forked from chuckaude/hello-java
-
Notifications
You must be signed in to change notification settings - Fork 0
89 lines (89 loc) · 3.72 KB
/
bd+coverity+srm.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# example workflow for standalone Black Duck, Coverity and SRM (Code DX) using GitHub Actions
# - Black Duck and Coverity full scans on push to specified branches with import into SRM
# - Black Duck Rapid and Coverity Comparison scans on pull requests with PR comments enabled
# https://github.com/marketplace/actions/synopsys-action
# https://github.com/marketplace/actions/srm-analysis
name: bd+coverity+srm
on:
push:
branches: [ main, master, develop, stage, release ]
pull_request:
branches: [ main, master, develop, stage, release ]
workflow_dispatch:
jobs:
synopsys:
runs-on: ubuntu-latest
steps:
- name: Checkout Source
uses: actions/checkout@v4
- name: Setup Java JDK
uses: actions/setup-java@v4
with:
java-version: 17
distribution: microsoft
cache: maven
- name: Maven Build
run: mvn -B -DskipTests package
- name: Black Duck Full Scan
if: ${{ github.event_name != 'pull_request' }}
uses: synopsys-sig/[email protected]
env:
DETECT_PROJECT_NAME: ${{ github.event.repository.name }}
DETECT_PROJECT_VERSION_NAME: ${{ github.ref_name }}
DETECT_CODE_LOCATION_NAME: ${{ github.event.repository.name }}-${{ github.ref_name }}
with:
blackduck_url: ${{ vars.BLACKDUCK_URL }}
blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
blackduck_scan_full: true
# blackduck_scan_failure_severities: 'BLOCKER'
- name: Black Duck PR Scan
if: ${{ github.event_name == 'pull_request' }}
uses: synopsys-sig/[email protected]
env:
DETECT_PROJECT_NAME: ${{ github.event.repository.name }}
DETECT_PROJECT_VERSION_NAME: ${{ github.base_ref }}
DETECT_CODE_LOCATION_NAME: ${{ github.event.repository.name }}-${{ github.base_ref }}
with:
blackduck_url: ${{ vars.BLACKDUCK_URL }}
blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
blackduck_scan_full: false
blackduck_prComment_enabled: true
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Coverity Full Scan
if: ${{ github.event_name != 'pull_request' }}
uses: synopsys-sig/[email protected]
with:
coverity_url: ${{ vars.COVERITY_URL }}
coverity_user: ${{ secrets.COV_USER }}
coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
# coverity_project_name: ${{ github.event.repository.name }}
# coverity_stream_name: ${{ github.event.repository.name }}-${{ github.ref_name }}
# coverity_policy_view: 'Outstanding Issues'
- name: Coverity PR Scan
if: ${{ github.event_name == 'pull_request' }}
uses: synopsys-sig/[email protected]
with:
coverity_url: ${{ vars.COVERITY_URL }}
coverity_user: ${{ secrets.COV_USER }}
coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
# coverity_project_name: ${{ github.event.repository.name }}
# coverity_stream_name: ${{ github.event.repository.name }}-${{ github.base_ref }}
coverity_prComment_enabled: true
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: SRM Import
if: ${{ github.event_name != 'pull_request' }}
uses: codedx/[email protected]
with:
server-url: ${{ vars.SRM_URL }}/codedx
api-key: ${{ secrets.SRM_APIKEY }}
project-name: ${{ github.event.repository.name }}
base-branch-name: ${{ github.event.repository.default_branch }}
target-branch-name: ${{ github.ref_name }}
source-and-binaries-glob: './**'
wait-for-completion: true
# - name: Save Logs
# if: always()
# uses: actions/upload-artifact@v4
# with:
# name: bridge-logs
# path: ${{ github.workspace }}/.bridge