diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml new file mode 100644 index 00000000..dd81d80c --- /dev/null +++ b/.github/workflows/main.yml @@ -0,0 +1,50 @@ + +name: bd-sig-action + +on: + push: + branches: [ main, master, develop, stage, release ] + pull_request: + branches: [ main, master, develop, stage, release ] + workflow_dispatch: +jobs: + build: + runs-on: [ ubuntu-latest ] + steps: + - name: Checkout Source + uses: actions/checkout@v3 + + - name: Black Duck Full Scan + if: ${{ github.event_name != 'pull_request' }} + uses: synopsys-sig/synopsys-action@v1.2.0 + ### Use below configuration to set specific detect environment variables + env: + DETECT_PROJECT_NAME: ${{ github.event.repository.name }} + with: + blackduck_url: ${{ secrets.BLACKDUCK_URL }} + blackduck_apiToken: ${{ secrets.BLACKDUCK_API_TOKEN }} + blackduck_scan_full: true + ### Accepts Multiple Values + blackduck_scan_failure_severities: 'BLOCKER,CRITICAL' + ### Uncomment below configuration to enable automatic fix pull request creation if vulnerabilities are reported + # blackduck_automation_fixpr: true + # github_token: ${{ secrets.GITHUB_TOKEN }} # Mandatory when blackduck_automation_fixpr is set to 'true' + ### Uncomment below configuration if Synopsys Bridge diagnostic files needs to be uploaded + # include_diagnostics: true + + - name: Black Duck PR Scan + if: ${{ github.event_name == 'pull_request' }} + uses: synopsys-sig/synopsys-action@v1.2.0 + ### Use below configuration to set specific detect environment variables + env: + DETECT_PROJECT_NAME: ${{ github.event.repository.name }} + with: + blackduck_url: ${{ secrets.BLACKDUCK_URL }} + blackduck_apiToken: ${{ secrets.BLACKDUCK_API_TOKEN }} + blackduck_scan_full: false + ### Below configuration is used to enable automatic pull request comment based on Black Duck scan result + blackduck_automation_prcomment: false + github_token: ${{ secrets.GITHUB_TOKEN }} # Mandatory when blackduck_automation_prcomment is set to 'true' + ### Uncomment below configuration if Synopsys Bridge diagnostic files needs to be uploaded + # include_diagnostics: true + bridge.break: false