ci(owasp): cap job timeout and disable NVD auto-update in check step#1807
Merged
Conversation
The OWASP job intermittently failed with no reason other than timeouts. Root cause is the unreliable NIST NVD feed (see dependency-check#8633): keyless NVD downloads are heavily rate-limited and stall. Two fixes: - Add timeout-minutes: 30 so a hung NVD download fails fast instead of dragging to the 6h GitHub Actions default. - Add -DautoUpdate=false to the check step so it reads only the cache populated by the preceding update-only step. Previously the check step carried neither the mirror datafeed URL nor the API key, so on any cache staleness/miss it synced directly against NIST - the unreliable path. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The NIST NVD API is unreliable even with an API key (retries exhausted, see dependency-check#8633). Previously the mirror datafeed was used only when no API key was present, so apache/struts always took the flaky API path and never the mirror. Make the API update step continue-on-error and run the mirror update as a fallback when the API step fails (or when no API key is configured). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The OWASP checkup workflow fails intermittently, sometimes with no reason other than timeouts (as seen in #1667). Root cause is external: the NIST NVD feed is unreliable (see dependency-check#8633) — even with an API key the update can exhaust its retries and fail, and without one it is heavily rate-limited and stalls.
Contributing config issues:
OWASP checkstep carried neither the mirror datafeed URL nor the API key, so on cache staleness/miss it synced directly against NIST.Changes
timeout-minutes: 30on theowaspjob so a stuck download fails fast.-DautoUpdate=falseon the check step so it reads only the NVD cache populated by the update-only step, never phoning NIST directly.continue-on-error, and the mirror datafeed update runs when no API key is configured or when the API update fails. This makes the reliable mirror the automatic fallback instead of a no-key-only path.Verification
Confirmed on this PR's CI that the API update step was the failing step (
NvdApiRetryExceededException, retries exhausted) on the API-key path — which the mirror fallback now covers.🤖 Generated with Claude Code