bd+coverity+srm.yml

# example workflow for standalone Black Duck, Coverity and SRM using GitHub Actions
# - Black Duck and Coverity full scans on push to specified branches with import into SRM
# - Black Duck Rapid and Coverity Comparison scans on pull requests with PR comments enabled
# https://github.com/marketplace/actions/black-duck-security-scan
# https://github.com/marketplace/actions/srm-analysis
name: bd+coverity+srm
on:
  push:
    branches: [ main, master, develop, stage, release ]
  pull_request:
    branches: [ main, master, develop, stage, release ]
  workflow_dispatch:
jobs:
  blackduck:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Source
      uses: actions/checkout@v4
    - name: Setup Java JDK
      uses: actions/setup-java@v4
      with:
        java-version: 17
        distribution: microsoft
        cache: maven
    - name: Maven Build
      run: mvn -B -DskipTests package
    - name: Black Duck SCA Scan
      uses: blackduck-inc/black-duck-security-scan@v2.0.0
      env:
        DETECT_PROJECT_NAME: ${{ github.event.repository.name }}
      with:
        blackducksca_url: ${{ vars.BLACKDUCK_URL }}
        blackducksca_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
        # blackducksca_scan_failure_severities: 'BLOCKER'
        blackducksca_fixpr_enabled: true
        blackducksca_prComment_enabled: true
        blackducksca_reports_sarif_create: true
        blackducksca_upload_sarif_report: true
        github_token: ${{ secrets.GITHUB_TOKEN }}
        # include_diagnostics: true
    - name: Coverity SAST Scan
      uses: blackduck-inc/black-duck-security-scan@v2.0.0
      with:
        coverity_url: ${{ vars.COVERITY_URL }}
        coverity_user: ${{ secrets.COV_USER }}
        coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
        # coverity_policy_view: ${{ github.event_name != 'pull_request' && 'Outstanding Issues' || '' }}
        coverity_prComment_enabled: true
        github_token: ${{ secrets.GITHUB_TOKEN }}
        # include_diagnostics: true
    - name: SRM Import
      if: ${{ github.event_name != 'pull_request' }}
      uses: codedx/codedx-github-action@v1.3.0
      with:
        server-url: ${{ vars.SRM_URL }}/codedx
        api-key: ${{ secrets.SRM_APIKEY }}
        auto-create-project: true
        project-name: ${{ github.event.repository.name }}
        base-branch-name: ${{ github.event.repository.default_branch }}
        target-branch-name: ${{ github.ref_name }}
        source-and-binaries-glob: './**'
        wait-for-completion: true
#    - name: Save Logs
#      if: always()
#      uses: actions/upload-artifact@v4
#      with:
#        name: bridge-logs
#        path: ${{ github.workspace }}/.bridge
#        include-hidden-files: true