ci(security): add dependency-check scan job

    paths:

      - trivy-fs-junit.xml

dependency-vuln-scan:

  image: owasp/dependency-check:latest

  stage: code-quality

  <<: *build_rules

  needs: []

  variables:

    DEPENDENCY_CHECK_DATA: ".dependency-check-data"

  script:

    - mkdir -p dependency-check-report

    - |

      if [ -n "$NVD_API_KEY" ]; then

        dependency-check.sh --scan . --project "$CI_PROJECT_PATH_SLUG" --data "$DEPENDENCY_CHECK_DATA" --format "JSON" --format "HTML" --format "JUNIT" --out dependency-check-report --nvdApiKey "$NVD_API_KEY" --failOnCVSS 7 --junitFailOnCVSS 7

      else

        dependency-check.sh --scan . --project "$CI_PROJECT_PATH_SLUG" --data "$DEPENDENCY_CHECK_DATA" --format "JSON" --format "HTML" --format "JUNIT" --out dependency-check-report --failOnCVSS 7 --junitFailOnCVSS 7

      fi

  artifacts:

    when: always

    reports:

      junit:

        - dependency-check-report/*junit*.xml

        - dependency-check-report/*JUNIT*.xml

    paths:

      - dependency-check-report/

generate-apks:

  stage: build

  <<: *rules_publish