See existing card #431.
These two cards should be merged?
Tasks
[x] Add OWASP_NVD_API_KEY secret to the GitHub builds to speed up DepedencyCheck CVE updates.
[ ] Review the GH action logs for each containerized build: look for places that the build re-downloads the same thing each build. Update this card based on your findings.
[ ] Use GH action caches for DependencyCheck CVE data (esp. improves Gradle build times).
[ ] Update the YAML files for GH workflows to implement more caching as is sensible <-- This is the bulk of the work
[ ] Discuss caching in relevant pages.
[ ] Confirm build finishes in less that 30s - local
See existing card #431. These two cards should be merged?
Tasks
OWASP_NVD_API_KEY
secret to the GitHub builds to speed up DepedencyCheck CVE updates.References:
Include research on how to share the cache across projects.
Relates to #460, #431, #487.
Examples
When building for Gradle, I see that CI is pulling down the Gradle 8.8 distro. This is something we can cache:
This only happens for the containerized build, not the "direct" build. Why?