Skip to content

Latest commit

 

History

History
27 lines (22 loc) · 1.01 KB

check-vulnerabilities.md

File metadata and controls

27 lines (22 loc) · 1.01 KB

How to check vulnerabilities in the API

There are two dependency analysis tools used in the API: Trivy and Dependency-Check-Gradle.

These are automatically run on the main branch in CircleCI once every weekday, at 05:11. However, these can also be run locally or manually triggered on any branch in CircleCI.

Check locally

To run a Trivy scan locally, run:

script/trivy_scan

To run the Gradle dependency check locally, run:

./gradlew dependencyCheckAnalyze

Triggered check on CircleCI

To trigger a check on CircleCI:

  • Select your branch on the dropdown on the CircleCI dashboard.
  • Press the Trigger Pipeline button.
  • Expand the Add Parameters (optional) section.
  • Set the parameter type to boolean, the name to run-security-workflow-on-branch, and the value to true.
  • Press the Trigger Pipeline button.