action.yml

name: 'Clojure NVD Scan'
description: 'Scans a Clojure deps.edn project for vulnerabilities'
inputs:
  nvd-api-key:
    description: 'NVD API key'
    required: true
  working-directory:
    description: 'Directory in which to execute the NVD scan'
    required: false
  config-filename:
    description: 'Config file path'
    required: false
    default: '""'
  aliases:
    description: 'colon separated list of deps.edn alias(es) to run the scan on'
    required: false
    default: ''
  clojure-version:
    description: 'clojure cli version'
    required: false
    default: '1.11.3.1463'
  nvd-clojure-version:
    description: 'version of the nvd-clojure tool'
    required: false
    default: 'RELEASE'
  dependency-check-version:
    description: 'version of org.owasp/dependency-check-core'
    required: false
    default: 'RELEASE'
  java-opts:
    description: 'options for the JVM'
    required: false
    default: '-Xmx1g'
runs:
  using: "composite"
  steps:

    - uses: DeLaGuardo/setup-clojure@12.5
      with:
        cli: ${{ inputs.clojure-version }}

    - name: Cache maven
      uses: actions/cache@v4
      env:
        cache-name: cache-maven
      with:
        path: ~/.m2
        key: ${{ runner.os }}-nvd-${{ env.cache-name }}-${{ hashFiles('**/deps.edn') }}
        restore-keys: |
          ${{ runner.os }}-nvd-${{ env.cache-name }}-
          ${{ runner.os }}-nvd-
          ${{ runner.os }}-
        save-always: true

    - name: Cache gitlibs
      uses: actions/cache@v4
      env:
        cache-name: cache-gitlibs
      with:
        path: ~/.gitlibs
        key: ${{ runner.os }}-nvd-${{ env.cache-name }}-${{ hashFiles('**/deps.edn') }}
        restore-keys: |
          ${{ runner.os }}-nvd-${{ env.cache-name }}-
          ${{ runner.os }}-nvd-
          ${{ runner.os }}-
        save-always: true

    - name: NVD Scan
      run: clojure -Sdeps '{:deps {nvd-clojure/nvd-clojure {:mvn/version "${{ inputs.nvd-clojure-version }}"} org.owasp/dependency-check-core {:mvn/version "${{ inputs.dependency-check-version }}"}}}' -M -m nvd.task.check ${{ inputs.config-filename }} "$(clojure -A:${{ inputs.aliases }} -Spath)"
      working-directory: ${{ inputs.working-directory }}
      shell: bash
      env:
        NVD_API_TOKEN: ${{ inputs.nvd-api-key }}
        JAVA_OPTS: ${{ inputs.java-opts }}