dependency-check / dependency-check/azuredevops

Question regarding easy caching approach

Open
#142 15 comments 0 reactions 0 assignees View on GitHub
documentation enhancement question
Dominant language
TypeScript
Stars
53
Forks
35
PR merge metrics
No merged PRs in 30d

Description

Hi,

obviously loading the whole NVD database for every pipe run is a bad idea. So I thought how to improve it without requiring too much effort or even costs for hosting etc.

Then I came across the --data [CLI argument](https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html). Using that, we could easily use [Azure DevOps Cache task](https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/cache-v2?view=azure-pipelines) to cache/restore the data.

But I'm wondering if that is a valid approach, as the description for the argument says: "This option should generally not be set."
Also that approach is suggested nowhere.

Anyway, I started to implement it like this, but unfortunately I'm unable to test it currently due to [some issues](https://github.com/jeremylong/DependencyCheck/issues/6107) on NVD API side of things (HTTP 503).

Any idea if that should work or not at all or if there is any reason why it should not be done like this?

```yml
steps:
- task: Cache@2
displayName: ODC NVD Database Cache
inputs:
key: 'ODCNVD | "$(Agent.OS)"'
path: $(Pipeline.Workspace)/odc/data

- task: dependency-check-build-task@6
displayName: 'OWASP Dependency Check'
continueOnError: ${{ parameters.warningOnly }}
inputs:
projectName: ${{ parameters.projectName }}
scanPath: ${{ parameters.scanPath }}
format: ${{ parameters.format }}
enableVerbose: ${{ parameters.verbose }}
failOnCVSS: ${{ parameters.cvssThreshold }}
warnOnCVSSViolation: ${{ parameters.warningOnly }}
additionalArguments: --nvdApiKey --data $(Pipeline.Workspace)/odc/data ${{ parameters.additionalArguments }}
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the Azure DevOps Cache@2 task and the dependency-check-build-task@6 configuration shown in the issue, then verify whether --data can safely use the restored path. Done means documenting whether this cache setup is supported and identifying any required changes; testing is currently blocked by the linked NVD API 503 issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript, yaml
Domain
ci-cd, devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.