ci: enable incremental dependency-check updates

[FrankChen021]

Description

• stop purging the OWASP Dependency-Check database before every scan
• restore and save the database through a dedicated GitHub Actions cache
• use a stable data directory and a 24-hour NVD freshness window
• add a manual workflow trigger for validation

Testing

• git diff --check
• YAML parse validation
• Dependency-Check 12.2.0 parameter validation
• Cron Job ITs workflow run to be triggered after PR creation

The first run is expected to initialize the cache; a subsequent run will verify that the cached database is restored and only incremental NVD updates are downloaded.

[FrankChen021]

Dependency-Check cache validation for commit 32629a3:

• Initial PR run 32743390989: the cache was initially absent, Dependency-Check downloaded the full NVD set (382,070 records), and the workflow saved the cache with key dependency-check-data-Linux-odc-12.2.2-32743390989.
• Follow-up run 32756643364: the restore step reported "Cache not found" for the odc-12.2.2 keys, so it downloaded the full NVD set again (382,161 records). It later logged "Skipping the NVD API Update as it was completed within the last 240 minutes."

Conclusion: this follow-up did not demonstrate an Actions cache hit or incremental NVD update. The version-scoped key is present, but the cache saved by the pull_request run was not visible to this workflow_dispatch run, likely because of GitHub Actions cache scope by event/ref. Both runs failed on CVSS >= 7 findings after the scan; neither showed the previous URL-length database-schema error.

[FrankChen021]

Severity	Findings
P0	0
P1	1
P2	0
P3	0
Total	1

The review found one P1 workflow correctness issue: the refreshed dependency-check cache is not saved when the preceding vulnerability scan fails.

Reviewed 2 of 2 changed files.

---

This is an automated review by Codex GPT-5.6-Luna(max)

[FrankChen021]

[P1] Updated cache is skipped when the scan fails

Because this condition has no status function, GitHub Actions implicitly requires success(). The preceding security scan intentionally fails when vulnerabilities are found, so this save step is skipped even when dependency-check-update succeeded. The workflow therefore cannot persist the refreshed database on the observed failure path and will repeatedly download the full NVD dataset. Include an explicit always() or equivalent status condition while retaining the update-success and non-PR checks.

[FrankChen021]

Severity	Findings
P0	0
P1	1
P2	0
P3	0
Total	1

The previous cache-persistence finding remains unresolved: the save step is still skipped when the vulnerability scan fails.

Reviewed 1 of 3 changed files with findings; all 3 changed files were reviewed.

Validation: focused git diff --check and XML parsing passed. Builds and tests were not run.

---

This is an automated review by Codex GPT-5.6-Luna(max)

[FrankChen021]

[P1] Updated cache is skipped after scan failures

GitHub Actions implicitly applies success() to this condition, so actions/cache/save is skipped whenever the vulnerability scan fails. That prevents the refreshed Dependency-Check data from being persisted precisely when a failed scan should still leave the cache updated. Use an always()-based condition while retaining the update-success guard and event restriction.