Merge pull request #749 from aws/scan-published-artifacts

fix(daily-scan): scan published artifacts instead of repo source

Author: thpierce

.github/workflows/daily-scan.yml

@@ -33,8 +33,11 @@ jobs:
         with:
           node-version: '18'
 
-      - name: Build Node.js project for scanning
-        run: npm install
+      - name: Install published package for scanning
+        run: |
+          mkdir -p scan-target && cd scan-target
+          npm init -y
+          npm install aws-xray-sdk
 
       - name: Install Java for dependency scan
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 #v5.0.0
@@ -68,7 +71,7 @@ jobs:
           curl -Ls "https://github.com/dependency-check/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip.asc" --output dependency-check.zip.asc
           gpg --verify dependency-check.zip.asc
           unzip dependency-check.zip
-          ./dependency-check/bin/dependency-check.sh --failOnCVSS 0 --nvdApiKey ${{ env.NVD_API_KEY_NVD_API_KEY }} --ossIndexUsername ${{ env.OSS_INDEX_USERNAME }} --ossIndexPassword ${{ env.OSS_INDEX_PASSWORD }} -s "."
+          ./dependency-check/bin/dependency-check.sh --failOnCVSS 0 --nvdApiKey ${{ env.NVD_API_KEY_NVD_API_KEY }} --ossIndexUsername ${{ env.OSS_INDEX_USERNAME }} --ossIndexPassword ${{ env.OSS_INDEX_PASSWORD }} -s "scan-target/"
 
       - name: Print dependency scan results on failure
         if: ${{ steps.dep_scan.outcome != 'success' }}