cve-scanning.yml

name: CVE Scanning
on:
  push:

jobs:
  node-modules-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Set up Node
        uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Build project with NPM
        run: npm install --omit=dev
        working-directory: .
      - name: Depcheck
        uses: dependency-check/Dependency-Check_Action@1b5d19fd4a32ff0ff982e8c9d8e27dbf7ac8a46c
        id: Depcheck
        with:
          project: 'legend-engine-ide-vscode'
          path: '.'
          format: 'HTML'
          out: 'reports'
          args: >
            --suppression allow-list.xml
            --nodeAuditSkipDevDependencies
            --nodePackageSkipDevDependencies
            --failOnCVSS 7
            --enableRetired
      - name: Upload Test results
        if: ${{ always() }}
        uses: actions/upload-artifact@v2
        with:
          name: Depcheck report
          path: ${{ github.workspace }}/reports