Skip to content

Commit 8b7754f

Browse files
lhotarilhotari
authored
[fix][ci] Fix OWASP Dependency Check download by using NVD API key (apache#22999)
1 parent 2086cc4 commit 8b7754f

File tree

10 files changed

+30
-34
lines changed

10 files changed

+30
-34
lines changed

‎.github/workflows/ci-owasp-dependency-check.yaml

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,9 @@ on:
2424
workflow_dispatch:
2525

2626
env:
27-
MAVEN_OPTS: -Xss1500k -Xmx1024m -Daether.connector.http.reuseConnections=false -Daether.connector.requestTimeout=60000 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.http.retryHandler.requestSentEnabled=true -Dmaven.wagon.http.serviceUnavailableRetryStrategy.class=standard -Dmaven.wagon.rto=60000
27+
MAVEN_OPTS: -Xss1500k -Xmx1500m -Daether.connector.http.reuseConnections=false -Daether.connector.requestTimeout=60000 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.http.retryHandler.requestSentEnabled=true -Dmaven.wagon.http.serviceUnavailableRetryStrategy.class=standard -Dmaven.wagon.rto=60000
2828
JDK_DISTRIBUTION: corretto
29+
NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY }}
2930

3031
jobs:
3132
run-owasp-dependency-check:
@@ -42,12 +43,9 @@ jobs:
4243
matrix:
4344
include:
4445
- branch: master
46+
- branch: branch-3.3
4547
- branch: branch-3.2
46-
- branch: branch-3.1
4748
- branch: branch-3.0
48-
- branch: branch-2.11
49-
- branch: branch-2.10
50-
jdk: 11
5149

5250
steps:
5351
- name: checkout
@@ -58,16 +56,14 @@ jobs:
5856
- name: Tune Runner VM
5957
uses: ./.github/actions/tune-runner-vm
6058

61-
- name: Cache local Maven repository
62-
uses: actions/cache@v4
59+
- name: Restore Maven repository cache
60+
uses: actions/cache/restore@v4
6361
timeout-minutes: 5
6462
with:
6563
path: |
6664
~/.m2/repository/*/*/*
6765
!~/.m2/repository/org/apache/pulsar
68-
!~/.m2/repository/org/owasp/dependency-check-data
6966
key: ${{ runner.os }}-m2-dependencies-all-${{ hashFiles('**/pom.xml') }}
70-
lookup-only: true
7167
restore-keys: |
7268
${{ runner.os }}-m2-dependencies-core-modules-${{ hashFiles('**/pom.xml') }}
7369
${{ runner.os }}-m2-dependencies-core-modules-
@@ -79,7 +75,7 @@ jobs:
7975
java-version: ${{ matrix.jdk || '17' }}
8076

8177
- name: run install by skip tests
82-
run: mvn -B -ntp clean install -DskipTests -Dspotbugs.skip=true -Dlicense.skip=true -Dcheckstyle.skip=true -Drat.skip=true -DskipDocker=true
78+
run: mvn -B -ntp clean install -DskipTests -Dspotbugs.skip=true -Dlicense.skip=true -Dcheckstyle.skip=true -Drat.skip=true -DskipDocker=true -DnarPluginPhase=none -pl '!distribution/io,!distribution/offloaders'
8379

8480
- name: OWASP cache key weeknum
8581
id: get-weeknum
@@ -89,7 +85,7 @@ jobs:
8985

9086
- name: Restore OWASP Dependency Check data
9187
id: restore-owasp-dependency-check-data
92-
uses: actions/cache/restore@v3
88+
uses: actions/cache/restore@v4
9389
timeout-minutes: 5
9490
with:
9591
path: ~/.m2/repository/org/owasp/dependency-check-data
@@ -105,7 +101,7 @@ jobs:
105101

106102
- name: Save OWASP Dependency Check data
107103
if: ${{ steps.update-owasp-dependency-check-data.outcome == 'success' }}
108-
uses: actions/cache/save@v3
104+
uses: actions/cache/save@v4
109105
timeout-minutes: 5
110106
with:
111107
path: ~/.m2/repository/org/owasp/dependency-check-data

‎.github/workflows/pulsar-ci.yaml

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1427,6 +1427,7 @@ jobs:
14271427
env:
14281428
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
14291429
CI_JDK_MAJOR_VERSION: ${{ needs.preconditions.outputs.jdk_major_version }}
1430+
NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY }}
14301431
steps:
14311432
- name: checkout
14321433
uses: actions/checkout@v4
@@ -1442,16 +1443,14 @@ jobs:
14421443
with:
14431444
limit-access-to-actor: true
14441445

1445-
- name: Cache Maven dependencies
1446-
uses: actions/cache@v4
1446+
- name: Restore Maven repository cache
1447+
uses: actions/cache/restore@v4
14471448
timeout-minutes: 5
14481449
with:
14491450
path: |
14501451
~/.m2/repository/*/*/*
14511452
!~/.m2/repository/org/apache/pulsar
1452-
!~/.m2/repository/org/owasp/dependency-check-data
14531453
key: ${{ runner.os }}-m2-dependencies-core-modules-${{ hashFiles('**/pom.xml') }}
1454-
lookup-only: true
14551454
restore-keys: |
14561455
${{ runner.os }}-m2-dependencies-core-modules-
14571456
@@ -1480,7 +1479,7 @@ jobs:
14801479

14811480
- name: Restore OWASP Dependency Check data
14821481
id: restore-owasp-dependency-check-data
1483-
uses: actions/cache/restore@v3
1482+
uses: actions/cache/restore@v4
14841483
timeout-minutes: 5
14851484
with:
14861485
path: ~/.m2/repository/org/owasp/dependency-check-data

‎distribution/io/pom.xml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,6 @@
136136
<plugin>
137137
<groupId>org.owasp</groupId>
138138
<artifactId>dependency-check-maven</artifactId>
139-
<version>${dependency-check-maven.version}</version>
140139
<executions>
141140
<execution>
142141
<goals>

‎pom.xml

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,7 @@ flexible messaging model and an intuitive client API.</description>
316316
<errorprone-slf4j.version>0.1.21</errorprone-slf4j.version>
317317
<j2objc-annotations.version>1.3</j2objc-annotations.version>
318318
<lightproto-maven-plugin.version>0.4</lightproto-maven-plugin.version>
319-
<dependency-check-maven.version>9.1.0</dependency-check-maven.version>
319+
<dependency-check-maven.version>10.0.1</dependency-check-maven.version>
320320
<roaringbitmap.version>1.0.6</roaringbitmap.version>
321321
<extra-enforcer-rules.version>1.6.1</extra-enforcer-rules.version>
322322
<oshi.version>6.4.0</oshi.version>
@@ -2192,6 +2192,16 @@ flexible messaging model and an intuitive client API.</description>
21922192
<artifactId>build-helper-maven-plugin</artifactId>
21932193
<version>${build-helper-maven-plugin.version}</version>
21942194
</plugin>
2195+
<plugin>
2196+
<groupId>org.owasp</groupId>
2197+
<artifactId>dependency-check-maven</artifactId>
2198+
<version>${dependency-check-maven.version}</version>
2199+
<configuration>
2200+
<nvdApiKeyEnvironmentVariable>NIST_NVD_API_KEY</nvdApiKeyEnvironmentVariable>
2201+
<!-- Uncomment the following to use the NVD data feed provided by the Dependency-Check project -->
2202+
<!-- <nvdDatafeedUrl>https://jeremylong.github.io/DependencyCheck/hb_nvd/</nvdDatafeedUrl> -->
2203+
</configuration>
2204+
</plugin>
21952205
</plugins>
21962206
</pluginManagement>
21972207
<extensions>
@@ -2639,7 +2649,6 @@ flexible messaging model and an intuitive client API.</description>
26392649
<plugin>
26402650
<groupId>org.owasp</groupId>
26412651
<artifactId>dependency-check-maven</artifactId>
2642-
<version>${dependency-check-maven.version}</version>
26432652
<configuration>
26442653
<suppressionFiles>
26452654
<suppressionFile>${pulsar.basedir}/src/owasp-dependency-check-false-positives.xml</suppressionFile>
@@ -2674,7 +2683,6 @@ flexible messaging model and an intuitive client API.</description>
26742683
<plugin>
26752684
<groupId>org.owasp</groupId>
26762685
<artifactId>dependency-check-maven</artifactId>
2677-
<version>${dependency-check-maven.version}</version>
26782686
<reportSets>
26792687
<reportSet>
26802688
<reports>

‎pulsar-io/docs/pom.xml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,6 @@
258258
<plugin>
259259
<groupId>org.owasp</groupId>
260260
<artifactId>dependency-check-maven</artifactId>
261-
<version>${dependency-check-maven.version}</version>
262261
<executions>
263262
<execution>
264263
<goals>

‎pulsar-io/flume/pom.xml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,6 @@
141141
<plugin>
142142
<groupId>org.owasp</groupId>
143143
<artifactId>dependency-check-maven</artifactId>
144-
<version>${dependency-check-maven.version}</version>
145144
<executions>
146145
<execution>
147146
<goals>

‎pulsar-io/hbase/pom.xml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,6 @@
108108
<plugin>
109109
<groupId>org.owasp</groupId>
110110
<artifactId>dependency-check-maven</artifactId>
111-
<version>${dependency-check-maven.version}</version>
112111
<executions>
113112
<execution>
114113
<goals>

‎pulsar-io/hdfs2/pom.xml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,14 @@
2727
</parent>
2828
<artifactId>pulsar-io-hdfs2</artifactId>
2929
<name>Pulsar IO :: Hdfs2</name>
30-
30+
3131
<dependencies>
3232
<dependency>
3333
<groupId>${project.groupId}</groupId>
3434
<artifactId>pulsar-io-core</artifactId>
3535
<version>${project.version}</version>
3636
</dependency>
37-
37+
3838
<dependency>
3939
<groupId>com.fasterxml.jackson.core</groupId>
4040
<artifactId>jackson-databind</artifactId>
@@ -74,7 +74,7 @@
7474
<artifactId>commons-lang3</artifactId>
7575
</dependency>
7676
</dependencies>
77-
77+
7878
<build>
7979
<plugins>
8080
<plugin>
@@ -113,7 +113,6 @@
113113
<plugin>
114114
<groupId>org.owasp</groupId>
115115
<artifactId>dependency-check-maven</artifactId>
116-
<version>${dependency-check-maven.version}</version>
117116
<executions>
118117
<execution>
119118
<goals>

‎pulsar-io/hdfs3/pom.xml

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,14 @@
2727
</parent>
2828
<artifactId>pulsar-io-hdfs3</artifactId>
2929
<name>Pulsar IO :: Hdfs3</name>
30-
30+
3131
<dependencies>
3232
<dependency>
3333
<groupId>${project.groupId}</groupId>
3434
<artifactId>pulsar-io-core</artifactId>
3535
<version>${project.version}</version>
3636
</dependency>
37-
37+
3838
<dependency>
3939
<groupId>com.fasterxml.jackson.core</groupId>
4040
<artifactId>jackson-databind</artifactId>
@@ -49,7 +49,7 @@
4949
<groupId>org.apache.commons</groupId>
5050
<artifactId>commons-collections4</artifactId>
5151
</dependency>
52-
52+
5353
<dependency>
5454
<groupId>org.apache.hadoop</groupId>
5555
<artifactId>hadoop-client</artifactId>
@@ -80,7 +80,7 @@
8080
</dependency>
8181

8282
</dependencies>
83-
83+
8484
<build>
8585
<plugins>
8686
<plugin>
@@ -119,7 +119,6 @@
119119
<plugin>
120120
<groupId>org.owasp</groupId>
121121
<artifactId>dependency-check-maven</artifactId>
122-
<version>${dependency-check-maven.version}</version>
123122
<executions>
124123
<execution>
125124
<goals>

‎tiered-storage/file-system/pom.xml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,6 @@
208208
<plugin>
209209
<groupId>org.owasp</groupId>
210210
<artifactId>dependency-check-maven</artifactId>
211-
<version>${dependency-check-maven.version}</version>
212211
<executions>
213212
<execution>
214213
<goals>

0 commit comments

Comments
 (0)