lukaszlenart opened a new pull request, #1807: URL: https://github.com/apache/struts/pull/1807
## Problem The **OWASP checkup** workflow has been failing intermittently with no reason other than timeouts (as seen in #1667). The root cause is external: the NIST NVD feed has become unreliable (see [dependency-check#8633](https://github.com/dependency-check/DependencyCheck/issues/8633)) — keyless NVD downloads are heavily rate-limited and stall, and NIST has churned API keys. Two things made this worse in our config: 1. The job had **no timeout**, so a hung NVD download dragged on toward the 6-hour GitHub Actions default before the run was marked failed. 2. The `OWASP check` step ran `-Pdependency-check -Pjakartaee11` but carried **neither** the mirror datafeed URL **nor** the NVD API key (unlike the update-only step). So on any cache staleness/miss, the aggregate check synced **directly against NIST** — the unreliable path. ## Changes - **`timeout-minutes: 30`** on the `owasp` job so a stuck download fails fast. - **`-DautoUpdate=false`** on the check step so it reads only the NVD cache populated by the preceding `update-only` step, and never phones NIST directly. ## Notes - The mirror/API split in the `update-only` step (the core of #1667) is unchanged — with `autoUpdate=false` the check step doesn't need a data source. - Not addressed here (happy to follow up): the cache key uses `${{ github.run_id }}`, which is unique per run, so the primary key never hits and every run relies on the `restore-keys` prefix fallback. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
