Check dependency vulnerabilities #177

	# SPDX-FileCopyrightText: 2024, 2025 SURF B.V.
	# SPDX-License-Identifier: EPL-2.0 WITH Classpath-exception-2.0
	# SPDX-FileContributor: Joost Diepenmaat
	# SPDX-FileContributor: Remco van 't Veer

	name: Check dependency vulnerabilities

	on:
	push:
	schedule:
	- cron: '0 1 * * 1,2,3,4,5' # every workday

	jobs:
	"NVD-check":
	runs-on: ubuntu-22.04

	steps:

	# NVD data can change every day, so we use a cache key based on today's date
	- name: Get current date
	id: date
	run: echo "date=$(date '+%Y-%m-%d')" >> $GITHUB_OUTPUT

	- uses: actions/checkout@v4
	- uses: actions/cache@v4
	with:
	path: "~/.m2"

	# store as today's cache
	key: "nvd-clojure-${{ steps.date.outputs.date }}"
	# if today's cache does not yet exist, fetch from whatever iss
	# the most recent cache for nvd-clojure
	# and update that
	restore-keys: "nvd-clojure-"

	- uses: actions/setup-java@v4
	with:
	distribution: 'temurin'
	java-version: '21'

	- name: Install clj runtime
	run: \|
	.github/workflows/install-binaries.sh
	echo "${PWD}/bin" >> $GITHUB_PATH

	- name: Check that NVD Secret is set
	env:
	NVD_API_TOKEN: ${{ secrets.NVD_API_TOKEN }}
	if: ${{ env.NVD_API_TOKEN == '' }}
	run: echo "NVD_API_TOKEN secret is empty"; exit 1

	- name: Check clojure dependencies with NVD
	env:
	CLJ_WATSON_NVD_API_KEY: "${{ secrets.NVD_API_TOKEN }}"
	run: \|
	clojure -M:clj-watson scan -p deps.edn -f -w .watson.properties

Provide feedback