From b554e90b72c8bbc7d7a855d04ee6c61b46503e40 Mon Sep 17 00:00:00 2001 From: Iwan Eising Date: Sat, 8 Aug 2026 19:41:47 +0400 Subject: [PATCH 1/2] ci: consolidate vulnerability scans into the twice-weekly NVD cache refresh Vulnerability scanning now runs alongside the shared NVD cache refresh (Monday and Friday) for both hexagonal-spring-rules and sedr-library, matching the SoftwareEngineeringDoneRight-Gradle mechanism. Removes the standalone spring-rules-security-scan.yml schedule and drops the per-project Security-Scan job from the build/release workflows so releases no longer perform their own scans. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/nvd-cache-refresh.yml | 67 ++++++++++++++++++- .github/workflows/sedr-library-release.yml | 15 +---- .github/workflows/spring-rules-release.yml | 15 +---- .../workflows/spring-rules-security-scan.yml | 42 ------------ 4 files changed, 69 insertions(+), 70 deletions(-) delete mode 100644 .github/workflows/spring-rules-security-scan.yml diff --git a/.github/workflows/nvd-cache-refresh.yml b/.github/workflows/nvd-cache-refresh.yml index dfa1ae7..b394708 100644 --- a/.github/workflows/nvd-cache-refresh.yml +++ b/.github/workflows/nvd-cache-refresh.yml @@ -1,8 +1,9 @@ -name: NVD Cache Refresh +name: NVD Cache Refresh & Vulnerability Scan on: schedule: - - cron: '17 2 * * 1' + - cron: '17 2 * * 1' # Every Monday at 02:17 UTC + - cron: '0 7 * * 5' # Every Friday at 07:00 UTC workflow_dispatch: jobs: @@ -85,3 +86,65 @@ jobs: echo "- Update timed out: ${{ steps.nvd-update.outputs.nvd_update_timed_out || 'false' }}" echo "- Update failed: ${{ steps.nvd-update.outputs.nvd_update_failed || 'false' }}" } >> "$GITHUB_STEP_SUMMARY" + + Read-Version-Spring-Rules: + name: Read Architecture Validator Spring Rules Version + needs: refresh-nvd-cache + runs-on: ubuntu-latest + outputs: + version: ${{ steps.read-version.outputs.version }} + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + fetch-depth: 1 + persist-credentials: false + + - name: Read version from gradle.properties + id: read-version + run: | + VERSION=$(grep -oP 'version\s*=\s*\K\S+' hexagonal-spring-rules/gradle.properties) + echo "version=$VERSION" >> "$GITHUB_OUTPUT" + + Security-Scan-Spring-Rules: + name: Vulnerability Scan - Architecture Validator Spring Rules + needs: Read-Version-Spring-Rules + uses: ./.github/workflows/security-scan.yml + with: + project_name: 'hexagonal-spring-rules' + semantic_version: ${{ needs.Read-Version-Spring-Rules.outputs.version }} + fail_on_fatal: true + reports_subpath: build/reports + secrets: + NVD_APIKEY_SEDR: ${{ secrets.NVD_APIKEY_SEDR }} + + Read-Version-Sedr-Library: + name: Read SEDR Library Version + needs: refresh-nvd-cache + runs-on: ubuntu-latest + outputs: + version: ${{ steps.read-version.outputs.version }} + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + fetch-depth: 1 + persist-credentials: false + + - name: Read version from gradle.properties + id: read-version + run: | + VERSION=$(grep -oP 'version\s*=\s*\K\S+' sedr-library/gradle.properties) + echo "version=$VERSION" >> "$GITHUB_OUTPUT" + + Security-Scan-Sedr-Library: + name: Vulnerability Scan - SEDR Library + needs: Read-Version-Sedr-Library + uses: ./.github/workflows/security-scan.yml + with: + project_name: 'sedr-library' + semantic_version: ${{ needs.Read-Version-Sedr-Library.outputs.version }} + fail_on_fatal: true + reports_subpath: build/reports + secrets: + NVD_APIKEY_SEDR: ${{ secrets.NVD_APIKEY_SEDR }} diff --git a/.github/workflows/sedr-library-release.yml b/.github/workflows/sedr-library-release.yml index ac47f3d..1f4b7c2 100644 --- a/.github/workflows/sedr-library-release.yml +++ b/.github/workflows/sedr-library-release.yml @@ -99,20 +99,9 @@ jobs: name: sedr-library-build-reports path: sedr-library/build/reports/** - Security-Scan: - needs: [Calculate-Version] - uses: ./.github/workflows/security-scan.yml - with: - semantic_version: ${{ needs.Calculate-Version.outputs.next_version }} - project_name: sedr-library - reports_subpath: build/reports - fail_on_fatal: true - secrets: - NVD_APIKEY_SEDR: ${{ secrets.NVD_APIKEY_SEDR }} - Release-sedr-library: name: Release SEDR Library - needs: [Calculate-Version, Build, Security-Scan] + needs: [Calculate-Version, Build] if: ${{ needs.Calculate-Version.outputs.next_version != '' }} uses: ./.github/workflows/semantic-version-apply.yml with: @@ -218,7 +207,7 @@ jobs: Workflow-Summary: name: Workflow Summary - needs: [Build, Security-Scan, Publish, Update-README, Release-sedr-library, Determine-Release-Type] + needs: [Build, Publish, Update-README, Release-sedr-library, Determine-Release-Type] if: always() runs-on: ubuntu-latest steps: diff --git a/.github/workflows/spring-rules-release.yml b/.github/workflows/spring-rules-release.yml index 18e74ec..22db402 100644 --- a/.github/workflows/spring-rules-release.yml +++ b/.github/workflows/spring-rules-release.yml @@ -22,17 +22,6 @@ jobs: secrets: sem_rel_token_token: ${{ secrets.SEMANTIC_RELEASE_TOKEN }} - Security-Scan: - needs: Calculate-Version - uses: ./.github/workflows/security-scan.yml - with: - fail_on_fatal: true - project_name: 'hexagonal-spring-rules' - semantic_version: ${{ needs.Calculate-Version.outputs.next_version }} - reports_subpath: build/reports - secrets: - NVD_APIKEY_SEDR: ${{ secrets.NVD_APIKEY_SEDR }} - Build: name: Build Architecture Validator Spring Rules needs: Calculate-Version @@ -84,7 +73,7 @@ jobs: Release-Spring-Rules: name: Release Architecture Validator Spring Rules - needs: [Calculate-Version, Build, Security-Scan] + needs: [Calculate-Version, Build] if: ${{ needs.Calculate-Version.outputs.next_version != '' }} uses: ./.github/workflows/semantic-version-apply.yml with: @@ -192,7 +181,7 @@ jobs: Workflow-Summary: name: Workflow Summary - needs: [Build, Security-Scan, Publish, Update-README, Release-Spring-Rules, Determine-Release-Type] + needs: [Build, Publish, Update-README, Release-Spring-Rules, Determine-Release-Type] if: always() runs-on: ubuntu-latest steps: diff --git a/.github/workflows/spring-rules-security-scan.yml b/.github/workflows/spring-rules-security-scan.yml deleted file mode 100644 index 785a45f..0000000 --- a/.github/workflows/spring-rules-security-scan.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Architecture Validator Spring Rules - Security Scan -on: - schedule: - - cron: '0 8 * * 5' # Every Friday at 08:00 UTC - workflow_dispatch: - inputs: - force_nvd_refresh: - description: 'Force dependencyCheckUpdate before analyze' - type: boolean - required: false - default: false - -jobs: - Read-Version: - name: Read Current Version - runs-on: ubuntu-latest - outputs: - version: ${{ steps.read-version.outputs.version }} - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - fetch-depth: 1 - persist-credentials: false - - - name: Read version from gradle.properties - id: read-version - run: | - VERSION=$(grep -oP 'version\s*=\s*\K\S+' hexagonal-spring-rules/gradle.properties) - echo "version=$VERSION" >> "$GITHUB_OUTPUT" - - Security-Scan: - needs: Read-Version - uses: ./.github/workflows/security-scan.yml - with: - project_name: 'hexagonal-spring-rules' - semantic_version: ${{ needs.Read-Version.outputs.version }} - fail_on_fatal: true - force_nvd_refresh: ${{ github.event_name == 'workflow_dispatch' && inputs.force_nvd_refresh || false }} - reports_subpath: build/reports - secrets: - NVD_APIKEY_SEDR: ${{ secrets.NVD_APIKEY_SEDR }} From 9a734e54ba666c01d9f93d3adbb34689f37a2657 Mon Sep 17 00:00:00 2001 From: Iwan Eising Date: Sat, 8 Aug 2026 19:45:41 +0400 Subject: [PATCH 2/2] fix(ci): stabilize security scan reporting and sedr policy What changed:\n- updated reusable security scan artifact upload path to dependency-check/dependency-check-report.html\n- aligned sedr-library dependencyCheck behavior with Option A by making failBuildOnCVSS conditional on FAIL_ON_FATAL\n- disabled Node analyzers for sedr-library (nodeAuditEnabled and nodeEnabled)\n\nWhy:\n- the failing release run could not upload the report from the old path\n- sedr-library scans were failing on npm toolchain transitive vulnerabilities unrelated to released Java artifacts\n\nHow:\n- changed the upload-artifact target in the reusable workflow to the actual generated report location\n- mirrored existing conditional CVSS gate pattern and analyzer settings used for Java-only scope\n\nOutcomes:\n- security report artifact path is now consistent with Dependency-Check output\n- sedr-library follows Option A scan scope and avoids Node lockfile-driven release failures\n- validated with actionlint on the modified workflow and a successful Gradle configuration run (./gradlew help) --- .github/workflows/security-scan.yml | 2 +- sedr-library/build.gradle | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index e4272cf..888d4ff 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -188,4 +188,4 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.PROJECT_NAME}}-reports-vulnerability - path: ${{ env.REPORTS_DIR }}/dependency-check-report.html + path: ${{ env.REPORTS_DIR }}/dependency-check/dependency-check-report.html diff --git a/sedr-library/build.gradle b/sedr-library/build.gradle index 78d5dfd..7063a1c 100644 --- a/sedr-library/build.gradle +++ b/sedr-library/build.gradle @@ -112,7 +112,11 @@ dependencyCheck { nvd { apiKey = System.getenv('NVD_APIKEY_SEDR') ?: System.getenv('NVD_APIKEY') } - failBuildOnCVSS = 9 + failBuildOnCVSS = (System.getenv('FAIL_ON_FATAL') == 'true') ? 9 : 11 + analyzers { + nodeAuditEnabled = false + nodeEnabled = false + } format = 'HTML' }