fix(ci): stabilize security scan reporting and SEDR scan scope - #49
Merged
Arc-E-Tect merged 2 commits intoAug 8, 2026
Merged
Conversation
…efresh Vulnerability scanning now runs alongside the shared NVD cache refresh (Monday and Friday) for both hexagonal-spring-rules and sedr-library, matching the SoftwareEngineeringDoneRight-Gradle mechanism. Removes the standalone spring-rules-security-scan.yml schedule and drops the per-project Security-Scan job from the build/release workflows so releases no longer perform their own scans. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
What changed:\n- updated reusable security scan artifact upload path to dependency-check/dependency-check-report.html\n- aligned sedr-library dependencyCheck behavior with Option A by making failBuildOnCVSS conditional on FAIL_ON_FATAL\n- disabled Node analyzers for sedr-library (nodeAuditEnabled and nodeEnabled)\n\nWhy:\n- the failing release run could not upload the report from the old path\n- sedr-library scans were failing on npm toolchain transitive vulnerabilities unrelated to released Java artifacts\n\nHow:\n- changed the upload-artifact target in the reusable workflow to the actual generated report location\n- mirrored existing conditional CVSS gate pattern and analyzer settings used for Java-only scope\n\nOutcomes:\n- security report artifact path is now consistent with Dependency-Check output\n- sedr-library follows Option A scan scope and avoids Node lockfile-driven release failures\n- validated with actionlint on the modified workflow and a successful Gradle configuration run (./gradlew help)
Arc-E-Tect
deleted the
extract-vulnerability-scans-from-regular-workflows
branch
August 8, 2026 15:49
Arc-E-Tect
added a commit
that referenced
this pull request
Aug 8, 2026
## [0.5.1](v0.5.0...v0.5.1) (2026-08-08) ### 🐛 Bug Fixes * **examples:** remove mavenLocal now that dependencies are released ([#42](#42)) ([9b20913](9b20913)), closes [#42](#42) * **ci:** stabilize security scan reporting and SEDR scan scope ([#49](#49)) ([f5c7df2](f5c7df2)), closes [#49](#49) * **CI:** stop the NVD cache refresh from timing out on every cold sync ([#46](#46)) ([cbaebf3](cbaebf3)), closes [#46](#46) ### 📝 Documentation * **hexagonal-spring-rules:** update README version to 0.5.0 [skip ci] ([5c8b553](5c8b553)) ### 🔧 Misc * Change NVD cache refresh schedule to weekly ([#45](#45)) ([83c3552](83c3552)), closes [#45](#45) * dependency updates for Library projects ([#43](#43)) ([fa70e5e](fa70e5e)), closes [#43](#43) * dependency updates for Library projects ([#47](#47)) ([398933c](398933c)), closes [#47](#47) * dependency updates for Library projects ([#48](#48)) ([105111d](105111d)), closes [#48](#48) * **Sedr Library:** update npm packages ([#44](#44)) ([821da37](821da37)), closes [#44](#44)
Owner
Author
|
🎉 This PR is included in version 0.5.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the failing security scan path and applies Option A for sedr-library dependency-check by disabling Node analyzers and making CVSS failure conditional on FAIL_ON_FATAL. Validated with actionlint and a Gradle configuration run.