blackduck #36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: blackduck | |
| on: | |
| schedule: | |
| - cron: '0 3 * * *' | |
| workflow_dispatch: | |
| inputs: | |
| branch: | |
| description: 'Branch to scan (defaults to default branch).' | |
| required: false | |
| type: string | |
| permissions: {} | |
| env: | |
| BLACKDUCK_SKIP_PHONE_HOME: true | |
| jobs: | |
| blackduck-scan: | |
| name: blackduck scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Determine project version | |
| id: version | |
| env: | |
| INPUT_BRANCH: ${{ github.event.inputs.branch }} | |
| run: | | |
| if [ -n "$INPUT_BRANCH" ]; then | |
| VERSION="$INPUT_BRANCH" | |
| else | |
| VERSION="main" | |
| fi | |
| echo "Black Duck project version: $VERSION" | |
| echo "project_version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Checkout repository at project version | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ steps.version.outputs.project_version }} | |
| persist-credentials: false | |
| - name: Run Black Duck SCA scan | |
| uses: blackduck-inc/black-duck-security-scan@152247222aa9cd38124acd5c0cf60f4db71adc3f # v2.11.0 | |
| with: | |
| blackducksca_url: https://sap.blackducksoftware.com | |
| blackducksca_token: ${{ secrets.BLACKDUCK_API_TOKEN }} | |
| blackducksca_scan_full: true | |
| blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' | |
| blackducksca_reports_sarif_create: true | |
| blackducksca_reports_sarif_severities: 'BLOCKER,CRITICAL' | |
| blackducksca_reports_sarif_groupSCAIssues: true | |
| blackducksca_upload_sarif_report: true | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| detect_args: >- | |
| --detect.project.name="${{ vars.BLACKDUCK_PROJECT_NAME }}" | |
| --detect.project.version.name="${{ steps.version.outputs.project_version }}" | |
| --detect.project.user.groups="${{ vars.BLACKDUCK_PROJECT_GROUP }}" | |
| --detect.code.location.name="${{ vars.BLACKDUCK_PROJECT_NAME }}/${{ steps.version.outputs.project_version }}" | |
| --detect.blackduck.signature.scanner.memory=4096 | |
| --detect.timeout=6000 | |
| --detect.blackduck.signature.scanner.arguments="--min-scan-interval=0" | |
| --detect.excluded.directories='**/__pycache__,**/.venv,**/venv,**/env,**/dist,**/build,**/*.egg-info,**/test,**/tests,**/coverage' |