veracode.yml

#
#  Copyright (c) 2021, 2023 Contributors to the Eclipse Foundation
#
#  See the NOTICE file(s) distributed with this work for additional
#  information regarding copyright ownership.
#
#  This program and the accompanying materials are made available under the
#  terms of the Apache License, Version 2.0 which is available at
#  https://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#  License for the specific language governing permissions and limitations
#  under the License.
#
#  SPDX-License-Identifier: Apache-2.0
#

---
name: "Veracode"

on:
  schedule:
    - cron: '0 2 * * *'
  workflow_dispatch:

jobs:
  secret-presence:
    runs-on: ubuntu-latest
    outputs:
      ORG_VERACODE_API_ID: ${{ steps.secret-presence.outputs.ORG_VERACODE_API_ID }}
      ORG_VERACODE_API_KEY: ${{ steps.secret-presence.outputs.ORG_VERACODE_API_KEY }}
    steps:
      - name: Check whether secrets exist
        id: secret-presence
        run: |
          [ ! -z "${{ secrets.ORG_VERACODE_API_ID }}" ] && echo "ORG_VERACODE_API_ID=true" >> $GITHUB_OUTPUT
          [ ! -z "${{ secrets.ORG_VERACODE_API_KEY }}" ] && echo "ORG_VERACODE_API_KEY=true" >> $GITHUB_OUTPUT
          exit 0

  verify-formatting:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3.5.2
        with:
          fetch-depth: 0
      - uses: ./.github/actions/setup-java
      - name: Verify proper formatting
        run: ./mvnw spotless:check

  build:
    runs-on: ubuntu-latest
    needs: [ secret-presence, verify-formatting ]
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        variant: [ { dir: agent-plane, name: agentplane-azure-vault },
                   { dir: agent-plane, name: agentplane-hashicorp } ]
    steps:
      # Set-Up
      - uses: actions/checkout@v3.5.2
      - uses: ./.github/actions/setup-java
      # Build
      - name: Build ${{ matrix.variant.name }}
        run: |-
          ./mvnw -s settings.xml -pl ${{ matrix.variant.dir }}/${{ matrix.variant.name }} -am install
        env:
          GITHUB_ACTOR: ${{ github.actor }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Tar gzip files for veracode upload
        run: |-
          tar -czvf ${{ matrix.variant.dir }}/${{ matrix.variant.name }}/target/${{ matrix.variant.name }}.tar.gz ${{ matrix.variant.dir }}/${{ matrix.variant.name }}/target/${{ matrix.variant.name }}.jar ${{ matrix.variant.dir }}/${{ matrix.variant.name }}/target/lib/*.jar
      - name: Veracode Upload And Scan
        uses: veracode/veracode-uploadandscan-action@v1.0
        if: |
          needs.secret-presence.outputs.ORG_VERACODE_API_ID && needs.secret-presence.outputs.ORG_VERACODE_API_KEY
        continue-on-error: true
        with:
          appname: knowledge-agents-edc/${{ matrix.variant.name }}
          createprofile: true
          version: ${{ matrix.variant.name }}-${{ github.sha }}
          filepath: ${{ matrix.variant.dir }}/${{ matrix.variant.name }}/target/${{ matrix.variant.name }}.tar.gz
          vid: ${{ secrets.ORG_VERACODE_API_ID }}
          vkey: ${{ secrets.ORG_VERACODE_API_KEY }}