From 868eba5d10622b5bfe596acfad82db07c32df0fa Mon Sep 17 00:00:00 2001 From: NeethuESim Date: Wed, 5 Aug 2026 10:33:06 -0700 Subject: [PATCH 01/36] feat: add blackduck gh workflow --- .../workflows/black-duck-security-scan-ci.yml | 95 +++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 .github/workflows/black-duck-security-scan-ci.yml diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml new file mode 100644 index 0000000..5a6f4d8 --- /dev/null +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -0,0 +1,95 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# Black Duck Security Action allows you to integrate Static Analysis Security Testing (SAST) and Software Composition Analysis (SCA) into your CI/CD pipelines. +# For more information about configuring your workflow, +# read our documentation at https://github.com/blackduck-inc/black-duck-security-scan + +name: CI Black Duck security scan + +on: + push: + branches: [ "main", "secure-build" ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ "main", "secure-build" ] + schedule: + - cron: '34 5 * * 6' + +jobs: + build: + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + security-events: write + actions: read + + steps: + - name: Checkout source + uses: actions/checkout@v4 + - name: Black Duck SCA scan + id: black-duck-full-scan + if: ${{ github.event_name != 'pull_request' }} + uses: blackduck-inc/black-duck-security-scan@v2 + with: + ### ---------- BLACKDUCK SCA SCANNING: REQUIRED FIELDS ---------- + blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} + blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} + blackducksca_scan_full: true + + ### SCANNING: Optional fields + # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' + + ### FIX PULL REQUEST CREATION: Uncomment below to enable + blackducksca_fixpr_enabled: true + github_token: ${{ secrets.GITHUB_TOKEN }} # Required when Fix PRs is enabled + + ### PULL REQUEST COMMENTS: Uncomment below to enable + blackducksca_prcomment_enabled: true + # github_token: ${{ secrets.GITHUB_TOKEN }} # Required when PR comments is enabled + + ### SARIF report generation and upload to GitHub Adavanced Security: Uncomment below to enable + blackducksca_reports_sarif_create: true # Create Black Duck SCA SARIF report and upload it as artifact + blackducksca_upload_sarif_report: true # Upload Black Duck SCA SARIF report in GitHub Advanced Security tab + # github_token: ${{ secrets.GITHUB_TOKEN }} # Required when blackducksca_upload_sarif_report is set as true + + ### Mark build status if policy violating issues are found + mark_build_status: 'success' + + ### To enable Black Duck SCA policy badges + blackducksca_policy_badges_create: true + blackducksca_policy_badges_maxCount: 5 + + ### Uncomment below configuration if Bridge diagnostic files needs to be uploaded + include_diagnostics: true + + - name: Black Duck SCA PR Scan + id: black-duck-pr-scan + if: ${{ github.event_name == 'pull_request' }} + uses: blackduck-inc/black-duck-security-scan@v2 + with: + blackducksca_url: ${{ vars.BLACKDUCK_URL }} + blackducksca_token: ${{ secrets.BLACKDUCK_TOKEN }} + blackducksca_scan_full: false + + ### Mark build status if policy violating issues are found + mark_build_status: 'success' + + ### ---------- COVERITY SCANNING: REQUIRED FIELDS ---------- + ### coverity_url: ${{ vars.COVERITY_URL }} + ### coverity_user: ${{ secrets.COVERITY_USER }} + ### coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }} + + ### ---------- POLARIS SCANNING: REQUIRED FIELDS ---------- + ### polaris_server_url: ${{ vars.POLARIS_SERVER_URL }} + ### polaris_access_token: ${{ secrets.POLARIS_ACCESS_TOKEN }} + ### polaris_assessment_types: "SCA,SAST" + + ### ---------- SRM SCANNING: REQUIRED FIELDS ---------- + ### srm_url: ${{ vars.SRM_URL }} + ### srm_apikey: ${{ secrets.SRM_API_KEY }} + ### srm_assessment_types: "SCA,SAST" + From 4ccaac2a508056c3b04be678c3446b96f5811fc1 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Wed, 5 Aug 2026 13:42:06 -0700 Subject: [PATCH 02/36] fix: blackduck url & token vars --- .github/workflows/black-duck-security-scan-ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 5a6f4d8..190042e 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -71,8 +71,8 @@ jobs: if: ${{ github.event_name == 'pull_request' }} uses: blackduck-inc/black-duck-security-scan@v2 with: - blackducksca_url: ${{ vars.BLACKDUCK_URL }} - blackducksca_token: ${{ secrets.BLACKDUCK_TOKEN }} + blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} + blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} blackducksca_scan_full: false ### Mark build status if policy violating issues are found From 4827072f107e6c0ed0f155e54489f919facaf69c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 17 Aug 2026 17:54:08 +0000 Subject: [PATCH 03/36] Apply remaining changes Co-authored-by: NeethuESim <3488970+NeethuESim@users.noreply.github.com> --- .github/workflows/black-duck-security-scan-ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 190042e..434655c 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -42,6 +42,7 @@ jobs: ### SCANNING: Optional fields # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' + detect_args: "--detect.accuracy.required=LOW" ### FIX PULL REQUEST CREATION: Uncomment below to enable blackducksca_fixpr_enabled: true @@ -74,6 +75,7 @@ jobs: blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} blackducksca_scan_full: false + detect_args: "--detect.accuracy.required=LOW" ### Mark build status if policy violating issues are found mark_build_status: 'success' @@ -92,4 +94,3 @@ jobs: ### srm_url: ${{ vars.SRM_URL }} ### srm_apikey: ${{ secrets.SRM_API_KEY }} ### srm_assessment_types: "SCA,SAST" - From 810d604e63be72048cf6cbaaf0b6ab7a0158bfd3 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Mon, 17 Aug 2026 11:28:23 -0700 Subject: [PATCH 04/36] fix: detect accuracy value --- .github/workflows/black-duck-security-scan-ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 434655c..de66034 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -42,7 +42,7 @@ jobs: ### SCANNING: Optional fields # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' - detect_args: "--detect.accuracy.required=LOW" + detect_args: "--detect.accuracy.required=NONE" ### FIX PULL REQUEST CREATION: Uncomment below to enable blackducksca_fixpr_enabled: true @@ -75,7 +75,7 @@ jobs: blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} blackducksca_scan_full: false - detect_args: "--detect.accuracy.required=LOW" + detect_args: "--detect.accuracy.required=NONE" ### Mark build status if policy violating issues are found mark_build_status: 'success' From b9b361741dd1508b75fe8a88e39e07c4fb6eba80 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Mon, 17 Aug 2026 11:44:01 -0700 Subject: [PATCH 05/36] fix: token permission --- .github/workflows/black-duck-security-scan-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index de66034..33d1ccd 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -24,7 +24,7 @@ jobs: permissions: contents: read pull-requests: write - security-events: write + security-events: read actions: read steps: From bd113d7e8c0531024c07059581a68eb9e5d7e464 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Mon, 17 Aug 2026 11:53:41 -0700 Subject: [PATCH 06/36] fix: pin hash --- .github/workflows/black-duck-security-scan-ci.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 33d1ccd..b150177 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -18,22 +18,25 @@ on: schedule: - cron: '34 5 * * 6' +# Declare default permissions as read only. +permissions: read-all + jobs: build: runs-on: ubuntu-latest permissions: contents: read pull-requests: write - security-events: read + security-events: write actions: read steps: - name: Checkout source - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Black Duck SCA scan id: black-duck-full-scan if: ${{ github.event_name != 'pull_request' }} - uses: blackduck-inc/black-duck-security-scan@v2 + uses: blackduck-inc/black-duck-security-scan@152247222aa9cd38124acd5c0cf60f4db71adc3f # v2.11.0 with: ### ---------- BLACKDUCK SCA SCANNING: REQUIRED FIELDS ---------- blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} @@ -70,7 +73,7 @@ jobs: - name: Black Duck SCA PR Scan id: black-duck-pr-scan if: ${{ github.event_name == 'pull_request' }} - uses: blackduck-inc/black-duck-security-scan@v2 + uses: blackduck-inc/black-duck-security-scan@152247222aa9cd38124acd5c0cf60f4db71adc3f # v2.11.0 with: blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} From 16ab726748a3be9c8d43c6514b2d63adefb397b3 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Mon, 17 Aug 2026 12:13:19 -0700 Subject: [PATCH 07/36] fix: sarif upload via codeql-action --- .../workflows/black-duck-security-scan-ci.yml | 30 +++++++------------ 1 file changed, 11 insertions(+), 19 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index b150177..b49f38e 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -55,10 +55,11 @@ jobs: blackducksca_prcomment_enabled: true # github_token: ${{ secrets.GITHUB_TOKEN }} # Required when PR comments is enabled - ### SARIF report generation and upload to GitHub Adavanced Security: Uncomment below to enable - blackducksca_reports_sarif_create: true # Create Black Duck SCA SARIF report and upload it as artifact - blackducksca_upload_sarif_report: true # Upload Black Duck SCA SARIF report in GitHub Advanced Security tab - # github_token: ${{ secrets.GITHUB_TOKEN }} # Required when blackducksca_upload_sarif_report is set as true + ### SARIF report generation for upload to GitHub Advanced Security + blackducksca_reports_sarif_create: true + blackducksca_reports_sarif_file_path: blackduck-results.sarif + ### Set upload to false & then later upload via github/codeql-action/upload-sarif@v4.37.4 to avoid token-permissions issue flagged by scorecard + blackducksca_upload_sarif_report: false ### Mark build status if policy violating issues are found mark_build_status: 'success' @@ -69,6 +70,12 @@ jobs: ### Uncomment below configuration if Bridge diagnostic files needs to be uploaded include_diagnostics: true + + - name: Upload Black Duck SARIF + if: ${{ github.event_name != 'pull_request' }} + uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + with: + sarif_file: blackduck-results.sarif - name: Black Duck SCA PR Scan id: black-duck-pr-scan @@ -82,18 +89,3 @@ jobs: ### Mark build status if policy violating issues are found mark_build_status: 'success' - - ### ---------- COVERITY SCANNING: REQUIRED FIELDS ---------- - ### coverity_url: ${{ vars.COVERITY_URL }} - ### coverity_user: ${{ secrets.COVERITY_USER }} - ### coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }} - - ### ---------- POLARIS SCANNING: REQUIRED FIELDS ---------- - ### polaris_server_url: ${{ vars.POLARIS_SERVER_URL }} - ### polaris_access_token: ${{ secrets.POLARIS_ACCESS_TOKEN }} - ### polaris_assessment_types: "SCA,SAST" - - ### ---------- SRM SCANNING: REQUIRED FIELDS ---------- - ### srm_url: ${{ vars.SRM_URL }} - ### srm_apikey: ${{ secrets.SRM_API_KEY }} - ### srm_assessment_types: "SCA,SAST" From c88464107c0214a38e8f6bcf9b2e0d55f67abd76 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Mon, 17 Aug 2026 13:16:19 -0700 Subject: [PATCH 08/36] fix: uncomment gh token line for pr comments --- .github/workflows/black-duck-security-scan-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index b49f38e..8b77cab 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -53,7 +53,7 @@ jobs: ### PULL REQUEST COMMENTS: Uncomment below to enable blackducksca_prcomment_enabled: true - # github_token: ${{ secrets.GITHUB_TOKEN }} # Required when PR comments is enabled + github_token: ${{ secrets.GITHUB_TOKEN }} # Required when PR comments is enabled ### SARIF report generation for upload to GitHub Advanced Security blackducksca_reports_sarif_create: true From 1ef3cf61f0efe6a06e9a5a35544590da05edafd4 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Tue, 18 Aug 2026 10:32:28 -0700 Subject: [PATCH 09/36] fix: addres PR comments --- .../workflows/black-duck-security-scan-ci.yml | 34 ++++++++++++++----- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 8b77cab..1962c18 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -21,18 +21,36 @@ on: # Declare default permissions as read only. permissions: read-all +concurrency: + group: blackduck-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + jobs: build: runs-on: ubuntu-latest permissions: - contents: read + contents: write pull-requests: write security-events: write actions: read + env: + DETECT_PROJECT_NAME: ARM:MCP steps: - name: Checkout source uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Set repository reference + run: | + ver_to_reference="${{ github.ref_name }}" + + # Replace / with - to avoid issues with Black Duck project version names + ver_to_reference="${ver_to_reference//\//-}" + echo "DETECT_PROJECT_VERSION_NAME=$ver_to_reference" >> $GITHUB_ENV + + # notice - highlighted in the gh actions UI + echo "::notice title=Black Duck target::${{ env.DETECT_PROJECT_NAME }} / $ver_to_reference" + - name: Black Duck SCA scan id: black-duck-full-scan if: ${{ github.event_name != 'pull_request' }} @@ -47,13 +65,9 @@ jobs: # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' detect_args: "--detect.accuracy.required=NONE" - ### FIX PULL REQUEST CREATION: Uncomment below to enable + ### FIX PULL REQUEST CREATION blackducksca_fixpr_enabled: true - github_token: ${{ secrets.GITHUB_TOKEN }} # Required when Fix PRs is enabled - - ### PULL REQUEST COMMENTS: Uncomment below to enable - blackducksca_prcomment_enabled: true - github_token: ${{ secrets.GITHUB_TOKEN }} # Required when PR comments is enabled + github_token: ${{ secrets.GITHUB_TOKEN }} ### SARIF report generation for upload to GitHub Advanced Security blackducksca_reports_sarif_create: true @@ -68,7 +82,7 @@ jobs: blackducksca_policy_badges_create: true blackducksca_policy_badges_maxCount: 5 - ### Uncomment below configuration if Bridge diagnostic files needs to be uploaded + ### To upload Bridge diagnostic files include_diagnostics: true - name: Upload Black Duck SARIF @@ -87,5 +101,9 @@ jobs: blackducksca_scan_full: false detect_args: "--detect.accuracy.required=NONE" + ### PULL REQUEST COMMENTS + blackducksca_prcomment_enabled: true + github_token: ${{ secrets.GITHUB_TOKEN }} + ### Mark build status if policy violating issues are found mark_build_status: 'success' From 36049723ee615575a03a2871367f881d1d883dfc Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Tue, 18 Aug 2026 10:46:35 -0700 Subject: [PATCH 10/36] test: with existing UI version --- .github/workflows/black-duck-security-scan-ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 1962c18..8cf6bba 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -45,7 +45,8 @@ jobs: ver_to_reference="${{ github.ref_name }}" # Replace / with - to avoid issues with Black Duck project version names - ver_to_reference="${ver_to_reference//\//-}" + # ver_to_reference="${ver_to_reference//\//-}" + ver_to_reference="0.0" echo "DETECT_PROJECT_VERSION_NAME=$ver_to_reference" >> $GITHUB_ENV # notice - highlighted in the gh actions UI From d3e6199114df6e5cfa52e515fb25344726916257 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Tue, 18 Aug 2026 10:57:33 -0700 Subject: [PATCH 11/36] test: Blackduck UI report upload --- .github/workflows/black-duck-security-scan-ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 8cf6bba..fd2ae94 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -54,7 +54,7 @@ jobs: - name: Black Duck SCA scan id: black-duck-full-scan - if: ${{ github.event_name != 'pull_request' }} + if: ${{ github.event_name == 'pull_request' }} uses: blackduck-inc/black-duck-security-scan@152247222aa9cd38124acd5c0cf60f4db71adc3f # v2.11.0 with: ### ---------- BLACKDUCK SCA SCANNING: REQUIRED FIELDS ---------- @@ -87,14 +87,14 @@ jobs: include_diagnostics: true - name: Upload Black Duck SARIF - if: ${{ github.event_name != 'pull_request' }} + if: ${{ github.event_name == 'pull_request' }} uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: sarif_file: blackduck-results.sarif - name: Black Duck SCA PR Scan id: black-duck-pr-scan - if: ${{ github.event_name == 'pull_request' }} + if: ${{ github.event_name != 'pull_request' }} uses: blackduck-inc/black-duck-security-scan@152247222aa9cd38124acd5c0cf60f4db71adc3f # v2.11.0 with: blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} From 962822b98413f6171186d846e36b0260d24616ac Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 17:58:15 +0000 Subject: [PATCH 12/36] Black Duck: Black Duck SCA Policy Badges: Update README.md [skip ci] --- README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.md b/README.md index 43c6951..8728b25 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,9 @@ # Arm MCP Server + + + + + An [MCP](https://modelcontextprotocol.io/) server providing AI assistants with tools and knowledge for Arm architecture development, migration, and optimization. From 6b4c6e498002b4d130785c54fcd4d30913954d97 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Tue, 18 Aug 2026 11:05:16 -0700 Subject: [PATCH 13/36] test: change upload report mechanism --- .github/workflows/black-duck-security-scan-ci.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index fd2ae94..9102691 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -74,7 +74,7 @@ jobs: blackducksca_reports_sarif_create: true blackducksca_reports_sarif_file_path: blackduck-results.sarif ### Set upload to false & then later upload via github/codeql-action/upload-sarif@v4.37.4 to avoid token-permissions issue flagged by scorecard - blackducksca_upload_sarif_report: false + blackducksca_upload_sarif_report: true ### Mark build status if policy violating issues are found mark_build_status: 'success' @@ -86,11 +86,11 @@ jobs: ### To upload Bridge diagnostic files include_diagnostics: true - - name: Upload Black Duck SARIF - if: ${{ github.event_name == 'pull_request' }} - uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 - with: - sarif_file: blackduck-results.sarif + ###- name: Upload Black Duck SARIF + #if: ${{ github.event_name == 'pull_request' }} + #uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + #with: + # sarif_file: blackduck-results.sarif - name: Black Duck SCA PR Scan id: black-duck-pr-scan From b167ca119bb0012c867bf60e8ea301ba79cf6704 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 18:13:48 +0000 Subject: [PATCH 14/36] Black Duck: Black Duck SCA Policy Badges: Update README.md [skip ci] --- README.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/README.md b/README.md index 8728b25..5c4f2f2 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,6 @@ # Arm MCP Server - - - + An [MCP](https://modelcontextprotocol.io/) server providing AI assistants with tools and knowledge for Arm architecture development, migration, and optimization. From 118e40c97f639da0301a7481478631311737120f Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Tue, 18 Aug 2026 12:22:40 -0700 Subject: [PATCH 15/36] test:report upload --- .../workflows/black-duck-security-scan-ci.yml | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 9102691..2f35348 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -84,7 +84,7 @@ jobs: blackducksca_policy_badges_maxCount: 5 ### To upload Bridge diagnostic files - include_diagnostics: true + include_diagnostics: false ###- name: Upload Black Duck SARIF #if: ${{ github.event_name == 'pull_request' }} @@ -92,19 +92,19 @@ jobs: #with: # sarif_file: blackduck-results.sarif - - name: Black Duck SCA PR Scan - id: black-duck-pr-scan - if: ${{ github.event_name != 'pull_request' }} - uses: blackduck-inc/black-duck-security-scan@152247222aa9cd38124acd5c0cf60f4db71adc3f # v2.11.0 - with: - blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} - blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} - blackducksca_scan_full: false - detect_args: "--detect.accuracy.required=NONE" + ###- name: Black Duck SCA PR Scan + #id: black-duck-pr-scan + #if: ${{ github.event_name == 'pull_request' }} + #uses: blackduck-inc/black-duck-security-scan@152247222aa9cd38124acd5c0cf60f4db71adc3f # v2.11.0 + #with: + #blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} + #blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} + #blackducksca_scan_full: false + #detect_args: "--detect.accuracy.required=NONE" ### PULL REQUEST COMMENTS - blackducksca_prcomment_enabled: true - github_token: ${{ secrets.GITHUB_TOKEN }} + #blackducksca_prcomment_enabled: true + #github_token: ${{ secrets.GITHUB_TOKEN }} ### Mark build status if policy violating issues are found - mark_build_status: 'success' + #mark_build_status: 'success' From e95818c32b7ef36f5723eef8933a83ff3e83b29c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 19:23:25 +0000 Subject: [PATCH 16/36] Black Duck: Black Duck SCA Policy Badges: Update README.md [skip ci] From e064a7aca9221982b93726b7238ca2307fb8262a Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Tue, 18 Aug 2026 12:25:27 -0700 Subject: [PATCH 17/36] test:minimal scan --- .github/workflows/black-duck-security-scan-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 2f35348..792e3f1 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -60,7 +60,7 @@ jobs: ### ---------- BLACKDUCK SCA SCANNING: REQUIRED FIELDS ---------- blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} - blackducksca_scan_full: true + blackducksca_scan_full: false ### SCANNING: Optional fields # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' From 6cccc6aa532d37c4090acae6f34c2d1df7f4201b Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 19:26:17 +0000 Subject: [PATCH 18/36] Black Duck: Black Duck SCA Policy Badges: Update README.md [skip ci] From bbb3f15a0fb6523bccd16885e91152512c088e4f Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Tue, 18 Aug 2026 12:35:07 -0700 Subject: [PATCH 19/36] test: change versions --- .github/workflows/black-duck-security-scan-ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 792e3f1..50d9ade 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -38,7 +38,7 @@ jobs: steps: - name: Checkout source - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - name: Set repository reference run: | @@ -55,12 +55,12 @@ jobs: - name: Black Duck SCA scan id: black-duck-full-scan if: ${{ github.event_name == 'pull_request' }} - uses: blackduck-inc/black-duck-security-scan@152247222aa9cd38124acd5c0cf60f4db71adc3f # v2.11.0 + uses: blackduck-inc/black-duck-security-scan@b6f87e0cec75fc586a22ce6e076e3b9d691b685a # v2.5.0 with: ### ---------- BLACKDUCK SCA SCANNING: REQUIRED FIELDS ---------- blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} - blackducksca_scan_full: false + blackducksca_scan_full: true ### SCANNING: Optional fields # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' From a45cf6bab4d4f6e1932d5b8441f7b734fe3ecc78 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 19:35:53 +0000 Subject: [PATCH 20/36] Black Duck: Black Duck SCA Policy Badges: Update README.md [skip ci] From 7f2048cdacbcc557ddcec2adfb5cef50ebdfd69e Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Tue, 18 Aug 2026 12:45:30 -0700 Subject: [PATCH 21/36] test: change version --- .github/workflows/black-duck-security-scan-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 50d9ade..76f9380 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -46,7 +46,7 @@ jobs: # Replace / with - to avoid issues with Black Duck project version names # ver_to_reference="${ver_to_reference//\//-}" - ver_to_reference="0.0" + ver_to_reference="1.0" echo "DETECT_PROJECT_VERSION_NAME=$ver_to_reference" >> $GITHUB_ENV # notice - highlighted in the gh actions UI From 6cbfeef3408b41af4c286109cc32a35d5dbe1308 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 19:46:14 +0000 Subject: [PATCH 22/36] Black Duck: Black Duck SCA Policy Badges: Update README.md [skip ci] From 25e9bc192fe76b388e0b8cc7e60135154a578e44 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Tue, 18 Aug 2026 13:03:04 -0700 Subject: [PATCH 23/36] test: add diagnostic --- .github/workflows/black-duck-security-scan-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 76f9380..6e6b631 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -64,7 +64,7 @@ jobs: ### SCANNING: Optional fields # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' - detect_args: "--detect.accuracy.required=NONE" + detect_args: "--detect.accuracy.required=NONE --detect.diagnostic=true" ### FIX PULL REQUEST CREATION blackducksca_fixpr_enabled: true From da49c2c30d5b3a900556afbff23fc42a2ade5207 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 20:03:43 +0000 Subject: [PATCH 24/36] Black Duck: Black Duck SCA Policy Badges: Update README.md [skip ci] From 7a9427b299ab16d36ea193a6fce6b4cc57f0ab64 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Wed, 19 Aug 2026 08:53:28 -0700 Subject: [PATCH 25/36] test: comment out params requiring authorization --- .github/workflows/black-duck-security-scan-ci.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 6e6b631..445116f 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -67,21 +67,21 @@ jobs: detect_args: "--detect.accuracy.required=NONE --detect.diagnostic=true" ### FIX PULL REQUEST CREATION - blackducksca_fixpr_enabled: true - github_token: ${{ secrets.GITHUB_TOKEN }} + #blackducksca_fixpr_enabled: true + #github_token: ${{ secrets.GITHUB_TOKEN }} ### SARIF report generation for upload to GitHub Advanced Security - blackducksca_reports_sarif_create: true - blackducksca_reports_sarif_file_path: blackduck-results.sarif + #blackducksca_reports_sarif_create: true + #blackducksca_reports_sarif_file_path: blackduck-results.sarif ### Set upload to false & then later upload via github/codeql-action/upload-sarif@v4.37.4 to avoid token-permissions issue flagged by scorecard - blackducksca_upload_sarif_report: true + #blackducksca_upload_sarif_report: true ### Mark build status if policy violating issues are found mark_build_status: 'success' ### To enable Black Duck SCA policy badges - blackducksca_policy_badges_create: true - blackducksca_policy_badges_maxCount: 5 + #blackducksca_policy_badges_create: true + #blackducksca_policy_badges_maxCount: 5 ### To upload Bridge diagnostic files include_diagnostics: false From 8a6d04154e24c6d70c2941d3f484228c1be5e5e1 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Wed, 19 Aug 2026 09:00:21 -0700 Subject: [PATCH 26/36] test: pass project name version via args --- .github/workflows/black-duck-security-scan-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 445116f..be41a2b 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -64,7 +64,7 @@ jobs: ### SCANNING: Optional fields # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' - detect_args: "--detect.accuracy.required=NONE --detect.diagnostic=true" + detect_args: "--detect.project.name='ARM:MCP' --detect.project.version.name='1.0' --detect.accuracy.required=NONE --detect.diagnostic=true" ### FIX PULL REQUEST CREATION #blackducksca_fixpr_enabled: true From c0eace614ca10cbe652e0c1bc44954714fb1ade6 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Wed, 19 Aug 2026 09:03:18 -0700 Subject: [PATCH 27/36] test: change project name --- .github/workflows/black-duck-security-scan-ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index be41a2b..5cf65c3 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -34,7 +34,7 @@ jobs: security-events: write actions: read env: - DETECT_PROJECT_NAME: ARM:MCP + DETECT_PROJECT_NAME: Arm:MCP steps: - name: Checkout source @@ -64,7 +64,7 @@ jobs: ### SCANNING: Optional fields # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' - detect_args: "--detect.project.name='ARM:MCP' --detect.project.version.name='1.0' --detect.accuracy.required=NONE --detect.diagnostic=true" + detect_args: "--detect.project.name='Arm:MCP' --detect.project.version.name='1.0' --detect.accuracy.required=NONE --detect.diagnostic=true" ### FIX PULL REQUEST CREATION #blackducksca_fixpr_enabled: true From 051ca834aa1e7e5f21e34deded1aaa25f01455cf Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Wed, 19 Aug 2026 09:34:04 -0700 Subject: [PATCH 28/36] test: revert back reporting changes --- .../workflows/black-duck-security-scan-ci.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 5cf65c3..a2d5810 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -64,24 +64,24 @@ jobs: ### SCANNING: Optional fields # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' - detect_args: "--detect.project.name='Arm:MCP' --detect.project.version.name='1.0' --detect.accuracy.required=NONE --detect.diagnostic=true" + detect_args: "--detect.accuracy.required=NONE --detect.diagnostic=true" ### FIX PULL REQUEST CREATION - #blackducksca_fixpr_enabled: true - #github_token: ${{ secrets.GITHUB_TOKEN }} + blackducksca_fixpr_enabled: true + github_token: ${{ secrets.GITHUB_TOKEN }} ### SARIF report generation for upload to GitHub Advanced Security - #blackducksca_reports_sarif_create: true - #blackducksca_reports_sarif_file_path: blackduck-results.sarif + blackducksca_reports_sarif_create: true + blackducksca_reports_sarif_file_path: blackduck-results.sarif ### Set upload to false & then later upload via github/codeql-action/upload-sarif@v4.37.4 to avoid token-permissions issue flagged by scorecard - #blackducksca_upload_sarif_report: true + blackducksca_upload_sarif_report: true ### Mark build status if policy violating issues are found mark_build_status: 'success' ### To enable Black Duck SCA policy badges - #blackducksca_policy_badges_create: true - #blackducksca_policy_badges_maxCount: 5 + blackducksca_policy_badges_create: true + blackducksca_policy_badges_maxCount: 5 ### To upload Bridge diagnostic files include_diagnostics: false From ec10260fe53cf238ae46688717e87b49f615a648 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 16:35:15 +0000 Subject: [PATCH 29/36] Black Duck: Black Duck SCA Policy Badges: Update README.md [skip ci] From b5c0f16985de69ea3c0258a2489adffa76c02776 Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Wed, 19 Aug 2026 09:38:23 -0700 Subject: [PATCH 30/36] test: revert report upload changes --- .github/workflows/black-duck-security-scan-ci.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index a2d5810..348c041 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -74,7 +74,7 @@ jobs: blackducksca_reports_sarif_create: true blackducksca_reports_sarif_file_path: blackduck-results.sarif ### Set upload to false & then later upload via github/codeql-action/upload-sarif@v4.37.4 to avoid token-permissions issue flagged by scorecard - blackducksca_upload_sarif_report: true + blackducksca_upload_sarif_report: false ### Mark build status if policy violating issues are found mark_build_status: 'success' @@ -86,11 +86,11 @@ jobs: ### To upload Bridge diagnostic files include_diagnostics: false - ###- name: Upload Black Duck SARIF - #if: ${{ github.event_name == 'pull_request' }} - #uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 - #with: - # sarif_file: blackduck-results.sarif + - name: Upload Black Duck SARIF + if: ${{ github.event_name == 'pull_request' }} + uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + with: + sarif_file: blackduck-results.sarif ###- name: Black Duck SCA PR Scan #id: black-duck-pr-scan From f59bac22cca2c3a54813354d33507dba3773a865 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 16:39:33 +0000 Subject: [PATCH 31/36] Black Duck: Black Duck SCA Policy Badges: Update README.md [skip ci] From 4254c44fcd3ee3eca40caae4c92386753238815c Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Wed, 19 Aug 2026 09:41:02 -0700 Subject: [PATCH 32/36] fix: change path --- .github/workflows/black-duck-security-scan-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 348c041..d77c661 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -72,7 +72,7 @@ jobs: ### SARIF report generation for upload to GitHub Advanced Security blackducksca_reports_sarif_create: true - blackducksca_reports_sarif_file_path: blackduck-results.sarif + #blackducksca_reports_sarif_file_path: blackduck-results.sarif ### Set upload to false & then later upload via github/codeql-action/upload-sarif@v4.37.4 to avoid token-permissions issue flagged by scorecard blackducksca_upload_sarif_report: false From d26c2cad00ed651f81fca994ca3ec020bd0efa9d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 16:42:14 +0000 Subject: [PATCH 33/36] Black Duck: Black Duck SCA Policy Badges: Update README.md [skip ci] From 027a83894c4ca183aa6a18d3a72cd268bb1a554c Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Wed, 19 Aug 2026 09:45:30 -0700 Subject: [PATCH 34/36] test: add sarif path --- .github/workflows/black-duck-security-scan-ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index d77c661..4d13dfc 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -72,7 +72,7 @@ jobs: ### SARIF report generation for upload to GitHub Advanced Security blackducksca_reports_sarif_create: true - #blackducksca_reports_sarif_file_path: blackduck-results.sarif + blackducksca_reports_sarif_file_path: blackduck-results.sarif ### Set upload to false & then later upload via github/codeql-action/upload-sarif@v4.37.4 to avoid token-permissions issue flagged by scorecard blackducksca_upload_sarif_report: false @@ -84,7 +84,7 @@ jobs: blackducksca_policy_badges_maxCount: 5 ### To upload Bridge diagnostic files - include_diagnostics: false + include_diagnostics: true - name: Upload Black Duck SARIF if: ${{ github.event_name == 'pull_request' }} From 1c236429369502442bc3fe9155492dd29ee1f2ce Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 16:47:19 +0000 Subject: [PATCH 35/36] Black Duck: Black Duck SCA Policy Badges: Update README.md [skip ci] From f467aea7e475af59722205e5ff63325fc9b169eb Mon Sep 17 00:00:00 2001 From: Neethu Elizabeth Simon Date: Wed, 19 Aug 2026 11:11:24 -0700 Subject: [PATCH 36/36] fix: revert testing changes --- .../workflows/black-duck-security-scan-ci.yml | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/black-duck-security-scan-ci.yml b/.github/workflows/black-duck-security-scan-ci.yml index 4d13dfc..4c16981 100644 --- a/.github/workflows/black-duck-security-scan-ci.yml +++ b/.github/workflows/black-duck-security-scan-ci.yml @@ -54,8 +54,8 @@ jobs: - name: Black Duck SCA scan id: black-duck-full-scan - if: ${{ github.event_name == 'pull_request' }} - uses: blackduck-inc/black-duck-security-scan@b6f87e0cec75fc586a22ce6e076e3b9d691b685a # v2.5.0 + if: ${{ github.event_name != 'pull_request' }} + uses: blackduck-inc/black-duck-security-scan@152247222aa9cd38124acd5c0cf60f4db71adc3f # v2.11.0 with: ### ---------- BLACKDUCK SCA SCANNING: REQUIRED FIELDS ---------- blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} @@ -64,7 +64,7 @@ jobs: ### SCANNING: Optional fields # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' - detect_args: "--detect.accuracy.required=NONE --detect.diagnostic=true" + detect_args: "--detect.accuracy.required=NONE" ### FIX PULL REQUEST CREATION blackducksca_fixpr_enabled: true @@ -87,24 +87,24 @@ jobs: include_diagnostics: true - name: Upload Black Duck SARIF - if: ${{ github.event_name == 'pull_request' }} + if: ${{ github.event_name != 'pull_request' }} uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: sarif_file: blackduck-results.sarif - ###- name: Black Duck SCA PR Scan - #id: black-duck-pr-scan - #if: ${{ github.event_name == 'pull_request' }} - #uses: blackduck-inc/black-duck-security-scan@152247222aa9cd38124acd5c0cf60f4db71adc3f # v2.11.0 - #with: - #blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} - #blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} - #blackducksca_scan_full: false - #detect_args: "--detect.accuracy.required=NONE" + - name: Black Duck SCA PR Scan + id: black-duck-pr-scan + if: ${{ github.event_name == 'pull_request' }} + uses: blackduck-inc/black-duck-security-scan@152247222aa9cd38124acd5c0cf60f4db71adc3f # v2.11.0 + with: + blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} + blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} + blackducksca_scan_full: false + detect_args: "--detect.accuracy.required=NONE" ### PULL REQUEST COMMENTS - #blackducksca_prcomment_enabled: true - #github_token: ${{ secrets.GITHUB_TOKEN }} + blackducksca_prcomment_enabled: true + github_token: ${{ secrets.GITHUB_TOKEN }} ### Mark build status if policy violating issues are found - #mark_build_status: 'success' + mark_build_status: 'success'