blackduck.yml

name: blackduck
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  issues: write
  checks: write
  pull-requests: write

jobs:
  build:
    runs-on: [ubuntu-latest]
    steps:
      - name: Checkout Source
        uses: actions/checkout@v3
      - name: Black Duck Full Scan
        if: ${{ github.event_name != 'pull_request' }}
        uses: synopsys-sig/synopsys-action@v1.6.0
        env:
          DETECT_PROJECT_NAME: "MED_ca-injector"
        with:
          blackduck_url: ${{ secrets.BLACKDUCK_URL }}
          blackduck_token: ${{ secrets.BLACKDUCK_TOKEN }}
          blackduck_scan_full: true
          blackduck_scan_failure_severities: "BLOCKER,CRITICAL"
          blackduck_fixpr_enabled: true
          blackduck_fixpr_maxCount: 5
          blackduck_fixpr_filter_severities: "CRITICAL,HIGH"
          blackduck_fixpr_useUpgradeGuidance: "SHORT_TERM,LONG_TERM"
          github_token: ${{ secrets.GITHUB_TOKEN }}

      - name: Black Duck PR Scan
        if: ${{ github.event_name == 'pull_request' }}
        uses: synopsys-sig/synopsys-action@v1.6.0
        env:
          DETECT_PROJECT_NAME: "MED_ca-injector"
        with:
          blackduck_url: ${{ secrets.BLACKDUCK_URL }}
          blackduck_token: ${{ secrets.BLACKDUCK_TOKEN }}
          blackduck_scan_full: false
          blackduck_prComment_enabled: true
          github_token: ${{ secrets.GITHUB_TOKEN }}