diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml new file mode 100644 index 0000000..fa29f6e --- /dev/null +++ b/.github/workflows/dependency-submission.yml @@ -0,0 +1,37 @@ +# Workflow: Dependency Graph Submission and Vulnerability Reporting +# +# Trigger: This workflow runs on every merge to the main branch. +# +# Purpose: It generates and submits a dependency graph to the GitHub Dependency Submission API. The graph is used to +# trigger Dependabot Alerts for vulnerable dependencies, and to populate the Dependency Graph insights view in GitHub. +# +# Excludes: +# - Test-only dependencies + +name: Dependency Submission + +on: + push: + branches: [ 'main' ] + +permissions: + contents: write + +jobs: + dependency-submission: + runs-on: ubuntu-latest + steps: + - name: Checkout sources + uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # pin@v4 + - name: Setup Java + uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # pin@v4 + with: + distribution: 'temurin' + java-version: 11 + - name: Generate and submit dependency graph + uses: gradle/actions/dependency-submission@d156388eb19639ec20ade50009f3d199ce1e2808 # pin@v4 + with: + dependency-graph-exclude-configurations: '.*[Tt]est(Compile|Runtime)Classpath' + build-scan-publish: true + build-scan-terms-of-use-url: "https://gralde.com/help/legal-terms-of-use" + build-scan-terms-of-use-agree: "yes" diff --git a/.github/workflows/snyk_scan.yml b/.github/workflows/snyk_scan.yml deleted file mode 100644 index f6acdd6..0000000 --- a/.github/workflows/snyk_scan.yml +++ /dev/null @@ -1,29 +0,0 @@ -# This workflow automates the process of identifying potential security vulnerabilities -# using Snyk. Dependency vulnerability scans will be run when a push is made to the main -# branch, on a weekly schedule, and can also be triggered manually. - -name: Snyk Vulnerability Scan -on: - workflow_dispatch: - schedule: - - cron: '00 15 * * 1' - push: - branches: - - main - -jobs: - security: - runs-on: ubuntu-latest - steps: - - name: Checkout Code - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # pin@v4 - with: - ref: 'main' - - - name: Run Snyk To Check For Vulnerabilities - uses: snyk/actions/gradle-jdk11@8349f9043a8b7f0f3ee8885bf28f0b388d2446e8 # pin@master - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - with: - command: monitor - args: --all-sub-projects --org=java-agent --configuration-matching='(^compileClasspath$)|(^runtimeClasspath$)'