synopsys.yaml

# Copyright 2024 Nutanix. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Black Duck Policy Check
on:
  pull_request:
    branches:
      - main
    # Only scan when product source dependencies change.
    paths:
      - '**/go.mod'
      # Ignore source dependencies of build tooling.
      - '!docs/go.mod'
  push:
    branches:
      - main
    # Only scan when product source dependencies change.
    paths:
      - '**/go.mod'
      # Ignore source dependencies of build tooling.
      - '!docs/go.mod'

jobs:
  security:
    if: github.repository == 'nutanix-cloud-native/cluster-api-runtime-extensions-nutanix'
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install devbox
        uses: jetify-com/devbox-install-action@v0.11.0
        with:
          enable-cache: true

      - name: Go cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Build Project
        run: devbox run -- make build-snapshot

      - name: Black Duck Full Scan
        if: ${{ github.event_name != 'pull_request' }}
        uses: synopsys-sig/synopsys-action@v1.10.0
        with:
          blackduck_url: ${{ secrets.BLACKDUCK_URL }}
          blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          blackduck_scan_full: true
          blackduck_scan_failure_severities: 'BLOCKER,CRITICAL'

      - name: Black Duck PR Scan
        if: ${{ github.event_name == 'pull_request' }}
        uses: synopsys-sig/synopsys-action@v1.10.0
        env:
          DETECT_PROJECT_VERSION_NAME: ${{ github.base_ref }}
        with:
          blackduck_url: ${{ secrets.BLACKDUCK_URL }}
          blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          blackduck_scan_full: false
          blackduck_prComment_enabled: true