synopsys.yaml

name: Black Duck Policy Check
on:
  pull_request_target:
  push:
    branches:
      - main
      - 'release-*'

jobs:
  security:
    if: github.repository == 'nutanix-cloud-native/cluster-api-provider-nutanix'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: "${{ github.event.pull_request.head.sha }}"

      - name: Install devbox
        run: curl -fsSL https://get.jetpack.io/devbox | bash -s -- -f
      - name: Install devbox deps
        run: devbox install

      - name: Build Project
        run: devbox run -- make build

      - name: Black Duck Full Scan
        if: ${{ github.event_name != 'pull_request' }}
        uses: synopsys-sig/synopsys-action@v1.10.0
        with:
          blackduck_url: ${{ secrets.BLACKDUCK_URL }}
          blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          blackduck_scan_full: true
          blackduck_scan_failure_severities: 'BLOCKER,CRITICAL'

      - name: Black Duck PR Scan
        if: ${{ github.event_name == 'pull_request' }}
        uses: synopsys-sig/synopsys-action@v1.10.0
        env:
          DETECT_PROJECT_VERSION_NAME: ${{ github.base_ref }}
        with:
          blackduck_url: ${{ secrets.BLACKDUCK_URL }}
          blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          blackduck_scan_full: false
          blackduck_prComment_enabled: true