dash-dependency-check.yml

#
# Copyright (c) 2023 Volkswagen AG
# Copyright (c) 2023 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST)
# Copyright (c) 2023 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Apache License, Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# SPDX-License-Identifier: Apache-2.0
#

name: "3rd Party Dependency Check (Eclipse Dash Tool)"

on:
  workflow_dispatch:
  pull_request:
    branches:
      - main

permissions:
  contents: write

jobs:
  check-dependencies-frontend:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Run dash
        id: run-dash
        uses: eclipse-tractusx/sig-infra/.github/actions/run-dash@8ee6e411b82105c5f553a6115dd64fb9c6d4df2a #2023-11-17
        with:
          dash_version: "1.0.2"
          dash_input: "./frontend/package-lock.json"
          dependencies_file: "DEPENDENCIES_FRONTEND"
          fail_on_out_of_date: true
          fail_on_rejected: true
          fail_on_restricted: true
  check-dependencies-backend:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up JDK 17
        uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Generate dependencies file
        run: cd backend && mvn dependency:list -DskipTests -Dmaven.javadoc.skip=true -DappendOutput=true -DoutputFile=maven.dependencies

      - name: Run dash
        id: run-dash
        uses: eclipse-tractusx/sig-infra/.github/actions/run-dash@8ee6e411b82105c5f553a6115dd64fb9c6d4df2a #2023-11-17
        with:
          dash_version: "1.0.2"
          dash_input: "./backend/maven.dependencies"
          dependencies_file: "DEPENDENCIES_BACKEND"
          fail_on_out_of_date: true
          fail_on_rejected: true
          fail_on_restricted: true