diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fc05ef6b3..eaf6f9333 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -57,3 +57,11 @@ updates: time: "22:00" timezone: Europe/London open-pull-requests-limit: 99 +- package-ecosystem: github-actions + directory: "/" + schedule: + interval: monthly + groups: + github-actions: + patterns: + - "*" \ No newline at end of file diff --git a/.github/workflows/dependency-graph.yml b/.github/workflows/dependency-graph.yml new file mode 100644 index 000000000..1611a05cc --- /dev/null +++ b/.github/workflows/dependency-graph.yml @@ -0,0 +1,26 @@ +name: "Load Dependency Graph" + +on: + push: + branches: + - "main" + - "master" + schedule: + - cron: '0 6 * * *' + workflow_call: + workflow_dispatch: + +jobs: + scan-dependencies: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: Alfresco/alfresco-build-tools/.github/actions/maven-dependency-scan@v15.9.0 + with: + java-version: '21' + maven-version: '3.9.9' + maven-args: -Dscopes=compile,runtime + maven-username: ${{ secrets.NEXUS_USERNAME }} + maven-password: ${{ secrets.NEXUS_PASSWORD }} + maven-settings-path: ".ci.settings.xml" \ No newline at end of file