# example workflow for Black Duck scans using the Bridge CLI

name: bd-bridge-cli

on:

push:

branches: [ main, master, develop, stage, release ]

pull_request:

branches: [ main, master, develop, stage, release ]

workflow_dispatch:

jobs:

blackduck:

runs-on: ubuntu-latest

env:

BRIDGE_BLACKDUCK_URL: ${{ vars.BLACKDUCK_URL }}

BRIDGE_BLACKDUCK_TOKEN: ${{ secrets.BLACKDUCK_API_TOKEN }}

BRIDGE_GITHUB_USER_TOKEN: ${{ secrets.GITHUB_TOKEN }}

steps:

- name: Checkout Source

uses: actions/checkout@v4

- name: Setup Java JDK

uses: actions/setup-java@v4

with:

java-version: 17

distribution: microsoft

cache: maven

- name: Maven Build

run: mvn -B -DskipTests package

- name: Black Duck Full Scan

if: ${{ github.event_name != 'pull_request' }}

env:

DETECT_PROJECT_NAME: ${{ github.event.repository.name }}

DETECT_PROJECT_VERSION_NAME: ${{ github.ref_name }}

DETECT_CODE_LOCATION_NAME: ${{ github.event.repository.name }}-${{ github.ref_name }}

run: |

curl -fLsS -o bridge.zip ${{ vars.BRIDGECLI_LINUX64 }} && unzip -qo -d ${{ runner.temp }} bridge.zip && rm -f bridge.zip

${{ runner.temp }}/synopsys-bridge --stage blackduck \

blackduck.scan.full='true' \

blackduck.scan.failure.severities='BLOCKER' \

blackduck.fixpr.enabled='true' \

blackduck.reports.sarif.create='true' \

github.repository.owner.name=${{ github.repository_owner }} \

github.repository.name=${{ github.event.repository.name }} \

github.repository.branch.name=${{ github.ref_name }}

- name: Black Duck PR Scan

if: ${{ github.event_name == 'pull_request' }}

env:

DETECT_PROJECT_NAME: ${{ github.event.repository.name }}

DETECT_PROJECT_VERSION_NAME: ${{ github.base_ref }}

DETECT_CODE_LOCATION_NAME: ${{ github.event.repository.name }}-${{ github.base_ref }}

run: |

curl -fLsS -o bridge.zip ${{ vars.BRIDGECLI_LINUX64 }} && unzip -qo -d ${{ runner.temp }} bridge.zip && rm -f bridge.zip

${{ runner.temp }}/synopsys-bridge --stage blackduck \

blackduck.scan.full='false' \

blackduck.automation.prcomment='true' \

github.repository.owner.name=${{ github.repository_owner }} \

github.repository.name=${{ github.event.repository.name }} \

github.repository.branch.name=${{ github.ref_name }} \

github.repository.pull.number=${{ github.event.number }}

# - name: Save Logs

# if: always()

# uses: actions/upload-artifact@v4

# with:

# name: bridge-logs

# path: ${{ github.workspace }}/.bridge