ci(publish-maven): cache OWASP NVD data + raise timeout (#89)

Author: jourlez

.github/workflows/_publish-maven.yml

@@ -44,7 +44,7 @@ jobs:
   publish:
     name: Audit · Sign · Upload · Attest · Await approval
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 90
     environment: maven-central-release
     permissions:
       contents: read
@@ -94,6 +94,28 @@ jobs:
             -DnewVersion="${RELEASE_VERSION}" \
             -DgenerateBackupPoms=false
 
+      - name: Compute weekly cache key for OWASP NVD data
+        if: ${{ inputs.run-audit-profile }}
+        id: nvd-cache-week
+        run: echo "week=$(/bin/date -u +%GW%V)" >> "$GITHUB_OUTPUT"
+
+      # The OWASP dependency-check-maven plugin persists its synced NVD CVE
+      # database under ~/.m2/repository/org/owasp/dependency-check-data. NIST's
+      # NVD API can throttle a cold full sync (~364k+ records) to the point
+      # where it blows past the job timeout; restoring last week's DB here
+      # means subsequent runs only fetch the incremental delta instead of
+      # resyncing from scratch. Keyed weekly (not on pom.xml) since the NVD
+      # data changes independently of our dependencies; restore-keys fall back
+      # to the newest available cache of any week if this week has none yet.
+      - name: Restore cached OWASP dependency-check NVD data
+        if: ${{ inputs.run-audit-profile }}
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        with:
+          path: ~/.m2/repository/org/owasp/dependency-check-data
+          key: owasp-dependency-check-nvd-${{ steps.nvd-cache-week.outputs.week }}
+          restore-keys: |
+            owasp-dependency-check-nvd-
+
       - name: Full audit gate before release
         if: ${{ inputs.run-audit-profile }}
         env:
@@ -106,6 +128,16 @@ jobs:
             ./mvnw --batch-mode verify -P audit -Ddependency-check.skip=true
           fi
 
+      # Save unconditionally (even on audit failure) so a partially-synced NVD
+      # DB from a throttled run still speeds up the next attempt; actions/cache
+      # skips the save if this exact key was already restored as an exact hit.
+      - name: Save cached OWASP dependency-check NVD data
+        if: ${{ inputs.run-audit-profile && !cancelled() }}
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        with:
+          path: ~/.m2/repository/org/owasp/dependency-check-data
+          key: owasp-dependency-check-nvd-${{ steps.nvd-cache-week.outputs.week }}
+
       - name: Build + verify
         if: ${{ !inputs.run-audit-profile }}
         run: ./mvnw --batch-mode --no-transfer-progress verify -Dgpg.skip=true