Skip to content

Commit d8fe9bf

Browse files
johanneseschrigjohanneseschrig
authored
build: add blackduck and sonar scans (#1)
* build: add blackduck and sonar scans * fixes * rm repository * readd repo * fix repo * allow creating issues * github token * fix permissions
1 parent b198da2 commit d8fe9bf

6 files changed

Lines changed: 164 additions & 24 deletions

File tree

‎.github/actions/scan-with-blackduck/action.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: Scan with BlackDuck
2+
description: Scans the project with BlackDuck
3+
4+
inputs:
5+
blackduck_token:
6+
description: The token to use for BlackDuck authentication
7+
required: true
8+
github_token:
9+
description: The token to use for GitHub authentication
10+
required: true
11+
java-version:
12+
description: The version of Java to use
13+
default: "17"
14+
required: false
15+
maven-version:
16+
description: The Maven version the build shall run with.
17+
required: true
18+
19+
runs:
20+
using: composite
21+
steps:
22+
- name: Set up Java ${{ inputs.java-version }}
23+
uses: actions/setup-java@v4
24+
with:
25+
java-version: ${{ inputs.java-version }}
26+
distribution: sapmachine
27+
cache: maven
28+
29+
- name: Set up Maven ${{ inputs.maven-version }}
30+
uses: stCarolas/setup-maven@v5
31+
with:
32+
maven-version: ${{ inputs.maven-version }}
33+
34+
- name: Get Major Version
35+
id: get-major-version
36+
run: |
37+
echo "REVISION=$(mvn help:evaluate -Dexpression=revision -q -DforceStdout)" >> $GITHUB_OUTPUT
38+
shell: bash
39+
40+
- name: Print Version Number
41+
run: echo "${{ steps.get-major-version.outputs.REVISION }}"
42+
shell: bash
43+
44+
- name: BlackDuck Scan
45+
uses: SAP/project-piper-action@main
46+
with:
47+
step-name: detectExecuteScan
48+
flags: \
49+
--version=${{ steps.get-major-version.outputs.REVISION }}
50+
env:
51+
PIPER_token: ${{ inputs.blackduck_token }}
52+
PIPER_githubToken: ${{ inputs.github_token }}
53+
SCAN_MODE: FULL

‎.github/actions/scan-with-sonar/action.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: Scan with SonarQube
2+
description: Scans the project with SonarQube
3+
4+
inputs:
5+
sonarq-token:
6+
description: The token to use for SonarQube authentication
7+
required: true
8+
github-token:
9+
description: The token to use for GitHub authentication
10+
required: true
11+
java-version:
12+
description: The version of Java to use
13+
required: true
14+
maven-version:
15+
description: The version of Maven to use
16+
required: true
17+
18+
runs:
19+
using: composite
20+
21+
steps:
22+
- name: Set up Java ${{inputs.java-version}}
23+
uses: actions/setup-java@v4
24+
with:
25+
java-version: ${{inputs.java-version}}
26+
distribution: sapmachine
27+
cache: maven
28+
29+
- name: Set up Maven ${{inputs.maven-version}}
30+
uses: stCarolas/setup-maven@v5
31+
with:
32+
maven-version: ${{inputs.maven-version}}
33+
34+
- name: Get Revision
35+
id: get-revision
36+
run: |
37+
echo "REVISION=$(mvn help:evaluate -Dexpression=revision -q -DforceStdout)" >> $GITHUB_OUTPUT
38+
shell: bash
39+
40+
- name: Print Revision
41+
run: echo "${{steps.get-revision.outputs.REVISION}}"
42+
shell: bash
43+
44+
- name: SonarQube Scan
45+
uses: SAP/project-piper-action@main
46+
with:
47+
step-name: sonarExecuteScan
48+
flags: --token=${{inputs.sonarq-token}} --githubToken=${{inputs.github-token}} --version=${{steps.get-revision.outputs.REVISION}} --inferJavaBinaries=true

‎.github/workflows/blackduck.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Blackduck Scan
2+
3+
env:
4+
MAVEN_VERSION: "3.9.11"
5+
6+
on:
7+
schedule:
8+
# Run nightly at 2 AM UTC
9+
- cron: "0 2 * * *"
10+
workflow_dispatch: # Allow manual trigger
11+
pull_request:
12+
branches: ["main"]
13+
push:
14+
branches: ["main"]
15+
permissions:
16+
contents: write
17+
id-token: write
18+
issues: write
19+
pull-requests: write
20+
21+
jobs:
22+
blackduck:
23+
name: Blackduck Scan
24+
runs-on: ubuntu-latest
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@v5
28+
- name: Scan With Black Duck
29+
uses: ./.github/actions/scan-with-blackduck
30+
with:
31+
blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }}
32+
github_token: ${{ secrets.GITHUB_TOKEN }}
33+
maven-version: ${{ env.MAVEN_VERSION }}

‎.github/workflows/build.yml‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
1-
name: PR Build
1+
name: Build
22

33
env:
4-
MAVEN_VERSION: '3.9.11'
4+
MAVEN_VERSION: "3.9.11"
55

66
on:
7+
workflow_dispatch: # Allow manual trigger
78
pull_request:
8-
branches: [ "main" ]
9+
branches: ["main"]
910
push:
10-
branches: [ "main" ]
11+
branches: ["main"]
1112
permissions:
1213
contents: write
1314
id-token: write
@@ -17,13 +18,20 @@ jobs:
1718
runs-on: ubuntu-latest
1819
strategy:
1920
matrix:
20-
java-version: [ 17, 21 ]
21+
java-version: [17, 21]
2122
steps:
2223
- name: Checkout
2324
uses: actions/checkout@v5
24-
2525
- name: Build
2626
uses: ./.github/actions/build
2727
with:
2828
java-version: ${{ matrix.java-version }}
29-
maven-version: ${{ env.MAVEN_VERSION }}
29+
maven-version: ${{ env.MAVEN_VERSION }}
30+
- name: Sonar Scan
31+
uses: ./.github/actions/scan-with-sonar
32+
if: matrix.java-version == 21
33+
with:
34+
java-version: 21
35+
maven-version: ${{ env.MAVEN_VERSION }}
36+
sonarq-token: ${{ secrets.SONAR_TOKEN }}
37+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/prepare-next-version.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
name: Deploy to Maven Central
1+
name: Prepare Next Version
22

33
env:
4-
JAVA_VERSION: '17'
5-
MAVEN_VERSION: '3.9.11'
4+
JAVA_VERSION: "17"
5+
MAVEN_VERSION: "3.9.11"
66

77
on:
88
workflow_dispatch:

‎.pipeline/config.yml‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,37 +4,35 @@ steps:
44
verify: true
55
flatten: true
66
# https://www.project-piper.io/steps/mavenBuild/#dockerimage
7-
# If empty, Docker is not used and the command is executed directly on the Jenkins system.
8-
dockerImage: ''
7+
dockerImage: ""
98

109
detectExecuteScan:
11-
projectName: 'com.sap.cds.feature.console'
10+
projectName: "com.sap.cds.feature.console"
1211
groups:
13-
- 'CDSJAVA-OPEN-SOURCE'
14-
serverUrl: 'https://sap.blackducksoftware.com/'
15-
mavenExcludedScopes: [ "provided", "test" ]
16-
failOn: [ 'BLOCKER', 'CRITICAL', 'MAJOR' ]
12+
- "CDSJAVA-OPEN-SOURCE"
13+
serverUrl: "https://sap.blackducksoftware.com/"
14+
mavenExcludedScopes: ["provided", "test"]
15+
failOn: ["BLOCKER", "CRITICAL", "MAJOR"]
1716
versioningModel: "major-minor"
18-
detectTools: [ 'DETECTOR', 'BINARY_SCAN' ]
17+
detectTools: ["DETECTOR", "BINARY_SCAN"]
1918
installArtifacts: true
20-
repository: '/cap-java/cds-feature-console'
19+
owner: "cap-java"
20+
repository: "cds-feature-console"
2121
verbose: true
2222
scanProperties:
2323
- --detect.included.detector.types=MAVEN
2424
- --detect.excluded.directories='**/node_modules,**/*test*,**/localrepo,**/target/site,**/*-site.jar'
2525
- --detect.maven.build.command='-pl com.sap.cds:cds-feature-console'
2626
# https://www.project-piper.io/steps/detectExecuteScan/#dockerimage
27-
# If empty, Docker is not used and the command is executed directly on the Jenkins system.
28-
dockerImage: ''
27+
dockerImage: ""
2928

3029
sonarExecuteScan:
3130
serverUrl: https://sonar.tools.sap
3231
projectKey: cds-feature-console
3332
# https://www.project-piper.io/steps/sonarExecuteScan/#dockerimage
34-
# If empty, Docker is not used and the command is executed directly on the Jenkins system.
35-
dockerImage: ''
33+
dockerImage: ""
3634
options:
3735
- sonar.qualitygate.wait=true
3836
- sonar.java.source=17
3937
- sonar.exclusions=**/node_modules/**,**/target/**
40-
- sonar.coverage.jacoco.xmlReportPaths=cds-feature-console/target/site/jacoco/jacoco.xml
38+
- sonar.coverage.jacoco.xmlReportPaths=cds-feature-console/target/site/jacoco/jacoco.xml

0 commit comments

Comments
 (0)