From bd83b61140149ecba7326ef8a289bb76bc0b7b20 Mon Sep 17 00:00:00 2001
From: Angel Eduardo Hincho Jove <82984150+ahincho@users.noreply.github.com>
Date: Sun, 12 Jul 2026 21:33:16 -0500
Subject: [PATCH] fix(ci): explicit OWASP data.directory + disable irrelevant
 analyzers

- data.directory now points at the shared, build-tool-agnostic path
  (~/.dependency-check-data) that reusable-owasp-check.yml caches and
  restores the centralized nova-devops NVD mirror into. The plugin's
  implicit default was never verified/documented; previous cache sizes
  (15-57MB) strongly suggest it did not match what was being cached.
- Disabled analyzers for ecosystems that plainly do not exist in this
  repo (assembly/nuspec/nugetconf/msbuild/.NET, golang, swift, cocoapods,
  composer/PHP, cpan/Perl, cmake/autoconf, bundleAudit/rubygems, python,
  dart, retirejs) - zero detection-feature cost since none of these file
  types are present. Node/nodeAudit analyzers are NOT disabled (package.json
  is real - commitlint/lefthook devDependencies).
- Verified property names against the actually-installed 12.2.2 Gradle
  plugin jar (javap on AnalyzerExtension.class) rather than assumed from
  docs - e.g. carthageAnalyzerEnabled does not exist in this version.

See docs/java/06-semantic-versioning-en-java.md for the investigation
into why OWASP scans were taking 30-50+ min.
---
 build.gradle.kts | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/build.gradle.kts b/build.gradle.kts
index 89bef03..6f1d25b 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -69,6 +69,49 @@ dependencyCheck {
     // and an empty NVD key (slower updates, acceptable for local dev).
     failBuildOnCVSS = (System.getenv("NOVA_OWASP_FAIL_ON_CVSS") ?: "11").toFloat()
     nvd.apiKey = System.getenv("NVD_API_KEY") ?: ""
+
+    // Must match the path reusable-owasp-check.yml caches AND restores the
+    // shared nova-devops NVD mirror into. Do NOT rely on the plugin's
+    // built-in default here - it was never verified/documented and previous
+    // cache sizes (15-57MB) strongly suggest it did not match what was
+    // being cached. Locally (no env var set) this falls back to a plain,
+    // dedicated directory outside ~/.gradle so it is never confused with
+    // unrelated Gradle caches.
+    data.directory = System.getenv("NOVA_OWASP_DATA_DIR")
+        ?: "${System.getProperty("user.home")}/.dependency-check-data"
+
+    // Investigation (2026-07-13, docs/java/06-semantic-versioning-en-java.md):
+    // a cold NVD sync took 50+ min mostly due to cache scoping, NOT these
+    // analyzers - but disabling ecosystems that plainly do not exist
+    // anywhere in this repo removes real (if smaller) analyze-phase
+    // overhead and network surface at zero detection-feature cost.
+    //
+    // Deliberately NOT disabled: nodeEnabled / nodeAudit.enabled
+    // (package.json IS present - commitlint/lefthook devDependencies -
+    // keep scanning it for real) and opensslEnabled (harmless/fast).
+    // RetireJS IS disabled: it fingerprints vendored/bundled JS *library*
+    // files - this repo has no such files, only commitlint.config.js.
+    analyzers {
+        retirejs.enabled = false
+        assemblyEnabled = false
+        nuspecEnabled = false
+        nugetconfEnabled = false
+        msbuildEnabled = false
+        golangDepEnabled = false
+        golangModEnabled = false
+        swiftEnabled = false
+        swiftPackageResolvedEnabled = false
+        cocoapodsEnabled = false
+        composerEnabled = false
+        cpanEnabled = false
+        cmakeEnabled = false
+        autoconfEnabled = false
+        bundleAuditEnabled = false
+        pyDistributionEnabled = false
+        pyPackageEnabled = false
+        rubygemsEnabled = false
+        dartEnabled = false
+    }
 }
 
 pitest {