From e5147e4cf4fab96b655480dd82394cce4151ffe5 Mon Sep 17 00:00:00 2001 From: Thomas Pierce Date: Thu, 19 Mar 2026 12:06:48 -0700 Subject: [PATCH] fix(daily-scan): move DependencyCheck install to /tmp to avoid self-scan false positives --- .github/workflows/daily-scan.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/daily-scan.yml b/.github/workflows/daily-scan.yml index 77f9668b..2fd492de 100644 --- a/.github/workflows/daily-scan.yml +++ b/.github/workflows/daily-scan.yml @@ -73,8 +73,8 @@ jobs: curl -Ls "https://github.com/dependency-check/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip" --output dependency-check.zip curl -Ls "https://github.com/dependency-check/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip.asc" --output dependency-check.zip.asc gpg --verify dependency-check.zip.asc - unzip dependency-check.zip - ./dependency-check/bin/dependency-check.sh --enableExperimental --failOnCVSS 0 --nvdApiKey ${{ env.NVD_API_KEY_NVD_API_KEY }} --ossIndexUsername ${{ env.OSS_INDEX_USERNAME }} --ossIndexPassword ${{ env.OSS_INDEX_PASSWORD }} -s "." + unzip dependency-check.zip -d /tmp + /tmp/dependency-check/bin/dependency-check.sh --enableExperimental --failOnCVSS 0 --nvdApiKey ${{ env.NVD_API_KEY_NVD_API_KEY }} --ossIndexUsername ${{ env.OSS_INDEX_USERNAME }} --ossIndexPassword ${{ env.OSS_INDEX_PASSWORD }} -s "." - name: Print dependency scan results on failure if: ${{ steps.dep_scan.outcome != 'success' }}