owasp-scan.yml

name: OWASP Dependency Scan

on:
  push:
    branches:
      - develop
  pull_request:
    branches:
      - develop

jobs:
  owasp-scan:
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Use Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '20'
          cache: "npm"

      - name: Install dependencies
        run: npm ci
        
      - name: Set up Java 11
        uses: actions/setup-java@v3
        with:
          distribution: 'adopt'
          java-version: '11'

      - name: Install OWASP Dependency-Check
        run: |
          wget https://github.com/jeremylong/DependencyCheck/releases/download/v10.0.3/dependency-check-10.0.3-release.zip
          unzip dependency-check-10.0.3-release.zip
          mkdir -p ./dependency-report
        

      - name: Run OWASP Dependency-Check for Frontend
        run: |
          ./dependency-check/bin/dependency-check.sh --project UniRent --out ./dependency-report/unirent.html --scan ./ --nvdApiKey ${{ secrets.NVD_API_KEY }}

      # - name: Run OWASP Dependency-Check for accommodationFunction
      #   run: |
      #     ./dependency-check/bin/dependency-check.sh --project accommodationFunction --out ./dependency-report/accommodationFunction.html --scan ./amplify/backend/function/accommodationFunction/src --nvdApiKey ${{ secrets.NVD_API_KEY }}

      # - name: Run OWASP Dependency-Check for geocodingHandler 
      #   run: |
      #     ./dependency-check/bin/dependency-check.sh --project geocodingHandler --out ./dependency-report/geocodingHandler.html --scan ./amplify/backend/function/geocodingHandler/src --nvdApiKey ${{ secrets.NVD_API_KEY }}

      # - name: Run OWASP Dependency-Check for locationSearchApi 
      #   run: |
      #     ./dependency-check/bin/dependency-check.sh --project locationSearchApi --out ./dependency-report/locationSearchApi.html --scan ./amplify/backend/function/locationSearchApi/src --nvdApiKey ${{ secrets.NVD_API_KEY }}

      # - name: Run OWASP Dependency-Check for recommendationHandler 
      #   run: |
      #     ./dependency-check/bin/dependency-check.sh --project recommendationHandler --out ./dependency-report/recommendationHandler.html --scan ./amplify/backend/function/recommendationHandler/src --nvdApiKey ${{ secrets.NVD_API_KEY }}

      - name: Upload Dependency-Check Reports
        uses: actions/upload-artifact@v3
        with:
          name: dependency-check-reports
          path: ./dependency-report/