ci(owasp): bun monorepo support — setup via local action, bun install, create per-package node_modules symlinks so ODC sees deps; enable experimental analyzers; upload reports

Author: riatzukiza

.github/workflows/owasp-scan.yml

@@ -1,79 +1,66 @@
 name: owasp-dependency-check
 on:
-  workflow_dispatch:
+  pull_request:
   release:
     types: [published]
-  pull_request:
-    branches: [dev]
-  schedule:
-    - cron: "0 5 * * 1" # weekly, 05:00 UTC Mondays
+  workflow_dispatch:
 
 permissions:
   contents: read
+  security-events: write
 
 jobs:
   depcheck:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout (release tag)
+        if: github.event_name == 'release'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - name: Checkout (PR/default)
+        if: github.event_name != 'release'
+        uses: actions/checkout@v4
 
-      - name: Detect JS tooling (bun / node)
-        id: meta
-        run: |
-          set -e
-          has_file() { git ls-files -z | tr '\0' '\n' | grep -qE "$1" && echo true || echo false; }
-          echo "has_bun=$(has_file '(^|/)bun\.lockb$')" >> "$GITHUB_OUTPUT"
-          echo "has_node=$(has_file '(^|/)package\.json$')" >> "$GITHUB_OUTPUT"
-          echo "has_pnpm_lock=$(has_file '(^|/)pnpm-lock\.yaml$')" >> "$GITHUB_OUTPUT"
-          echo "has_yarn_lock=$(has_file '(^|/)yarn\.lock$')" >> "$GITHUB_OUTPUT"
-          echo "has_package_lock=$(has_file '(^|/)package-lock\.json$')" >> "$GITHUB_OUTPUT"
+      - name: Setup Bun (repo action)
+        uses: ./.github/actions/setup-bun
 
-      - name: Setup Bun (if bun.lockb present)
-        if: steps.meta.outputs.has_bun == 'true'
-        run: |
-          curl -fsSL https://bun.sh/install | bash
-          echo "$HOME/.bun/bin" >> $GITHUB_PATH
-          bun --version
+      - name: Install workspace deps (Bun)
+        run: bun install --frozen-lockfile || bun install
 
-      - name: Install JS deps for analysis
-        if: steps.meta.outputs.has_bun == 'true' || steps.meta.outputs.has_node == 'true'
+      - name: Ensure per-package node_modules (symlink to root)
         run: |
           set -e
-          if [ "${{ steps.meta.outputs.has_bun }}" = "true" ]; then
-            bun install --frozen-lockfile || bun install
-          else
-            sudo apt-get update -y
-            sudo apt-get install -y nodejs npm || true
-            npm i -g corepack || true
-            corepack enable || true
-            if [ "${{ steps.meta.outputs.has_pnpm_lock }}" = "true" ]; then corepack prepare pnpm@9 --activate || true; pnpm install --frozen-lockfile || pnpm install || true; fi
-            if [ "${{ steps.meta.outputs.has_package_lock }}" = "true" ]; then npm ci || npm i || true; fi
-            if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then corepack prepare yarn@stable --activate || true; yarn install --frozen-lockfile || yarn install || true; fi
-          fi
+          root_nm="$(pwd)/node_modules"
+          if [ ! -d "$root_nm" ]; then echo 'No root node_modules after bun install' >&2; exit 1; fi
+          # create a node_modules symlink in every workspace package that lacks one
+          git ls-files -z | tr '\0' '\n' | grep -E '(^|/)package.json$' | while read -r pj; do
+            pkgdir="$(dirname "$pj")"
+            [ "$pkgdir" = ".github/actions/setup-bun" ] && continue
+            if [ ! -d "$pkgdir/node_modules" ]; then
+              echo "linking $pkgdir/node_modules -> $root_nm"
+              ln -s "$root_nm" "$pkgdir/node_modules" || true
+            fi
+          done
 
       - name: Cache dependency-check data
         uses: actions/cache@v4
         with:
           path: ~/.m2/repository/org/owasp/dependency-check-data/
-          key: depcheck-data-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
+          key: depcheck-data-${{ runner.os }}-v2
           restore-keys: |
             depcheck-data-${{ runner.os }}-
 
       - name: Run OWASP Dependency-Check
         uses: dependency-check/[email protected]
-        env:
-          JAVA_HOME: /opt/jdk
         with:
-          project: "OpenCode"
-          path: "."
+          project: OpenCode
+          path: .
           format: ALL
+          args: --enableExperimental
 
       - name: Upload reports
         uses: actions/upload-artifact@v4
         with:
           name: owasp-depcheck-report
-          path: reports
+          path: reports/**