Include a GitHub workflow for vulnerability scanning

[alexanderpann]

No description provided.

[arimer]

Lets give it a full name like : "Dependency Check report"

[arimer]

At the moment the report is just uploaded as an aritfact. What is the intention behind this? Will there be an automated check of the report or anything like that in the future?

[arimer]

1. Are the platform dependencies to mbeddr / mps-extensions / mps-qa excluded by default? A local dependency calculation looks like this, but most of those deps. did not make it to the report?

**Report:** 2. What about the custom JBR that we are using for building? Do we need to list it? 3. Could you maybe link the documentation to the provider of that plugin?

[alexanderpann]

At the moment the report is just uploaded as an aritfact. What is the intention behind this? Will there be an automated check of the report or anything like that in the future?

I first wanted to check if we have any vulnerabilities. We could set --failOnCVSS 7 (fail on severity level 7 or higher out of 10) so that the build fails when an issue is found. If we fail the build, someone has to fix it immediately, which we might not want.

Are the platform dependencies excluded by default?

They seem to be excluded, but to be honest I don't understand how it works. For me this behavior is correct since we only want to check the current platform and also keep the checking fast.

What about the custom JBR that we are using for building?

If we want to check it, the vulnerability check would have to be done in https://github.com/mbeddr/build.publish.jdk. Since we don't build anything here, the generic JDK is fine.

Could you maybe link the documentation

This is the GitHub action: https://github.com/dependency-check/Dependency-Check_Action
The arguments are documented here: https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html