ac7b9ed88c
Replace manual trigger with label-based activation for BlackDuck scans on MRs. Jobs now run automatically when the 'ci:allow-expensive-jobs' label is added to the merge request, References: PCF-1794 Signed-off-by: Mouna Aloui <mouna.aloui@softathome.com>
30 lines
1.2 KiB
YAML
30 lines
1.2 KiB
YAML
.blackduck scan config:
|
|
extends: .build test config
|
|
stage: blackduck
|
|
timeout: 4 hours
|
|
needs: []
|
|
rules:
|
|
- if: $CI_COMMIT_REF_PROTECTED && $CI_COMMIT_TAG
|
|
- if: $CI_PIPELINE_SOURCE == "schedule"
|
|
- if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /ci::allow-expensive-jobs/'
|
|
before_script:
|
|
- touch .build_failed
|
|
- export CI_BUILD_PROFILE="$(echo $CI_JOB_NAME | sed 's/blackduck scan \(.*\)/\1/')"
|
|
script:
|
|
- !reference [.build test config, script]
|
|
- target_name=$(sed -n 's/.*CONFIG_TARGET_BOARD="\([^"]\+\)".*/\1/p' .config)
|
|
- sudo apt update
|
|
- sudo apt install openjdk-17-jdk -y
|
|
- curl -s --output detect.sh https://detect.blackduck.com/detect10.sh
|
|
- sudo chmod +x detect.sh
|
|
- |
|
|
for dir in $(ls -d build_dir/target-*/*); do
|
|
./detect.sh \
|
|
--blackduck.url=https://prplfoundation.app.blackduck.com \
|
|
--blackduck.api.token=$BLACKDUCK_API_KEY \
|
|
--detect.project.name=prplos \
|
|
--detect.project.version.name=$CI_COMMIT_REF_NAME-$target_name \
|
|
--detect.source.path=$dir \
|
|
--detect.excluded.detector.types=PIP,NPM 2>&1 | tee logs/blackduck.log
|
|
done
|