Using the Black Duck Security Scan Action with Polaris

name: CI-Polaris-Basic
on:
  push:
    branches: [main, master, develop, stage, release]
  pull_request:
    branches: [main, master, develop, stage, release]
  workflow_dispatch:


jobs:
  build:
    runs-on: [ubuntu-latest]
    steps:
    - name: Checkout Source
      uses: actions/checkout@v5
    - name: Polaris Scan
      id: polaris-scan
      uses: blackduck-inc/black-duck-security-scan@v2
      with:
        ### SCANNING: Required fields
        polaris_server_url: ${{ vars.POLARIS_SERVER_URL }}
        polaris_access_token: ${{ secrets.POLARIS_ACCESS_TOKEN }}
        polaris_assessment_types: "SCA,SAST"

        ### Binary scan: requires polaris_assessment_types set to SCA only
        # polaris_test_sca_type: "SCA-BINARY"
        # polaris_artifactToUpload: "/path/to/binary-file"

        ### SCA container scan: requires polaris_assessment_types set to SCA only
        # polaris_test_sca_type: 'SCA-CONTAINER'
        # polaris_artifactToUpload: '/path/to/container.tar.gz'
        # polaris_container_name: 'unique-container-name' # use for filtering

        ### SCANNING: Optional fields
        # polaris_application_name: ${{ github.event.repository.name }}
        # polaris_project_name: ${{ github.event.repository.name }}

        ### PULL REQUEST COMMENTS: Uncomment below to enable
        # polaris_prComment_enabled: true 
        # github_token: ${{ secrets.GITHUB_TOKEN }} # Mandatory when PR comments is enabled

        ### FIX PR: Uncomment below to enable
        # polaris_fixpr_enabled: true
        # github_token: ${{ secrets.GITHUB_TOKEN }} # Mandatory when polaris_fixpr_enabled is set to 'true'

        ### Github Issues
        # polaris_externalIssues_create: true
        # github_token: ${{ secrets.GITHUB_TOKEN }} # Mandatory when polaris_externalIssues_create is set to 'true'

        ### SARIF report parameters
        # polaris_reports_sarif_create: true
        # polaris_upload_sarif_report: true

        ### Signature scan
        # polaris_test_sca_type: "SCA-SIGNATURE"

        ### Mark build status if policy violating issues are found
        # mark_build_status: 'success'

        ### Uncomment below configuration to add custom logic based on return status
        # - name: cmdLine
        #   id: cmdLine
        #   run: |
        #     EXIT_CODE=${{ steps.polaris-scan.outputs.status }}
        #     echo "Polaris Scan exit status - $EXIT_CODE"

name: CI-Polaris
on:
  push:
    branches: [main, master, develop, stage, release]
  pull_request:
    branches: [main, master, develop, stage, release]
jobs:
  polaris-scan:
    runs-on: [ubuntu-latest]
    steps:
    - name: Checkout Source
      uses: actions/checkout@v5
    - name: Polaris Full Scan
      id: polaris-full-scan
      if: ${{ github.event_name != 'pull_request' }}
      uses: blackduck-inc/black-duck-security-scan@v2
      with:
        polaris_server_url: ${{ vars.POLARIS_SERVER_URL }}
        polaris_access_token: ${{ secrets.POLARIS_ACCESS_TOKEN }}
        polaris_application_name: ${{ github.event.repository.name }}
        polaris_project_name: ${{ github.event.repository.name }}
        polaris_assessment_types: "SCA,SAST"
        # polaris_waitForScan: false  # Used to support the async mode
        # project_directory: ${{ vars.PROJECT_DIRECTORY }}

        ### Github Issues
        # polaris_externalIssues_create: true
        # polaris_externalIssues_types: "SCA,SAST"
        # polaris_externalIssues_severities: "critical,high,medium"
        # polaris_externalIssues_groupSCAIssues: true
        # polaris_externalIssues_maxCount: 10
        # github_token: ${{ secrets.GITHUB_TOKEN }} # Mandatory when polaris_externalIssues_create is set to 'true'

        ### FIX PR
        # Creates Fix PRs for the assessment types configured in polaris_assessment_types (SAST, SCA, or both).
        # polaris_fixpr_enabled: true
        # Shared limit across SAST and SCA Fix PRs.
        # polaris_fixpr_maxCount: 10
        # Applies to SCA Fix PRs only.
        # polaris_fixpr_useUpgradeGuidance: "SHORT_TERM,LONG_TERM"
        # SAST and/or SCA Fix PR severity filter.
        # polaris_fixpr_filter_severities: "critical,high,medium"
        # GitHub token is mandatory when polaris_fixpr_enabled is 'true'.
        # github_token: ${{ secrets.GITHUB_TOKEN }}

        ### Uncomment below configuration if Bridge diagnostic files needs to be uploaded
        # include_diagnostics: true

        ### SARIF report generation and upload to GitHub Adavanced Security Tab: Uncomment below to enable
        # polaris_reports_sarif_create: true  
        # polaris_reports_sarif_file_path: '/Users/tmp/report.sarif.json' # File path (including file name) where SARIF report is created.
        # polaris_reports_sarif_severities: 'CRITICAL,HIGH'
        # polaris_reports_sarif_groupSCAIssues: true 
        # polaris_reports_sarif_issue_types: 'SCA, SAST' 
        # polaris_upload_sarif_report: true 
        # github_token: ${{ secrets.GITHUB_TOKEN }} # Required when polaris_upload_sarif_report is set as true

        ### Mark build status if policy violating issues are found
        # mark_build_status: 'success'

        ### Signature scan
        # polaris_test_sca_type: 'SCA-SIGNATURE'

        ### Binary scan: requires polaris_assessment_types set to SCA only
        # polaris_test_sca_type: "SCA-BINARY"
        # polaris_artifactToUpload: "/path/to/binary-file"

        ### SCA container scan: requires polaris_assessment_types set to SCA only 
        # polaris_test_sca_type: 'SCA-CONTAINER'
        # polaris_artifactToUpload: '/path/to/container.tar.gz'
        # polaris_container_name: 'unique-container-name' # use for filtering

        ### Uncomment this to use Source Upload method. Default value is hybrid (build based)
        # polaris_test_sast_location: 'remote'
        # polaris_test_sca_location: 'remote'
        # project_source_archive: ${{ vars.PROJECT_SOURCE_ARCHIVE }}
        # project_source_excludes: ${{ vars.PROJECT_SOURCE_EXCLUDES }} # Accepts Multiple Values
        # project_source_preserveSymLinks: true

        #### Uncomment this to use Local Analysis feature
        # Please use Local Analysis or Source Upload exclusively
        # polaris_test_sast_location: 'local'

        ### Uncomment below to add arbitrary CL parameters
        # detect_search_depth: 2
        # detect_args: '--detect.diagnostic=true'
        # detect_config_path: '/Users/Config/application.properties'
        # coverity_build_command: mvn clean install
        # coverity_clean_command: mvn clean
        # coverity_config_path: /Users/Config/coverity.yml
        # coverity_args: --config-override capture.build.build-command=mvn install
        # coverity_version: '2025.6.2'

    - name: Polaris PR Scan
      id: polaris-pr-scan
      if: ${{ github.event_name == 'pull_request' }}
      uses: blackduck-inc/black-duck-security-scan@v2
      with:
        polaris_server_url: ${{ vars.POLARIS_SERVER_URL }}
        polaris_access_token: ${{ secrets.POLARIS_ACCESS_TOKEN }}
        polaris_application_name: ${{ github.event.repository.name }}
        polaris_project_name: ${{ github.event.repository.name }}
        polaris_assessment_types: "SCA,SAST"
        # project_directory: ${{ vars.PROJECT_DIRECTORY }}

        ### Uncomment this to use Source Upload method. Default value is hybrid (build based)
        # polaris_test_sast_location: 'remote'
        # polaris_test_sca_location: 'remote'
        # project_source_archive: ${{ vars.PROJECT_SOURCE_ARCHIVE }}
        # project_source_excludes: ${{ vars.PROJECT_SOURCE_EXCLUDES }} # Accepts Multiple Values
        # project_source_preserveSymLinks: true

        #### Uncomment this to use Local Analysis feature
        # Please use Local Analysis or Source Upload exclusively
        # polaris_test_sast_location: 'local'

        ### Below configuration is used to enable feedback from Polaris security testing as pull request comment
        polaris_prComment_enabled: true
        github_token: ${{ secrets.GITHUB_TOKEN }}
        # Mandatory when polaris_prComment_enabled is set to 'true'

        ### Mark build status if policy violating issues are found
        # mark_build_status: 'success'

        ### Uncomment below configuration if Bridge diagnostic files needs to be uploaded
        # include_diagnostics: true

        ### Uncomment below configuration to add custom logic based on return status
        # - name: cmdLine
        #   id: cmdLine
        #   run: |
        #     EXIT_CODE=${{ steps.polaris-full-scan.outputs.status }}
        #     echo "Polarity Full Scan exit status - $EXIT_CODE"