Enhance BlackDuck scan action with scan_mode input and update workflow to use MAVEN_VERSION environment variable

Author: Schmarvinius

.github/actions/scan-with-blackduck/action.yml

@@ -15,6 +15,10 @@ inputs:
   maven-version:
     description: The Maven version the build shall run with.
     required: true
+  scan_mode:
+    description: The scan mode to use (FULL or RAPID)
+    default: 'FULL'
+    required: false
 
 runs:
   using: composite
@@ -51,4 +55,4 @@ runs:
       env:
         PIPER_token: ${{ inputs.blackduck_token }}
         GITHUB_token: ${{ inputs.github_token }}
-        SCAN_MODE: FULL
+        SCAN_MODE: ${{ inputs.scan_mode }}

.github/workflows/main.yml

@@ -1,11 +1,30 @@
 name: CI
 
+env:
+  MAVEN_VERSION: '3.9.12'
+
 on:
   workflow_dispatch:
   push:
     branches: [main]
 
 jobs:
+  blackduck:
+    name: Blackduck Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Scan With Black Duck
+        uses: ./.github/actions/scan-with-blackduck
+        with:
+          blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          maven-version: ${{ env.MAVEN_VERSION }}
+          scan_mode: RAPID
+
   build-and-test:
     uses: ./.github/workflows/pipeline.yml
     with:

README.md

@@ -135,7 +135,9 @@ By default, the plugin operates without a dedicated storage target, storing atta
 Other available storage targets:
 
 - [Amazon, Azure, and Google Object Stores](storage-targets/cds-feature-attachments-oss)
-- [local file system as a storage backend](storage-targets/cds-feature-attachments-fs) (only for testing scenarios)
+- [local file system as a storage backend](storage-targets/cds-feature-attachments-fs)
+
+> **Warning:** The [file system storage target](storage-targets/cds-feature-attachments-fs) (`cds-feature-attachments-fs`) is intended **only for local development and testing purposes**. It is **not suitable for production or deployed environments**. For production use, configure one of the supported object stores (AWS, Azure, or Google).
 
 When using a dedicated storage target, the attachment is not stored in the underlying database; instead, it is saved on the specified storage target and only a reference to the file is kept in the database, as defined in the [CDS model](cds-feature-attachments/src/main/resources/cds/com.sap.cds/cds-feature-attachments/attachments.cds#L20).