eumserver_security_check.yml

name: Automatic Security Check

on:
  workflow_dispatch:
  schedule:
    - cron: "0 8 1,15 * *" # At 08:00 on day-of-month 1 and 15

jobs:
  security-check:
    name: Security Check
    runs-on: ubuntu-latest
    container: eclipse-temurin:21
    steps:
      - uses: actions/checkout@v4
      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      - name: build
        run: ./gradlew assemble
      # the action has not been updated a while, but it always uses the latest plugin version
      - name: Run DependencyCheck plugin
        uses: dependency-check/Dependency-Check_Action@main
        id: depcheck
        continue-on-error: true # we still want to upload the report
        with:
          project: ${{ github.repository }}
          path: '.'
          format: 'HTML'
          out: 'reports'
          args: >
            --failOnCVSS 6
            --suppression dependencyCheckSuppression.xml
            --disableAssembly
            --nvdApiKey ${{ secrets.NVD_API_KEY }}
            --nvdApiDelay 10000
      - name: Upload test results
        uses: actions/upload-artifact@v4
        with:
          name: dependency-check-report-eum-server
          path: ${{ github.workspace }}/reports
      # Since GitHub cannot send emails directly, we use an external API
      - name: Send Notification via Resend
        run: |
          curl -X POST https://api.resend.com/emails \
            -H "Authorization: Bearer ${{ secrets.RESEND_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{
              "from": "inspectIT Ocelot DepCheck <inspectit-ocelot-depcheck@resend.dev>",
              "to": ["info.inspectit@novatec-gmbh.de"],
              "subject": "EUM-Server Dependency-Check Report - ${{ steps.depcheck.outcome }}",
              "html": "<p>The Dependency-Check for inspectit-ocelot-eum-server completed with status: <strong>${{ steps.depcheck.outcome }}</strong></p><p>Please check the report here: <a href='https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'>View Report</a></p>"
            }'
      # if DependencyCheck failed, the job should also fail, but only after the results were uploaded
      - name: Validate DependencyCheck outcome
        if: ${{ steps.depcheck.outcome == 'failure' }}
        run: |
          echo "DependencyCheck failed"
          exit 1