Move OWASP Dependency Check to a standalone scheduled workflow

.github/workflows/ci-pr.yml

@@ -20,12 +20,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
       - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ matrix.java }}
           distribution: 'temurin'
@@ -36,7 +36,7 @@ jobs:
 
       # Upload XMLs ONLY once (Java 21) so the report doesn't double-count
       - name: Upload unit test XMLs (Java 21 only)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always() && matrix.java == '21'
         with:
           name: unit-xml
@@ -56,12 +56,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
       - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ matrix.java }}
           distribution: 'temurin'
@@ -72,7 +72,7 @@ jobs:
 
       # Upload XMLs ONLY once (Java 21) so the report doesn't double-count
       - name: Upload IT test XMLs (Java 21 only)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always() && matrix.java == '21'
         with:
           name: it-xml
@@ -87,12 +87,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: '21'
           distribution: 'temurin'
@@ -107,35 +107,6 @@ jobs:
       - name: Run Checkstyle analysis
         run: mvn -B checkstyle:check -Pqa -Ddependency-check.skip=true
 
-  dependency-check:
-    name: OWASP Dependency Check
-    runs-on: ubuntu-latest
-    needs: build
-    env:
-      NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@v4
-        with:
-          java-version: '21'
-          distribution: 'temurin'
-          cache: 'maven'
-
-      - name: Cache Dependency-Check DB
-        uses: actions/cache@v4
-        with:
-          path: ~/.m2/repository/org/owasp/dependency-check-data
-          key: depcheck-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
-          restore-keys: |
-            depcheck-${{ runner.os }}-
-
-      - name: Run OWASP Dependency Check
-        run: mvn -B dependency-check:aggregate -Pqa
-
   reports:
     name: Test Reports
     runs-on: ubuntu-latest
@@ -149,26 +120,26 @@ jobs:
 
     steps:
       - name: Download unit XMLs (Java 21 only)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: unit-xml
           path: reports/unit
 
       - name: Download IT XMLs (Java 21 only)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: it-xml
           path: reports/it
 
       - name: Publish Unit Test Report
-        uses: mikepenz/action-junit-report@v4
+        uses: mikepenz/action-junit-report@v6
         if: always()
         with:
           report_paths: 'reports/unit/**/TEST-*.xml'
           check_name: Unit Test Report
 
       - name: Publish IT Test Report
-        uses: mikepenz/action-junit-report@v4
+        uses: mikepenz/action-junit-report@v6
         if: always()
         with:
           report_paths: 'reports/it/**/TEST-*.xml'

.github/workflows/ci-push.yml

@@ -19,12 +19,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
       - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ matrix.java }}
           distribution: 'temurin'
@@ -34,7 +34,7 @@ jobs:
         run: mvn -B clean verify -Pqa -Ddependency-check.skip=true
 
       - name: Upload unit test XMLs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: unit-xml-java-${{ matrix.java }}
@@ -55,14 +55,14 @@ jobs:
 
     steps:
       - name: Download unit XMLs (all Java versions)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           pattern: unit-xml-java-*
           merge-multiple: true
           path: reports/unit
 
       - name: Publish Unit Test Report
-        uses: mikepenz/action-junit-report@v4
+        uses: mikepenz/action-junit-report@v6
         if: always()
         with:
           report_paths: 'reports/unit/**/TEST-*.xml'

.github/workflows/codeql.yml

@@ -20,19 +20,19 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: '21'
           distribution: 'temurin'
           cache: 'maven'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: java-kotlin
           build-mode: manual
@@ -42,6 +42,6 @@ jobs:
         run: mvn -B clean compile -DskipTests
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:java-kotlin"

.github/workflows/dependabot-retarget-to-develop.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Change base branch to develop
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const pr = context.payload.pull_request;

.github/workflows/dependency-review.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 

.github/workflows/owasp-dependency-check.yml

@@ -0,0 +1,48 @@
+name: OWASP Dependency Check
+
+on:
+  schedule:
+    # Runs every Sunday at 3:00 AM UTC
+    - cron: '0 3 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  dependency-check:
+    name: OWASP Dependency Check
+    runs-on: ubuntu-latest
+    env:
+      NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v5
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+          cache: 'maven'
+
+      - name: Cache Dependency-Check DB
+        uses: actions/cache@v5
+        with:
+          path: ~/.m2/repository/org/owasp/dependency-check-data
+          key: depcheck-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            depcheck-${{ runner.os }}-
+
+      - name: Run OWASP Dependency Check
+        run: mvn -B dependency-check:aggregate -Pqa
+
+      - name: Upload Dependency Check Report
+        uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: dependency-check-report
+          path: target/dependency-check-report.html
+          retention-days: 30

.github/workflows/release.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -65,7 +65,7 @@ jobs:
           fi
 
       - name: Set up JDK ${{ env.JAVA_VERSION }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ env.JAVA_VERSION }}
           distribution: 'temurin'
@@ -85,10 +85,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ matrix.java }}
           distribution: 'temurin'
@@ -105,10 +105,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up JDK ${{ env.JAVA_VERSION }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         env:
           CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
           CENTRAL_TOKEN: ${{ secrets.CENTRAL_TOKEN }}
@@ -137,10 +137,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up JDK ${{ env.JAVA_VERSION }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ env.JAVA_VERSION }}
           distribution: 'temurin'
@@ -150,7 +150,7 @@ jobs:
         run: mvn -B cyclonedx:makeAggregateBom -Pqa
 
       - name: Upload SBOM artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: sbom
           path: target/bom.*
@@ -168,10 +168,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Download SBOM
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: sbom
           path: sbom/

.gitignore

@@ -50,3 +50,6 @@ bin/
 # Claude Code
 /.claude/
 /CLAUDE.md
+
+# GitHub
+current-ticket.md

aether-datafixers-api/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>de.splatgames.aether.datafixers</groupId>
         <artifactId>aether-datafixers</artifactId>
-        <version>0.5.0</version>
+        <version>1.0.0-SNAPSHOT</version>
     </parent>
 
     <artifactId>aether-datafixers-api</artifactId>