Please provide a "owasp/dependency-check-daily" docker image with full database

Is your feature request related to a problem? Please describe.

Currently, all my Java projects run Dependency-Check as Gradle plugin and maintain their own local CVE database in the build cache folder. If that folder gets deleted, e.g. because the build fails for some reason it has to rebuild which takes long. It also takes a lot of disk space which sometimes leads to failing builds as well.

Describe the solution you’d like

It would be more convenient if I could just run a “owasp/dependency-check-daily:latest” Docker image that scans the project source with an already included CVE database that is max one day old without having to download and parse every CVE myself. And also without having to add yet another plugin to my build scripts.

A daily build of that Docker image with the latest CVE data is probably ok for most people.

Describe alternatives you’ve considered A clear and concise description of any alternative solutions or features you’ve considered.

Additional context

There is a Docker image https://hub.docker.com/r/daniiiol/dependency-check-prepared which claims to be based on your image and has just added RUN /usr/share/dependency-check/bin/dependency-check.sh --project WarmUp --out /report/ --scan ..

That already sounds like the perfect solution but I’m probably not the only one who’s not comfortable with scanning my source code by some random guys docker image so I’d prefer if the image would be provided by OWASP or at least the author of the scanner.

[jeremylong]

The following would copy the current data from the docker image.

id=$(docker create owasp/dependency-check-action:latest)       
docker cp $id:/usr/share/dependency-check/data ./data    
docker rm -v $id

[rjacobs91]

That was my intention yes. Or copy to another build image for pipelines

Would be good to know what command to use to do this though