@@ -66,30 +66,17 @@ jobs:
6666 id : dep_scan
6767 if : always()
6868 run : |
69- # Install dependency-check
7069 gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 259A55407DD6C00299E6607EFFDE55BE73A2D1ED
7170 VERSION=$(curl -s https://jeremylong.github.io/DependencyCheck/current.txt | head -n1 | cut -d" " -f1)
7271 curl -Ls "https://github.com/dependency-check/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip" --output dependency-check.zip
7372 curl -Ls "https://github.com/dependency-check/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip.asc" --output dependency-check.zip.asc
7473 gpg --verify dependency-check.zip.asc
7574 unzip dependency-check.zip
76-
77- # Run dependency check on entire workspace
78- ./dependency-check/bin/dependency-check.sh \
79- --failOnCVSS 0 \
80- --nvdApiKey ${{ env.NVD_API_KEY_NVD_API_KEY }} \
81- --disableOssIndex \
82- --enableExperimental \
83- -s "." \
84- --format HTML \
85- --format JSON
75+ ./dependency-check/bin/dependency-check.sh --enableExperimental --failOnCVSS 0 --nvdApiKey ${{ env.NVD_API_KEY_NVD_API_KEY }} -s "."
8676
8777 - name : Print dependency scan results on failure
88- if : always()
89- run : |
90- if [ "${{ steps.dep_scan.outcome }}" != "success" ]; then
91- less dependency-check-report.html
92- fi
78+ if : ${{ steps.dep_scan.outcome != 'success' }}
79+ run : less dependency-check-report.html
9380
9481 - name : Perform high severity scan on built artifacts
9582 if : always()
@@ -118,7 +105,7 @@ jobs:
118105 uses : aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # 5.0.0
119106 with :
120107 role-to-assume : ${{ secrets.AWS_INTEG_TEST_ROLE_ARN }}
121- aws-region : ${{ env.AWS_DEFAULT_REGION }}
108+ aws-region : ${{ env.AWS_DEFAULT_REGION }}
122109
123110 - name : Publish high scan status
124111 if : always()
@@ -137,10 +124,3 @@ jobs:
137124 --metric-name Success \
138125 --dimensions repository=${{ github.repository }},branch=${{ github.ref_name }},workflow=daily_scan_low \
139126 --value $value
140-
141- - name : Cleanup
142- if : always()
143- run : |
144- rm -f ./dependency-check.zip
145- rm -f ./dependency-check.zip.asc
146- rm -rf ./dependency-check || true
0 commit comments