=${LOW}" >> $GITHUB_OUTPUT

          echo "## Maven Dependency-Check Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Severity | Count |" >> $GITHUB_STEP_SUMMARY
          echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| Critical | ${CRITICAL} |" >> $GITHUB_STEP_SUMMARY
          echo "| High | ${HIGH} |" >> $GITHUB_STEP_SUMMARY
          echo "| Medium | ${MEDIUM} |" >> $GITHUB_STEP_SUMMARY
          echo "| Low | ${LOW} |" >> $GITHUB_STEP_SUMMARY
          echo "| **Total** | **${TOTAL}** |" >> $GITHUB_STEP_SUMMARY

      - name: Upload OWASP report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: maven-dependency-check-report
          path: |
            target/dependency-check-report.html
            target/dependency-check-report.xml
            target/dependency-check-report.json
          retention-days: 30

      - name: Comment on PR
        if: github.event_name == 'pull_request' && always()
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const total = '${{ steps.parse-owasp.outputs.total }}';
            const critical = '${{ steps.parse-owasp.outputs.critical }}';
            const high = '${{ steps.parse-owasp.outputs.high }}';
            const medium = '${{ steps.parse-owasp.outputs.medium }}';
            const low = '${{ steps.parse-owasp.outputs.low }}';

            const hasIssues = parseInt(critical) > 0 || parseInt(high) > 0;

            const comment = `## Dependency Vulnerability Scan (Maven)

            | Severity | Count |
            |----------|-------|
            | Critical | ${critical} |
            | High | ${high} |
            | Medium | ${medium} |
            | Low | ${low} |
            | **Total** | **${total}** |

            ${hasIssues ? '**Action Required:** Critical or high vulnerabilities found. Review the dependency-check report artifact.' : 'No critical or high vulnerabilities found.'}

            <details>
            <summary>View Details</summary>

            Download the \`maven-dependency-check-report\` artifact for the full HTML report.

            To run locally: \`mvn dependency-check:check\`
            Report: \`target/dependency-check-report.html\`
            </details>
            `;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: comment
            });

      - name: Create issue for critical vulnerabilities
        if: |
          always() &&
          github.event_name == 'schedule' &&
          (steps.parse-owasp.outputs.critical > 0 || steps.parse-owasp.outputs.high > 0)
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const critical = '${{ steps.parse-owasp.outputs.critical }}';
            const high = '${{ steps.parse-owasp.outputs.high }}';
            const total = '${{ steps.parse-owasp.outputs.total }}';

            const issues = await github.rest.issues.listForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: 'security,dependency-vulnerability',
              state: 'open'
            });

            if (issues.data.length === 0) {
              await github.rest.issues.create({
                owner: context.repo.owner,
                repo: context.repo.repo,
                title: 'Security: Maven dependency vulnerabilities detected',
                labels: ['security', 'dependency-vulnerability', 'automated', 'priority-high'],
                body: `## Dependency Vulnerability Scan Results

            **Scan Date:** ${new Date().toISOString().split('T')[0]}
            **Total Vulnerabilities:** ${total}
            - Critical: ${critical}
            - High: ${high}

            ### Action Required
            1. Run \`mvn dependency-check:check\` locally
            2. Review \`target/dependency-check-report.html\`
            3. Update affected dependencies or add justified suppressions

            ### Quick Commands
            \`\`\`bash
            # Check for available updates
            mvn versions:display-dependency-updates

            # Run vulnerability scan
            mvn dependency-check:check

            # View report
            open target/dependency-check-report.html
            \`\`\`

            ---
            _Automatically created by the Dependency Vulnerability Scan workflow._
            _Workflow run: ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}_
              `
              });
            }

  # ──────────────────────────────────────────────
  # Gradle (Core + Android) - Dependency submission
  # ──────────────────────────────────────────────
  gradle-dependency-submission:
    name: Gradle Dependency Submission
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: gradle

      - name: Submit Gradle dependencies
        uses: mikepenz/gradle-dependency-submission@v1
        with:
          gradle-build-module: |-
            :jnexus-core
          gradle-build-configuration: |-
            runtimeClasspath

  # ──────────────────────────────────────────────
  # SBOM Generation and Upload
  # ──────────────────────────────────────────────
  sbom-generation:
    name: Generate SBOM
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: maven

      - name: Generate CycloneDX SBOM
        run: mvn cyclonedx:makeAggregateBom -DskipTests -B

      - name: Upload SBOM artifacts
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: |
            target/jnexus-sbom.json
            target/jnexus-sbom.xml
          retention-days: 90

  # ──────────────────────────────────────────────
  # Summary
  # ──────────────────────────────────────────────
  scan-summary:
    name: Scan Summary
    runs-on: ubuntu-latest
    needs: [maven-dependency-check]
    if: always()

    steps:
      - name: Create summary
        run: |
          echo "## Dependency Vulnerability Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Scan | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Maven OWASP Dependency-Check | ${{ needs.maven-dependency-check.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "For detailed reports, download the artifacts from this workflow run." >> $GITHUB_STEP_SUMMARY