Merge pull request #21 from SURFnet/improve-workflows

Use jomco/clojure-action and make NVD dependency check more reliable

Author: remvee

.github/workflows/build.yml

@@ -11,23 +11,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache@v4
-      with: { path: "~/.m2", key: "${{ runner.os }}-${{ hashFiles('deps.edn') }}-m2" }
-    - uses: actions/cache@v4
-      with:
-        key: "clojure-${{ runner.os }}-${{ hashFiles('.github/workflows/install-binaries.sh') }}"
-        path: |
-          ~/bin
-          ~/lib
+    - uses: actions/checkout@v7
+    - uses: jomco/clojure-action@v0
+      with: { m2-cache-key: m2-build-checks }
 
     - name: Install packages
       run: |
         sudo apt-get install -y reuse
 
-    - name: Install clj runtime
-      run: .github/workflows/install-binaries.sh
-
     - name: Run release checks
       run: make release_check
 
@@ -78,23 +69,13 @@ jobs:
           - standalone.jar
 
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache@v4
-      with: { path: "~/.m2", key: "${{ runner.os }}-${{ hashFiles('deps.edn') }}-m2" }
-    - uses: actions/cache@v4
-      with:
-        key: "clojure-${{ runner.os }}-${{ hashFiles('.github/workflows/install-binaries.sh') }}"
-        path: |
-          ~/bin
-          ~/lib
+    - uses: jomco/clojure-action@v0
+      with: { m2-cache-key: m2-build-artifacts }
 
     - name: Artifact name
       run: echo filename=eduhub-validator-${{ needs.create_release.outputs.version }}-${{ matrix.arch }} >> $GITHUB_OUTPUT
       id: artifact
-    
-    - name: Install clj runtime
-      run: .github/workflows/install-binaries.sh
-      
+
     - name: Build artifact
       run: make ${{ steps.artifact.outputs.filename }}
 

.github/workflows/dependency-vulnerabilities.yml

@@ -14,34 +14,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-
-    # NVD data can change every day, so we use a cache key based on today's date
-    - name: Get current date
-      id: date
-      run: echo "date=$(date '+%Y-%m-%d')" >> $GITHUB_OUTPUT
-
-    - uses: actions/checkout@v4
-    - uses: actions/cache@v4
-      with:
-        path: "~/.m2"
-          
-        # store as today's cache
-        key: "nvd-clojure-${{ steps.date.outputs.date }}"
-        # if today's cache does not yet exist, fetch from whatever iss
-        # the most recent cache for nvd-clojure
-        # and update that
-        restore-keys: "nvd-clojure-"
-        
-    - name: Install clj runtime
-      run: .github/workflows/install-binaries.sh
-
-    - name: Check that NVD Secret is set
-      env:
-        NVD_API_TOKEN: ${{ secrets.NVD_API_TOKEN }}
-      if: ${{ env.NVD_API_TOKEN == '' }}
-      run: echo "NVD_API_TOKEN secret is empty"; exit 1
+    - uses: actions/checkout@v7
+    - uses: jomco/clojure-action@v0
+      with: { m2-cache-key: m2-nvd }
 
     - name: Check clojure dependencies with NVD
-      env:
-        CLJ_WATSON_NVD_API_KEY: "${{ secrets.NVD_API_TOKEN }}"
       run: make watson

Makefile

@@ -108,6 +108,9 @@ generated/resources/extra.css: $(sds_green_css_files)
 	mkdir -p generated/resources
 	cat $(sds_green_css_files) > $@
 
+export CLJ_WATSON_NVD_API_KEY=dummy # note: required but not used
+export CLJ_WATSON_NVD_API_DATAFEED_URL=https://dependency-check.github.io/DependencyCheck_Builder/nvd_cache/nvdcve-{0}.json.gz
+
 watson:
 	clojure -M:watson scan -p deps.edn -f -s -w .watson.properties
 

README.md

@@ -112,8 +112,6 @@ directory and are built into the binary releases:
   - `ooapi` -- the full OOAPI v5 specification
   - `rio` -- the RIO profile of OOAPI v5.
   - `eduxchange` -- the eduxchange profile of OOAPI v5.
-  - `ooapi-v6` -- the full OOAPI v6 specification
-  - `rio-v6` -- the RIO profile of OOAPI v6
 
 # Extending the validator