dependency-check-data.yml

name: Dependency Check Data

on:
  schedule:
    - cron: '23 2 * * *'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  update:
    name: Refresh NVD data
    runs-on: ubuntu-latest
    # A first-time NVD API import exceeded 150 minutes before reaching 70%.
    # The mirror bootstrap below normally avoids this, while the longer bound
    # leaves room for an unusually large authenticated API delta.
    timeout-minutes: 360
    concurrency:
      group: trusted-nvd-update
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
      - name: Select UTC cache day
        id: odc-day
        run: echo "value=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT"
      - name: Restore Dependency Check data
        id: odc-cache
        uses: actions/cache/restore@v4
        with:
          path: ${{ runner.temp }}/teaql-odc-data
          key: odc-v13.0.0-${{ runner.os }}-${{ steps.odc-day.outputs.value }}
          restore-keys: |
            odc-v13.0.0-${{ runner.os }}-
      - name: Bootstrap empty cache from Dependency-Check data feed
        run: |
          data_dir="${{ runner.temp }}/teaql-odc-data"
          if find "$data_dir" -type f -name '*.mv.db' -size +1M -print -quit 2>/dev/null | grep -q .; then
            echo "Populated Dependency-Check database restored; skipping full feed bootstrap"
            exit 0
          fi
          mvn -B org.owasp:dependency-check-maven:13.0.0:update-only \
            '-DnvdDatafeedUrl=https://dependency-check.github.io/DependencyCheck_Builder/nvd_cache/nvdcve-{0}.json.gz' \
            "-DdataDirectory=$data_dir" \
            -DfailOnError=true
      - name: Refresh NVD data
        env:
          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
        run: >-
          mvn -B org.owasp:dependency-check-maven:13.0.0:update-only
          -DnvdApiKeyEnvironmentVariable=NVD_API_KEY
          -DnvdValidForHours=0
          -DdataDirectory=${{ runner.temp }}/teaql-odc-data
          -DfailOnError=true
      - name: Verify and timestamp refreshed database
        run: |
          data_dir="${{ runner.temp }}/teaql-odc-data"
          if ! find "$data_dir" -type f -name '*.mv.db' -size +1M -print -quit | grep -q .; then
            echo "Dependency-Check did not produce a populated H2 database" >&2
            exit 1
          fi
          date -u +%s > "$data_dir/teaql-nvd-refresh.epoch"
      - name: Retain trusted NVD snapshot
        uses: actions/upload-artifact@v4
        with:
          name: teaql-odc-v13.0.0-${{ runner.os }}
          path: ${{ runner.temp }}/teaql-odc-data
          if-no-files-found: error
          retention-days: 3
      - name: Save refreshed Dependency Check data
        if: success() && steps.odc-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: ${{ runner.temp }}/teaql-odc-data
          key: odc-v13.0.0-${{ runner.os }}-${{ steps.odc-day.outputs.value }}