name: OWASP Dependency Scan
on:
pull_request:
branches: [ "main" ]
push:
branches: [ "main" ]
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always
jobs:
depscan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Rust
uses: dtolnay/rust-toolchain@stable
- name: Generate lockfile when missing
run: |
if [ ! -f Cargo.lock ]; then
cargo generate-lockfile
fi
- name: Build the project
run: cargo build --release --verbose
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: "24"
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.11"
- name: Install OWASP scanning tools
run: |
npm install -g @cyclonedx/cdxgen
python -m pip install --upgrade pip
pip install owasp-depscan
- name: Create reports directory
run: mkdir -p reports
- name: Generate CycloneDX SBOM
run: cdxgen -t rust -o reports/sbom.json .
- name: Run OWASP dep-scan
run: depscan --bom reports/sbom.json --reports-dir reports
- name: Upload dependency scan reports
uses: actions/upload-artifact@v4
if: always()
with:
name: dependency-scan-reports
path: reports/