Skip to content

ci: add dependency vulnerability scans - #162

Open
Busiii-adetiba wants to merge 1 commit into
ethos-protocol:mainfrom
Busiii-adetiba:feature/125-dependency-vulnerability-scanning
Open

ci: add dependency vulnerability scans#162
Busiii-adetiba wants to merge 1 commit into
ethos-protocol:mainfrom
Busiii-adetiba:feature/125-dependency-vulnerability-scanning

Conversation

@Busiii-adetiba

@Busiii-adetiba Busiii-adetiba commented Jul 30, 2026

Copy link
Copy Markdown

Summary:

  • Add OWASP Dependency-Check Gradle scanning for Android dependencies with a high-severity failure threshold.
  • Add SwiftPM dependency graph output and dependency review blocking for newly introduced high-severity vulnerabilities in iOS CI.

Closes #125

Validation performed:

  • Parsed android-ci.yml and ios-ci.yml as YAML.
  • Ran git diff --check.
  • Attempted ./gradlew dependencyCheckAnalyze --dry-run; blocked locally because this container only has Java 25.0.2, while CI pins JDK 17.

@drips-wave

drips-wave Bot commented Jul 30, 2026

Copy link
Copy Markdown

@Busiii-adetiba Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add Automated Dependency Vulnerability Scanning to CI

1 participant