Move OWASP Dependency Check to a standalone scheduled workflow

.github/workflows/ci-pr.yml

@@ -107,35 +107,6 @@ jobs:
       - name: Run Checkstyle analysis
         run: mvn -B checkstyle:check -Pqa -Ddependency-check.skip=true
 
-  dependency-check:
-    name: OWASP Dependency Check
-    runs-on: ubuntu-latest
-    needs: build
-    env:
-      NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@v5
-        with:
-          java-version: '21'
-          distribution: 'temurin'
-          cache: 'maven'
-
-      - name: Cache Dependency-Check DB
-        uses: actions/cache@v5
-        with:
-          path: ~/.m2/repository/org/owasp/dependency-check-data
-          key: depcheck-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
-          restore-keys: |
-            depcheck-${{ runner.os }}-
-
-      - name: Run OWASP Dependency Check
-        run: mvn -B dependency-check:aggregate -Pqa
-
   reports:
     name: Test Reports
     runs-on: ubuntu-latest

.github/workflows/owasp-dependency-check.yml

@@ -0,0 +1,48 @@
+name: OWASP Dependency Check
+
+on:
+  schedule:
+    # Runs every Sunday at 3:00 AM UTC
+    - cron: '0 3 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  dependency-check:
+    name: OWASP Dependency Check
+    runs-on: ubuntu-latest
+    env:
+      NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v5
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+          cache: 'maven'
+
+      - name: Cache Dependency-Check DB
+        uses: actions/cache@v5
+        with:
+          path: ~/.m2/repository/org/owasp/dependency-check-data
+          key: depcheck-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            depcheck-${{ runner.os }}-
+
+      - name: Run OWASP Dependency Check
+        run: mvn -B dependency-check:aggregate -Pqa
+
+      - name: Upload Dependency Check Report
+        uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: dependency-check-report
+          path: target/dependency-check-report.html
+          retention-days: 30