Adding dependency check

lensesio · Jun 19, 2024 · 3ba48c3 · 3ba48c3
1 parent 95f6c9f
commit 3ba48c3
Show file tree

Hide file tree

Showing 2 changed files with 48 additions and 1 deletion.
diff --git a/README.md b/README.md
@@ -42,14 +42,33 @@ To check the code style run:
 mvn checkstyle:check
 ```
 
+## Formatter
+
 To format the code run:
 
 ```bash
   mvn com.coveo:fmt-maven-plugin:format
 ```
 
+## License Headers
+
 To add license header, run:
 
 ```bash
 mvn license:format
-```
+```
+
+## Dependency Check
+
+To run the dependency check:
+
+1. **Getting NVD API Key:**
+    - Visit the [National Vulnerability Database (NVD) Website](https://nvd.nist.gov), sign up or log in to obtain your API key.
+
+2. **Setting NVD API Key in Environment Variable:**
+    - **Mac (zsh):** Add `export NVD_API_KEY=your_api_key_here` to `~/.zshrc`.
+    - **Windows:** Use `setx NVD_API_KEY "your_api_key_here"` in Command Prompt (Admin).
+    - **Linux (bash):** Add `export NVD_API_KEY=your_api_key_here` to `~/.bashrc`.
+
+3. **Running `mvn verify` for Dependency Check Plugin:**
+    - Run `mvn verify` to execute it. This will put a `dependency-check-report.html` in the target directory which will give you details of the scan result.
diff --git a/pom.xml b/pom.xml
@@ -165,6 +165,34 @@
                     </mapping>
                 </configuration>
             </plugin>
+
+            <plugin>
+                <groupId>org.owasp</groupId>
+                <artifactId>dependency-check-maven</artifactId>
+                <version>9.2.0</version>
+                <configuration>
+                    <failBuildOnCVSS>5</failBuildOnCVSS>
+                    <nvdApiKeyEnvironmentVariable>NVD_API_KEY</nvdApiKeyEnvironmentVariable>
+                    <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
+                    <scanSet>
+                            <fileSet>
+                                <directory>${basedir}/target</directory>
+                                <includes>
+                                    <include>kafka-connect-smt-*.jar</include>
+                                </includes>
+                            </fileSet>
+                    </scanSet>
+                </configuration>
+                <executions>
+                    <execution>
+                        <id>check-dependencies</id>
+                        <phase>verify</phase>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
     </build>
 </project>