ci(dependency-check): pass NVD API key as env variable

Author: thomasleplus

.github/workflows/maven-dependency-check.yml

@@ -44,8 +44,12 @@ jobs:
         run: |
           set -euo pipefail
           # Do not set IFS=$'\n\t', breaks ${MAVEN_CLI_OPTS}
+          # The NVD API key is read from the NVD_API_KEY environment variable by
+          # the pom (dependencyCheck.NVDApiKey default), so the secret is never
+          # passed on the command line where it would be visible in the process
+          # list.
           # shellcheck disable=SC2086 # [Double quote to prevent globbing and word splitting]: splitting is desired for MAVEN_CLI_OPTS
-          ./mvnw ${MAVEN_CLI_OPTS} -DdependencyCheck.NVDApiKey=${NVD_API_KEY} dependency-check:aggregate
+          ./mvnw ${MAVEN_CLI_OPTS} dependency-check:aggregate
       - name: Clean up
         working-directory: xml
         shell: bash

xml/pom.xml

@@ -12,6 +12,10 @@
     <dependencyCheck.version>12.2.2</dependencyCheck.version>
     <dependencyCheck.skip>false</dependencyCheck.skip>
     <dependencyCheck.threshold>7</dependencyCheck.threshold>
+    <!-- Read the NVD API key from the environment so the secret is never
+         passed on the command line (visible in the process list). Can still
+         be overridden with -DdependencyCheck.NVDApiKey=... if needed. -->
+    <dependencyCheck.NVDApiKey>${env.NVD_API_KEY}</dependencyCheck.NVDApiKey>
     <saxon.version>13.0</saxon.version>
   </properties>
   <build>