From b2a8ff9bb06bfdcf2acca6567afa6532ec512893 Mon Sep 17 00:00:00 2001
From: Matthias Franck <matthias.franck@softathome.com>
Date: Wed, 20 Aug 2025 16:08:49 +0200
Subject: [PATCH] ci: blackduck: move blackduck to separate job

let's move blackduck to a seperate job for easier maintenance.

References: PCF-1794

Signed-off-by: Matthias Franck <matthias.franck@softathome.com>
---
 .gitlab-ci.yml                    |  5 +++++
 .gitlab/blackduck.yml             | 17 +++++++++++++++++
 .gitlab/build.yml                 |  7 +------
 .gitlab/docker/builder/Dockerfile |  1 -
 4 files changed, 23 insertions(+), 7 deletions(-)
 create mode 100644 .gitlab/blackduck.yml

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 4a74aafdcb..dce34cb333 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,6 +4,7 @@ variables:
 
 include:
   - local: .gitlab/build.yml
+  - local: .gitlab/blackduck.yml
   - local: .gitlab/release.yml
   - local: .gitlab/cdrouter.yml
   - local: .gitlab/prplmesh.yml
@@ -41,6 +42,7 @@ stages:
   - certification tests
   - cdrouter
   - coverity
+  - blackduck
 
 build test mxl_x86_osp_tb341_v2 mxl_wlan_hostap_ng_wav700 prpl cellular security thread:
   extends: .build test config
@@ -76,6 +78,9 @@ coverity scan qca_ipq95xx prpl extender_full cellular thread:
       aarch64-openwrt-linux-gcc
       aarch64-openwrt-linux-musl-gcc
 
+blackduck scan qca_ipq95xx prpl cellular security thread:
+  extends: .blackduck scan config
+
 run test Turris Omnia initramfs:
   allow_failure: true
   needs: ["build test mvebu prpl security"]
diff --git a/.gitlab/blackduck.yml b/.gitlab/blackduck.yml
new file mode 100644
index 0000000000..ed15789d62
--- /dev/null
+++ b/.gitlab/blackduck.yml
@@ -0,0 +1,17 @@
+.blackduck scan config:
+  extends: .build test config
+  stage: blackduck
+  needs: []
+  rules:
+    - when: manual
+  before_script:
+    - touch .build_failed
+    - export CI_BUILD_PROFILE="$(echo $CI_JOB_NAME | sed 's/blackduck scan \(.*\)/\1/')"
+  script:
+    - !reference [.build test config, script]
+    - target_name=$(sed -n 's/.*CONFIG_TARGET_BOARD="\([^"]\+\)".*/\1/p' .config)
+    - sudo apt update
+    - sudo apt install openjdk-17-jdk -y
+    - cd build_dir/target-*
+    - rm -rf linux-*
+    - bash <(curl -s -L https://detect.blackduck.com/detect10.sh) --blackduck.url=https://prplfoundation.app.blackduck.com --blackduck.api.token=$BLACKDUCK_API_KEY --detect.project.name=$CI_COMMIT_REF_NAME --detect.project.version.name=$target_name
diff --git a/.gitlab/build.yml b/.gitlab/build.yml
index 0a6d43affa..f2adb13cec 100644
--- a/.gitlab/build.yml
+++ b/.gitlab/build.yml
@@ -15,6 +15,7 @@
     - when: manual
   before_script:
     - touch .build_failed
+    - export CI_BUILD_PROFILE="$(echo $CI_JOB_NAME | sed 's/build test \(.*\)/\1/')"
 
   script:
     - source .gitlab/scripts/helpers.sh
@@ -136,12 +137,6 @@
       fi
     - section_end "export-rootfs"
     - rm .build_failed
-    - sbom=$(find bin/targets* -name prplos-*.bom.cdx.json)
-    - target_name=$(echo "$sbom" | sed -n 's/.*prplos-\(.*\)\.bom\.cdx\.json$/\1/p')
-    - sudo apt update
-    - sudo apt install openjdk-17-jdk -y
-    - cd build_dir/target-*
-    - bash <(curl -s -L https://detect.blackduck.com/detect10.sh) --blackduck.url=https://prplfoundation.app.blackduck.com --blackduck.api.token=$BLACKDUCK_API_KEY --detect.project.name=$CI_COMMIT_REF_NAME --detect.project.version.name=$target_name
 
   after_script:
     - >
diff --git a/.gitlab/docker/builder/Dockerfile b/.gitlab/docker/builder/Dockerfile
index 4f674cefa7..6cb80b8dc2 100644
--- a/.gitlab/docker/builder/Dockerfile
+++ b/.gitlab/docker/builder/Dockerfile
@@ -18,7 +18,6 @@ RUN \
 	libncurses5-dev \
 	locales \
 	nmap \
-	openjdk-17-jdk \
 	openssh-client \
 	pwgen \
 	python3 \