ci: add PR workflow for checking dependencies

halestudio · Oct 10, 2023 · 147d66e · 147d66e
1 parent df4ed08
commit 147d66e
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
@@ -0,0 +1,22 @@
+name: Check
+
+on:
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  check:
+    uses: wetransform/gha-workflows/.github/workflows/gradle-library.yml@master
+    with:
+      gradle-tasks: ''
+      java-version: 17
+      notify-failure: false
+      # skip-build: true
+      expect-tests: false
+      submodules: 'recursive'
+
+      # rename lockfile so trivy picks it up
+      pre-build-command: mv gradle/dependency-locks/platform.lockfile gradle/dependency-locks/platform-gradle.lockfile
+    secrets: inherit
+
diff --git a/build.gradle b/build.gradle
@@ -212,6 +212,9 @@ configurations {
 				details.useTarget "com.hierynomus:sshj:${details.requested.version}"
 			}
 		}
+
+		// activate dependency locking for generating a lockfile for security scanning
+		resolutionStrategy.activateDependencyLocking()
 	}
 }
-Original file line number
+Diff line change
@@ Expand Up / @@ -212,6 +212,9 @@ configurations { @@
     				details.useTarget "com.hierynomus:sshj:${details.requested.version}"
     			}
     		}
+    		// activate dependency locking for generating a lockfile for security scanning
+    		resolutionStrategy.activateDependencyLocking()
     	}
     }
@@ Expand Down @@