use GitHub action for DependencyCheck #140

	name: EUM Server Tests

	on:
	push:
	branches:
	- main
	pull_request:
	branches:
	- main
	paths-ignore:
	- 'README.md'
	workflow_call:

	env:
	NVD_API_TOKEN: ${{ secrets.NVD_API_KEY }} # Token to access NVD API for dependency-check

	jobs:
	test:
	name: Run Tests
	runs-on: ubuntu-latest
	container: openjdk:17-jdk-slim
	steps:
	- uses: actions/checkout@v3
	- name: Grant execute permission for gradlew
	run: chmod +x gradlew
	- name: test
	run: ./gradlew test

	dependency-scan:
	name: Dependency Scan
	runs-on: ubuntu-latest
	container: openjdk:17-jdk-slim
	steps:
	- uses: actions/checkout@v3
	- name: Grant execute permission for gradlew
	run: chmod +x gradlew
	- name: build
	run: ./gradlew assemble
	# the action has not been updated a while, but it always uses the latest plugin version
	- name: Run DependencyCheck plugin
	uses: dependency-check/Dependency-Check_Action@main
	id: Depcheck
	with:
	project: ${{ github.repository }}
	path: '.'
	format: 'HTML'
	out: 'reports'
	args: >
	--failOnCVSS 6
	--suppression dependencyCheckSuppression.xml
	--disableAssembly
	--nvdApiKey ${{ secrets.NVD_API_KEY }}
	--nvdApiDelay 10000
	- name: Upload test results
	uses: actions/upload-artifact@v3
	with:
	name: dependency-check-report-eum-server
	path: ${{ github.workspace }}/reports

Provide feedback