# PR#61: Each Pull Request Is Checked for Vulnerable Dependencies

> **WARNING:** This document describes only the change applied in this PR.
> It may already be outdated once the next PR is merged.
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

## Related Links

- [PR#59](https://git.javagil.de/mi/werkregie/pulls/59), which brought OWASP Dependency-Check, for main only.

## Problem

Since PR#59, Werkator's build `dependencies` checks main for known vulnerabilities.
A pull request is not checked, so a vulnerable dependency shows only after its merge.
The check also loads the NVD data itself, at most once a day:
the first build of a day waits for the update, which takes minutes.

## Non-Goals

- No required check of `main` in Gitea's branch protection; the human sets it.
- No mutation tests.

## Specification

### Feature: each pull request is checked for vulnerable dependencies

#### Scenario#61.01: a pull request with a vulnerable dependency shows a red check

… so that a vulnerable dependency does not reach main.

- **Given** a pull request that adds a dependency with a known vulnerability of CVSS 4 or more
- **When** Werkator builds the pull request
- **Then** its check `werkator/dependencies` is red and names the vulnerability

##### Verified by

- Werkator's build `dependencies` of this pull request, green, under `werkator/dependencies`.

#### Scenario#61.02: the check does not wait for the vulnerability data

… so that a pull request is checked in seconds, also the first one of a day.

- **Given** the vulnerability data of the night before
- **When** Werkator builds a pull request
- **Then** the check reads the data without updating it

##### Verified by

- Werkator's build `dependencies` of this pull request: no update in its log.

## Solution

- `.werkator.yml`:
  - the build `dependencies` runs for each branch, no longer for main only;
    since PR#59, main sets its status context `werkator/dependencies`, so a branch no longer overwrites `werkator`;
  - its trigger names `branches: ["*"]`: Werkator merges a branch's trigger key by key into main's,
    so a trigger without `branches` kept main's `["main"]`, and the first push of this PR ran no check;
  - a new build `vulnerability-data` runs `dependencyCheckUpdate` each night at 02:00 UTC on main,
    under `werkator/vulnerability-data`, with the host's longest timeout.
- `dashboard/build.gradle.kts`: `autoUpdate = false`, so `dependencyCheckAnalyze` only reads the data.
  Werkator's direct builds share the Gradle home of the user `mih09-werkator`, which holds the data.
- `AGENTS.md`: locally, `./gradlew dependencyCheckUpdate` loads the data before the first check.
- Version 0.38.1.

## Open Questions

- [x] When does the slow update of the vulnerability data run?
  At night, in a build of its own, chosen by the human; every check only reads the data.