Additional GitHub configuration

Continuous integration for Polaris
Here are some optional configurations that can be used with Black Duck Security Scan Action for GitHub:

  • Black Duck Scan versioning:

    In our workflow, we employ the blackduck-inc/black-duck-security-scan GitHub Action to perform security scans. Users can specify the action version using two primary methods:

    • @v2 (recommended): Locks the action to the latest v2.x release, ensuring updates and patches within the stable major version 2. For precise version control, you can pin to a specific patch version (e.g., @v2.1.1).
    • @latest: Directs to the most recent release commit.
  • Install directory:
    bridgecli_install_directory: Use this to specify the path to Bridge CLI.
    Note: If this is not explicitly specified, then the integration defaults to $HOME/bridge-cli. If the installed version of Bridge CLI is not the latest, then the latest version of Bridge CLI is downloaded unless you specify the version to use explicitly (as documented below).
  • Download URL:
    bridgecli_download_url: Use this to specify the URL to the Bridge CLI zip file to be automatically downloaded and used. Examples: bridgecli_download_url: https://repo.blackduck.com/bds-integrations-release/com/blackduck/integration/bridge/binaries/bridge-cli-bundle/latest/bridge-cli-bundle-win64.zip or bridgecli_download_url: https://repo.blackduck.com/bds-integrations-release/com/blackduck/integration/bridge/binaries/bridge-cli-bundle/3.11.0/bridge-cli-bundle-3.11.0-win64.zip
    Note: If bridgecli_download_url is not provided, Black Duck Security Scan Action downloads the latest version of Bridge CLI from repo.blackduck.com.
  • Download version:
    bridgecli_download_version: Use this to specify the Bridge CLI version to use. If provided, the specified version of Bridge CLI will be automatically downloaded from repo.blackduck.com and used. If not, the latest version is downloaded and used. Example: bridgecli_download_version: "1.0.0"
    Note: If both bridgecli_download_version and bridgecli_download_url are provided, bridgecli_download_url takes precedence.
  • Using a proxy through GitHub Action's environment:
    Black Duck Security Action supports the following environment variables:
    Table 1. Proxy parameters
    Variable Description Example
    HTTPS_PROXY / https_proxy Proxy URL for HTTPS traffic. You can include basic authentication if required. Use this when target URL is HTTPS.
    • https://proxy.com
    • https://192.168.1.1:8080
    • https://username:password@proxy.com
    HTTP_PROXY / http_proxy Proxy URL for HTTP traffic. You can include basic authentication if required. Use this when target URL is HTTP.
    • http://proxy.com
    • http://192.168.1.1:8080
    • http://username:password@proxy.com
    NO_PROXY / no_proxy A comma-separated list of hosts or IP addresses that should bypass the proxy. Some clients only honor IP addresses when connections are made directly to the IP rather than a hostname.
    • example.com
    • example.com,myserver.local:443,example.org
    Note: Currently Coverity Local Scan is not supported with Proxy configuration.
    You may use the proxy parameters with secrets as shown here: 
    env:
    HTTPS_PROXY: ${{ secrets.HTTPS_PROXY }} # Proxy URL for HTTPS traffic
    HTTP_PROXY: ${{ secrets.HTTP_PROXY }} # Proxy URL for HTTP traffic
    NO_PROXY: ${{ secrets.NO_PROXY_LIST }} # Comma-separated list of hosts or IP addresses that should bypass the proxy
    Note: Proxy variables in a GitHub pipeline can either be defined globally (available to all steps) or scoped to a single step (available only within that step).
    If you are using a proxy with authentication, follow these guidelines:
  • Include diagnostics:

    include_diagnostics: When set to true, Bridge CLI diagnostic files are created and posted to GitHub. Additionally, diagnostics_retention_days can be used to specify the number of days the diagnostics files are retained for. Default value is 90. Accepted range of values is from 1 to 90.

  • Mark build status:
    mark_build_status: Defines the build status when policy-violating issues are detected. Supported values: failure, and success. The default value is failure.
    Note: mark_build_status is applicable only for return status 8. For any other return value, mark build status is ignored.