{"id":20434488,"url":"https://github.com/debricked/example-source-codeless-scan-maven","last_synced_at":"2026-04-19T01:37:55.134Z","repository":{"id":46696976,"uuid":"277814045","full_name":"debricked/example-source-codeless-scan-maven","owner":"debricked","description":"An example showcasing the Source-codeless Scan feature for a Maven project ","archived":false,"fork":false,"pushed_at":"2023-04-07T06:43:24.000Z","size":72,"stargazers_count":0,"open_issues_count":0,"forks_count":3,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-03-05T06:32:16.390Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/debricked.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-07-07T12:45:35.000Z","updated_at":"2021-09-30T11:30:22.000Z","dependencies_parsed_at":"2025-01-15T18:20:22.558Z","dependency_job_id":"b876dc47-fe50-49a1-8e9f-07f4f53602bf","html_url":"https://github.com/debricked/example-source-codeless-scan-maven","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/debricked/example-source-codeless-scan-maven","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/debricked%2Fexample-source-codeless-scan-maven","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/debricked%2Fexample-source-codeless-scan-maven/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/debricked%2Fexample-source-codeless-scan-maven/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/debricked%2Fexample-source-codeless-scan-maven/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/debricked","download_url":"https://codeload.github.com/debricked/example-source-codeless-scan-maven/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/debricked%2Fexample-source-codeless-scan-maven/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31991720,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-18T20:23:30.271Z","status":"ssl_error","status_checked_at":"2026-04-18T20:23:29.375Z","response_time":103,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-15T08:27:10.926Z","updated_at":"2026-04-19T01:37:55.113Z","avatar_url":"https://github.com/debricked.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Source-codeless Scan for Maven, with Debricked Github Action\n\nThis example shows how you can use the Debricked Github Action to scan the dependencies of your Maven repository, without uploading the source code to Debricked.\nThis is called a _Source-codeless Scan_, and is available for Gradle and Maven.\nNote that most other languages, such as JavaScript and Python, are already sourcecode-less by default, and you don't need to take any further action.\n\nTo do this for Maven, two steps need to be performed.\n\n1. You need to generate a list of dependencies as a part of your own pipeline.\n2. Add caching for the list generation to make the action snappy.\n3. These lists must be uploaded to Debricked.\n\nThis repository shows how this can be done for a simple Maven project.\n\n## Steps\n\nHere is a description of the two steps above in more details.\n\nIf you want to look at the final version of a working file, look in the [.github/workflows/vulnerabilities.yml](.github/workflows/vulnerabilities.yml) workflow file in this repository.\nThe different parts of it are described below.\n\n### Generate a list of dependencies\n\nThis can be done by running Maven `dependency:tree` plugin, and storing the output in a file.\n\nThe output filename is important, the Debricked integration will look for these files in the next step.\nThe output file _must_ be placed in the same directory as the `pom.xml` file it belongs to, otherwise Debricked cannot connect them together.\n\nIn [.github/workflows/vulnerabilities.yml](.github/workflows/vulnerabilities.yml), this is the first part of the workflow, i.e., the following step:\n\n```\n    - run: |\n        mvn dependency:tree \\\n            -DoutputFile=.debricked-maven-dependencies.tgf \\\n            -DoutputType=tgf\n```\n\nIf you haven't already, you also need to choose which Java version to use beforehand, like below:\n\n```\n    - uses: actions/setup-java@v1\n      with:\n        java-version: '13'\n    - run: |\n        mvn dependency:tree \\\n            -DoutputFile=.debricked-maven-dependencies.tgf \\\n            -DoutputType=tgf\n```\n\n### Add caching\nTo enable caching we use GitHub`s own [cache action](https://github.com/actions/cache).\n\nExample of caching:\n```\n- uses: actions/cache@v2\n      with:\n        path: ~/.m2/repository\n        key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}\n        restore-keys: |\n          ${{ runner.os }}-maven-\n```\n\n### Upload dependency files to Debricked\n\nThis is done with the usual Github Action, described in https://github.com/debricked/actions.\nAs long as your files are named correctly (`.debricked-maven-dependencies.json` for Maven), the action will automatically detect that you have generated the dependency file yourself.\nThis means you should *not* enable the `UPLOAD_ALL_FILES` option.\n\nExample of this step:\n\n```\n    - uses: debricked/actions/scan@v1\n      env:\n        DEBRICKED_TOKEN: ${{ secrets.DEBRICKED_TOKEN }}\n```\n\n## License\n\nThe Maven example is based on the code from this tutorial https://github.com/spring-guides/gs-maven, which is licensed under the Apache License, Version 2.0.\n\nModifications performed by Debricked, as well as other files are also covered under the Apache License, Version 2.0.\n\nSee the file LICENSE in this repository.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdebricked%2Fexample-source-codeless-scan-maven","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdebricked%2Fexample-source-codeless-scan-maven","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdebricked%2Fexample-source-codeless-scan-maven/lists"}