* ci(owasp): cap job timeout and disable NVD auto-update in check step
The OWASP job intermittently failed with no reason other than timeouts.
Root cause is the unreliable NIST NVD feed (see dependency-check#8633):
keyless NVD downloads are heavily rate-limited and stall.
Two fixes:
- Add timeout-minutes: 30 so a hung NVD download fails fast instead of
dragging to the 6h GitHub Actions default.
- Add -DautoUpdate=false to the check step so it reads only the cache
populated by the preceding update-only step. Previously the check step
carried neither the mirror datafeed URL nor the API key, so on any cache
staleness/miss it synced directly against NIST - the unreliable path.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* ci(owasp): fall back to NVD mirror when the API update fails
The NIST NVD API is unreliable even with an API key (retries exhausted,
see dependency-check#8633). Previously the mirror datafeed was used only
when no API key was present, so apache/struts always took the flaky API
path and never the mirror.
Make the API update step continue-on-error and run the mirror update as a
fallback when the API step fails (or when no API key is configured).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* OWASP + Github workflow updates
* Library updates
* Dependancy suppression cleanup
* #1667 PR Review updates, use NIST_NVD_API_KEY when available else use mirror for forks not configured, remove workflow_call for now since we don't on call
Lukasz Lenart