hello-java/.github/workflows/bd-snps-action-split.yml at main · evansa-synopsys/hello-java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
# example workflow for Black Duck scans using the Synopsys Action
# https://github.com/marketplace/actions/synopsys-action
name: bd-snps-action-split
on:
  push:
    branches: [ main, master, develop, stage, release ]
  pull_request:
    branches: [ main, master, develop, stage, release ]
  workflow_dispatch:
jobs:
  blackduck:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Source
      uses: actions/checkout@v4
    - name: Setup Java JDK
      uses: actions/setup-java@v4
      with:
        java-version: 17
        distribution: microsoft
        cache: maven
    - name: Maven Build
      run: mvn -B -DskipTests package
    - name: Black Duck Full Scan
      if: ${{ github.event_name != 'pull_request' }}
      uses: synopsys-sig/synopsys-action@v1.11.0
      env:
        DETECT_PROJECT_NAME: ${{ github.event.repository.name }}
        DETECT_PROJECT_VERSION_NAME: ${{ github.ref_name }}
        DETECT_CODE_LOCATION_NAME: ${{ github.event.repository.name }}-${{ github.ref_name }}
      with:
        blackduck_url: ${{ vars.BLACKDUCK_URL }}
        blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
        blackduck_scan_full: true
        blackduck_scan_failure_severities: 'BLOCKER'
        blackduck_fixpr_enabled: true
        blackduck_reports_sarif_create: true
        blackduck_upload_sarif_report: true
        github_token: ${{ secrets.GITHUB_TOKEN }}
    - name: Black Duck PR Scan
      if: ${{ github.event_name == 'pull_request' }}
      uses: synopsys-sig/synopsys-action@v1.11.0
      env:
        DETECT_PROJECT_NAME: ${{ github.event.repository.name }}
        DETECT_PROJECT_VERSION_NAME: ${{ github.base_ref }}
        DETECT_CODE_LOCATION_NAME: ${{ github.event.repository.name }}-${{ github.base_ref }}
      with:
        blackduck_url: ${{ vars.BLACKDUCK_URL }}
        blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
        blackduck_scan_full: false
        blackduck_prComment_enabled: true
        github_token: ${{ secrets.GITHUB_TOKEN }}
#    - name: Save Logs
#      if: always()
#      uses: actions/upload-artifact@v4
#      with:
#        name: bridge-logs
#        path: ${{ github.workspace }}/.bridge