Using the Black Duck Security Scan Action with Black Duck SCA

• blackduck_fixpr_enabled: By default, fix pull request creation is disabled (Black Duck Security Scan Action will not create fix pull requests for vulnerable direct dependencies.). To enable this feature, set blackduck_fixpr_enabled as true.
• github_token: You must pass github_token parameter with required permissions. The token can be GitHub secrets.GITHUB_TOKEN with required permissions. For more information on GitHub tokens see the GitHub documentation
• Due to rate limit restriction of GitHub rest API calls, note that GitHub might limit the number of pull requests that are created by Black Duck Security Scan Action.

name: CI-BlackDuck-SCA
  on:
    push:
      branches: [main, master, develop, stage, release]
    pull_request:
      branches: [main, master, develop, stage, release]
  jobs:
    build:
      runs-on: [ubuntu-latest]
    steps:
    - name: Checkout Source
      uses: actions/checkout@v5
    - name: Black Duck SCA Full Scan
      id: black-duck-full-scan
      if: ${{ github.event_name != 'pull_request' }}
      uses: blackduck-inc/black-duck-security-scan@v2
    
      ### Use below configuration to set specific detect environment variables
      env:
        DETECT_PROJECT_NAME: ${{ github.event.repository.name }}
      with:
        blackducksca_url: ${{ vars.BLACKDUCK_URL }}
        blackducksca_token: ${{ secrets.BLACKDUCK_TOKEN }}
        blackducksca_scan_full: true
        # blackducksca_waitForScan: false   # Used to support the async mode

        ### Accepts Multiple Values
        blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL'
        
        ### Arbitrary product-related CL arguments
        # detect_search_depth: 2
        # detect_args: '--detect.diagnostic=true'
        # detect_config_path: '/Users/Config/application.properties'

        ### Uncomment below configuration to enable automatic fix pull request creation if vulnerabilities are reported
        # blackducksca_fixpr_enabled: true
        # blackducksca_fixpr_maxCount: 10
        # blackducksca_fixpr_filter_severities: 'CRITICAL,HIGH'
        # blackducksca_fixpr_useUpgradeGuidance: 'SHORT_TERM,LONG_TERM'
        # github_token: ${{ secrets.GITHUB_TOKEN }} # Mandatory when blackducksca_fixpr_enabled is set to 'true'

        ### SARIF report generation and upload to GitHub Adavanced Security: Uncomment below to enable
        # blackducksca_reports_sarif_create: true # Create Black Duck SCA SARIF report and upload it as artifact
        # blackducksca_reports_sarif_file_path: '/Users/tmp/report.sarif.json' # File path including file name where SARIF report should be created(need to include file name as well)
        # blackducksca_reports_sarif_severities: 'CRITICAL,HIGH'
        # blackducksca_reports_sarif_groupSCAIssues: true # By default true
        # blackducksca_upload_sarif_report: true  # Upload Black Duck SCA SARIF report in GitHub Advanced Security tab
        # github_token: ${{ secrets.GITHUB_TOKEN }} # Required when blackducksca_upload_sarif_report is set as true

        ### Github Issues
        # blackducksca_externalIssues_create: true
        # blackducksca_externalIssues_severities: "critical,high,medium"
        # blackducksca_externalIssues_groupSCAIssues: true
        # blackducksca_externalIssues_maxCount: 5
        # github_token: ${{ secrets.GITHUB_TOKEN }} # Mandatory when blackducksca_externalIssues_create is set to 'true'

        ### Mark build status if policy violating issues are found
        # mark_build_status: 'success'

        ### To enable Black Duck SCA policy badges
        # blackducksca_policy_badges_create: true
        # blackducksca_policy_badges_maxCount: 5

        # project_directory: ${{ vars.PROJECT_DIRECTORY }}

        ### Uncomment below configuration if Bridge diagnostic files needs to be uploaded
        # include_diagnostics: true

        ### To enabable self-signed certificates
        #network_ssl_trustAll: true
        #network_ssl_cert_file: '/Users/Config/cert.pem'
  
    - name: Black Duck SCA PR Scan
      id: black-duck-pr-scan
      if: ${{ github.event_name == 'pull_request' }}
      uses: blackduck-inc/black-duck-security-scan@v2
    
      ### Use below configuration to set specific detect environment variables
      env:
        DETECT_PROJECT_NAME: ${{ github.event.repository.name }}
      with:
        blackducksca_url: ${{ vars.BLACKDUCK_URL }}
        blackducksca_token: ${{ secrets.BLACKDUCK_TOKEN }}
        blackducksca_scan_full: false
      
        ### Below configuration is used to enable automatic pull request comment based on Black Duck SCA scan result
        blackducksca_prComment_enabled: true
        github_token: ${{ secrets.GITHUB_TOKEN }}
        # Mandatory when blackducksca_automation_prcomment is set to 'true'

        ### To enable Black Duck SCA policy badges
        # blackducksca_policy_badges_create: true
        # blackducksca_policy_badges_maxCount: 5

        # project_directory: ${{ vars.PROJECT_DIRECTORY }}

        ### Uncomment below configuration if Bridge diagnostic files needs to be uploaded
        # include_diagnostics: true

        ### Mark build status if policy violating issues are found
        # mark_build_status: 'success'

        ### To enabable self-signed certificates
        # network_ssl_trustAll: true
        # network_ssl_cert_file: '/Users/Config/cert.pem'

        ### Uncomment below configuration to add custom logic based on return status
        # - name: cmdLine
        #   id: cmdLine
        #   run: |
        #     EXIT_CODE=${{ steps.black-duck-full-scan.outputs.status }}
        #     echo "Black Duck Full Scan exit status - $EXIT_CODE"