This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/struts.git
The following commit(s) were added to refs/heads/main by this push:
new b154b7ca4 ci(owasp): cap job timeout and disable NVD auto-update in
check step (#1807)
b154b7ca4 is described below
commit b154b7ca437b1a46f5b1668f1ad08ff55749d8f5
Author: Lukasz Lenart <[email protected]>
AuthorDate: Wed Jul 22 18:52:56 2026 +0200
ci(owasp): cap job timeout and disable NVD auto-update in check step (#1807)
* ci(owasp): cap job timeout and disable NVD auto-update in check step
The OWASP job intermittently failed with no reason other than timeouts.
Root cause is the unreliable NIST NVD feed (see dependency-check#8633):
keyless NVD downloads are heavily rate-limited and stall.
Two fixes:
- Add timeout-minutes: 30 so a hung NVD download fails fast instead of
dragging to the 6h GitHub Actions default.
- Add -DautoUpdate=false to the check step so it reads only the cache
populated by the preceding update-only step. Previously the check step
carried neither the mirror datafeed URL nor the API key, so on any cache
staleness/miss it synced directly against NIST - the unreliable path.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
* ci(owasp): fall back to NVD mirror when the API update fails
The NIST NVD API is unreliable even with an API key (retries exhausted,
see dependency-check#8633). Previously the mirror datafeed was used only
when no API key was present, so apache/struts always took the flaky API
path and never the mirror.
Make the API update step continue-on-error and run the mirror update as a
fallback when the API step fails (or when no API key is configured).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
---------
Co-authored-by: Claude Opus 4.8 <[email protected]>
---
.github/workflows/owasp.yml | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/owasp.yml b/.github/workflows/owasp.yml
index 2ede21325..661b09187 100644
--- a/.github/workflows/owasp.yml
+++ b/.github/workflows/owasp.yml
@@ -37,6 +37,7 @@ jobs:
owasp:
name: OWASP
runs-on: ubuntu-latest
+ timeout-minutes: 30
env:
HAVE_NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY != '' }}
steps:
@@ -60,13 +61,15 @@ jobs:
nvd-cache-${{ runner.os }}-
- name: OWASP Dependency check update cache via NIST_NVD_API_KEY
+ id: nvd-api-update
if: ${{ env.HAVE_NIST_NVD_API_KEY == 'true' }}
+ continue-on-error: true
run: mvn -N -V -DskipAssembly -Dmaven.test.skip=true -Powasp-nvd-api
-Pdependency-update-only --no-transfer-progress
env:
NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY}}
- name: OWASP Dependency check update cache via Mirror
- if: ${{ env.HAVE_NIST_NVD_API_KEY == 'false' }}
+ if: ${{ env.HAVE_NIST_NVD_API_KEY == 'false' ||
steps.nvd-api-update.outcome == 'failure' }}
run: mvn -N -V -DskipAssembly -Dmaven.test.skip=true
-Powasp-nvd-mirror -Pdependency-update-only --no-transfer-progress
- name: Cache NVD Database
@@ -77,7 +80,7 @@ jobs:
key: nvd-cache-${{ runner.os }}-owasp-${{ github.run_id }}
- name: OWASP check (Without running tests)
- run: mvn -B org.owasp:dependency-check-maven:aggregate
-Pdependency-check -Pjakartaee11 --no-transfer-progress
+ run: mvn -B org.owasp:dependency-check-maven:aggregate
-Pdependency-check -Pjakartaee11 -DautoUpdate=false --no-transfer-progress
- name: Upload Dependency Check reports
uses: actions/upload-artifact@v7
