scan-with-owasp-dependency-check.yml

# Name of the GitHub Actions workflow
name: Scan with OWASP Dependency Check

# Define when the workflow should be triggered
on:
  push:
    branches:
      - development # Trigger when code is pushed to the 'development' branch
      - main # Trigger when code is pushed to the 'main' branch

# Define the job(s) to be executed within the workflow
jobs:
  depchecktest:
    name: Scan with OWASP Dependency Check

    runs-on: [ 'ubuntu-latest' ] # Use the latest version of Ubuntu

    # Define permissions for specific actions
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        # Step: Checkout code
        # Action to check out the code from the repository
        # This step fetches the codebase from the GitHub repository

      - name: Scan with OWASP Dependency Check
        uses: dependency-check/Dependency-Check_Action@main
        id: Depcheck
        with:
          project: 'Mutillidae' # Project name for Dependency Check
          path: '.' # Scan all files in the current directory
          format: 'SARIF' # Output format for scan results
          out: '.' # Output directory (default is the current directory)
          args: >
            --enableRetired # Additional scan arguments for Dependency Check
        continue-on-error: true
        # Step: Scan with OWASP Dependency Check
        # Action to run OWASP Dependency Check to scan dependencies
        # It identifies vulnerabilities in project dependencies

      - name: Upload results from OWASP Dependency Check to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: dependency-check-report.sarif
          # Step: Upload results to GitHub Code Scanning
          # Action to upload the results of the OWASP Dependency Check scan in SARIF format
          # This allows viewing and analyzing the scan results in the GitHub repository
          category: "Scan-dependencies-code-with-OWASP-Dependency-Check"
          # Specify a category to distinguish between multiple analyses
          # for the same tool and ref. If you don't use `category` in your workflow,
          # GitHub will generate a default category name for you