maven-dependency-check.yml

---
# Copyright 2016-present Thomas Leplus
# 
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# 
#     http://www.apache.org/licenses/LICENSE-2.0
# 
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This workflow will build a Java project with Maven
# For more information see:
# https://help.github.com/actions/language-and-framework-guides
# /building-and-testing-java-with-maven

name: Maven Dependency Check

on:
  schedule:
    - cron: '0 0 * * 0'
  workflow_dispatch:

permissions: {}

env:
  MAVEN_OPTS: >
    -Dhttps.protocols=TLSv1.2
    -Dmaven.repo.local=.m2/repository
    -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN
    -Dorg.slf4j.simpleLogger.showDateTime=true
    -Djava.awt.headless=true
  MAVEN_CLI_OPTS: >
    --batch-mode
    --errors
    --fail-at-end
    --show-version
    -DinstallAtEnd=true
    -DdeployAtEnd=true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Set up JDK
        uses: actions/setup-java@2dfa2011c5b2a0f1489bf9e433881c92c1631f88 # v4.3.0
        with:
          distribution: temurin
          java-version: 21
      - name: Dependency Check with Maven
        run: |
          # shellcheck disable=SC2086
          ./mvnw ${MAVEN_CLI_OPTS} dependency-check:aggregate
      - name: Upload artifacts
        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
        with:
          name: ${{ github.workflow }}
          path: target/
      - name: Clean up
        run: rm "${HOME}/.m2/settings.xml"