fix(ci): stabilize security scan reporting and SEDR scan scope

.github/workflows/nvd-cache-refresh.yml

@@ -1,8 +1,9 @@
-name: NVD Cache Refresh
+name: NVD Cache Refresh & Vulnerability Scan
 
 on:
   schedule:
-    - cron: '17 2 * * 1'
+    - cron: '17 2 * * 1'  # Every Monday at 02:17 UTC
+    - cron: '0 7 * * 5'   # Every Friday at 07:00 UTC
   workflow_dispatch:
 
 jobs:
@@ -85,3 +86,65 @@ jobs:
             echo "- Update timed out: ${{ steps.nvd-update.outputs.nvd_update_timed_out || 'false' }}"
             echo "- Update failed: ${{ steps.nvd-update.outputs.nvd_update_failed || 'false' }}"
           } >> "$GITHUB_STEP_SUMMARY"
+
+  Read-Version-Spring-Rules:
+    name: Read Architecture Validator Spring Rules Version
+    needs: refresh-nvd-cache
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.read-version.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Read version from gradle.properties
+        id: read-version
+        run: |
+          VERSION=$(grep -oP 'version\s*=\s*\K\S+' hexagonal-spring-rules/gradle.properties)
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+  Security-Scan-Spring-Rules:
+    name: Vulnerability Scan - Architecture Validator Spring Rules
+    needs: Read-Version-Spring-Rules
+    uses: ./.github/workflows/security-scan.yml
+    with:
+      project_name: 'hexagonal-spring-rules'
+      semantic_version: ${{ needs.Read-Version-Spring-Rules.outputs.version }}
+      fail_on_fatal: true
+      reports_subpath: build/reports
+    secrets:
+      NVD_APIKEY_SEDR: ${{ secrets.NVD_APIKEY_SEDR }}
+
+  Read-Version-Sedr-Library:
+    name: Read SEDR Library Version
+    needs: refresh-nvd-cache
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.read-version.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Read version from gradle.properties
+        id: read-version
+        run: |
+          VERSION=$(grep -oP 'version\s*=\s*\K\S+' sedr-library/gradle.properties)
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+  Security-Scan-Sedr-Library:
+    name: Vulnerability Scan - SEDR Library
+    needs: Read-Version-Sedr-Library
+    uses: ./.github/workflows/security-scan.yml
+    with:
+      project_name: 'sedr-library'
+      semantic_version: ${{ needs.Read-Version-Sedr-Library.outputs.version }}
+      fail_on_fatal: true
+      reports_subpath: build/reports
+    secrets:
+      NVD_APIKEY_SEDR: ${{ secrets.NVD_APIKEY_SEDR }}

.github/workflows/security-scan.yml

@@ -188,4 +188,4 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ env.PROJECT_NAME}}-reports-vulnerability
-          path: ${{ env.REPORTS_DIR }}/dependency-check-report.html
+          path: ${{ env.REPORTS_DIR }}/dependency-check/dependency-check-report.html

.github/workflows/sedr-library-release.yml

@@ -99,20 +99,9 @@ jobs:
           name: sedr-library-build-reports
           path: sedr-library/build/reports/**
 
-  Security-Scan:
-    needs: [Calculate-Version]
-    uses: ./.github/workflows/security-scan.yml
-    with:
-      semantic_version: ${{ needs.Calculate-Version.outputs.next_version }}
-      project_name: sedr-library
-      reports_subpath: build/reports
-      fail_on_fatal: true
-    secrets:
-      NVD_APIKEY_SEDR: ${{ secrets.NVD_APIKEY_SEDR }}
-
   Release-sedr-library:
     name: Release SEDR Library
-    needs: [Calculate-Version, Build, Security-Scan]
+    needs: [Calculate-Version, Build]
     if: ${{ needs.Calculate-Version.outputs.next_version != '' }}
     uses: ./.github/workflows/semantic-version-apply.yml
     with:
@@ -218,7 +207,7 @@ jobs:
 
   Workflow-Summary:
     name: Workflow Summary
-    needs: [Build, Security-Scan, Publish, Update-README, Release-sedr-library, Determine-Release-Type]
+    needs: [Build, Publish, Update-README, Release-sedr-library, Determine-Release-Type]
     if: always()
     runs-on: ubuntu-latest
     steps:

.github/workflows/spring-rules-release.yml

@@ -22,17 +22,6 @@ jobs:
     secrets:
       sem_rel_token_token: ${{ secrets.SEMANTIC_RELEASE_TOKEN }}
 
-  Security-Scan:
-    needs: Calculate-Version
-    uses: ./.github/workflows/security-scan.yml
-    with:
-      fail_on_fatal: true
-      project_name: 'hexagonal-spring-rules'
-      semantic_version: ${{ needs.Calculate-Version.outputs.next_version }}
-      reports_subpath: build/reports
-    secrets:
-      NVD_APIKEY_SEDR: ${{ secrets.NVD_APIKEY_SEDR }}
-
   Build:
     name: Build Architecture Validator Spring Rules
     needs: Calculate-Version
@@ -84,7 +73,7 @@ jobs:
 
   Release-Spring-Rules:
     name: Release Architecture Validator Spring Rules
-    needs: [Calculate-Version, Build, Security-Scan]
+    needs: [Calculate-Version, Build]
     if: ${{ needs.Calculate-Version.outputs.next_version != '' }}
     uses: ./.github/workflows/semantic-version-apply.yml
     with:
@@ -192,7 +181,7 @@ jobs:
 
   Workflow-Summary:
     name: Workflow Summary
-    needs: [Build, Security-Scan, Publish, Update-README, Release-Spring-Rules, Determine-Release-Type]
+    needs: [Build, Publish, Update-README, Release-Spring-Rules, Determine-Release-Type]
     if: always()
     runs-on: ubuntu-latest
     steps:

sedr-library/build.gradle

@@ -112,7 +112,11 @@ dependencyCheck {
     nvd {
         apiKey = System.getenv('NVD_APIKEY_SEDR') ?: System.getenv('NVD_APIKEY')
     }
-    failBuildOnCVSS = 9
+    failBuildOnCVSS = (System.getenv('FAIL_ON_FATAL') == 'true') ? 9 : 11
+    analyzers {
+        nodeAuditEnabled = false
+        nodeEnabled = false
+    }
     format = 'HTML'
 }