Ruby erlang (#36)

* Added support for ruby-erlang

Signed-off-by: shanmugapriya-tr <shanmugapriya.tiruchengoderamanathan@progress.com>

* Add debug output for language parameter and HEX detector exclusion

* Use ruby-erlang branch for sbom workflow to include HEX detector exclusion

* Fix BlackDuck policy violation count parsing to extract correct numbers

---------

Signed-off-by: shanmugapriya-tr <shanmugapriya.tiruchengoderamanathan@progress.com>

Author: shanmugapriya-tr

.github/workflows/sbom.yml

@@ -83,7 +83,7 @@ on:
         type: boolean
         default: false
       language:
-        description: 'Primary programming language of the project, used for SBOM enrichment (e.g., "ruby", "go", "python")'
+        description: 'Primary programming language of the project, used for SBOM enrichment (e.g., "ruby", "go", "python", "erlang", "ruby-erlang")'
         required: false
         type: string
         default: 'ruby'
@@ -234,15 +234,15 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Ruby and run bundle install
-        if: inputs.language == 'ruby'
+        if: inputs.language == 'ruby' || inputs.language == 'ruby-erlang'
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: '3.4.2'
           bundler-cache: false
           working-directory: ${{ inputs.ruby-app-directory != '' && inputs.ruby-app-directory || '.' }}
 
       - name: Configure Bundler for private Ruby gems
-        if: ${{ inputs.run-bundle-install == true && inputs.language == 'ruby' }}
+        if: ${{ inputs.run-bundle-install == true && (inputs.language == 'ruby' || inputs.language == 'ruby-erlang') }}
         run: |
           if [ -z "${{ secrets.PRIVATE_ACCESS_KITCHEN_CHEF_ENTERPRISE }}" ]; then
             echo "Skipping: PRIVATE_ACCESS_KITCHEN_CHEF_ENTERPRISE secret not configured or not in scope"
@@ -251,20 +251,28 @@ jobs:
           bundle config set --local github.com "x-access-token:${{ secrets.PRIVATE_ACCESS_KITCHEN_CHEF_ENTERPRISE }}"
 
       - name: Set up Erlang/OTP and rebar3
-        if: inputs.language == 'erlang'
+        if: inputs.language == 'erlang' || inputs.language == 'ruby-erlang'
         uses: erlef/setup-beam@v1
         with:
           otp-version: '25.3.2.16'
           rebar3-version: '3.22.0'
 
+      - name: Verify rebar3 installation and add to PATH
+        if: inputs.language == 'erlang' || inputs.language == 'ruby-erlang'
+        run: |
+          echo "Checking for rebar3..."
+          which rebar3 || echo "rebar3 not found in PATH"
+          rebar3 version || echo "rebar3 command failed"
+          echo "PATH: $PATH"
+
       - name: Configure git for private Go modules
         if : ${{ inputs.go-private-modules != '' }}
         env:
           GOPRIVATE: ${{ inputs.go-private-modules }}
         run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"
 
       - name: generate Gemfile.lock if needed for Ruby projects
-        if: ${{ inputs.run-bundle-install == true && inputs.language == 'ruby' }} 
+        if: ${{ inputs.run-bundle-install == true && (inputs.language == 'ruby' || inputs.language == 'ruby-erlang') }} 
         continue-on-error: true
         working-directory: ${{ inputs.ruby-app-directory != '' && inputs.ruby-app-directory || '.' }}
         run: |
@@ -273,7 +281,7 @@ jobs:
           fi
 
       - name: attach artifact for Gemfile.lock for debugging
-        if: ${{ inputs.language == 'ruby' }} 
+        if: ${{ inputs.language == 'ruby' || inputs.language == 'ruby-erlang' }} 
         uses: actions/upload-artifact@v4
         continue-on-error: true
         with:
@@ -283,9 +291,20 @@ jobs:
       - name: Construct BlackDuck detect arguments
         id: detect-args
         run: |
+          echo "DEBUG: Language parameter is: ${{ inputs.language }}"
+          
           # Start with base arguments (always exclude PIP detector)
           DETECT_ARGS="--detect.excluded.detector.types=PIP"
           
+          # For Erlang projects, also exclude HEX detector if rebar3 setup fails
+          # The Signature Scanner will still scan the code
+          if [[ "${{ inputs.language }}" == "erlang" || "${{ inputs.language }}" == "ruby-erlang" ]]; then
+            echo "DEBUG: Excluding HEX detector for Erlang project"
+            DETECT_ARGS="--detect.excluded.detector.types=PIP,HEX"
+          else
+            echo "DEBUG: Not an Erlang project, keeping default exclusions"
+          fi
+          
           # Add timeout configurations to prevent FAILURE_TIMEOUT errors
           DETECT_ARGS="${DETECT_ARGS} --detect.timeout=1800"
           
@@ -339,7 +358,7 @@ jobs:
       # Persists a baseline to the BlackDuck server so PR scans can diff against it.
       - name: BlackDuck SCA Full Scan
         id: blackduck-full-scan
-        if: ${{ inputs.github-event-name != 'pull_request' }}
+        if: ${{ inputs.github-event-name != 'pull_request' || inputs.github-event-name == 'workflow_dispatch' }}
         uses: blackduck-inc/black-duck-security-scan@v2.1.1
         continue-on-error: false
         env:
@@ -403,9 +422,10 @@ jobs:
             [ "${OTHER_COUNT:-0}" -gt 0 ] && CRITICAL_COUNT=$((CRITICAL_COUNT + OTHER_COUNT))
           elif grep -q "Policy Severity counts:" "$BRIDGE_LOG"; then
             # Full scan
-            BLOCKER_COUNT=$(grep "severity level of BLOCKER" "$BRIDGE_LOG" | grep -oE '^[0-9]+' || echo 0)
-            CRITICAL_COUNT=$(grep "severity level of CRITICAL" "$BRIDGE_LOG" | grep -oE '^[0-9]+' || echo 0)
-            MAJOR_COUNT=$(grep "severity level of MAJOR" "$BRIDGE_LOG" | grep -oE '^[0-9]+' || echo 0)
+            # Example log line: "--- Black Duck found: 1 component in violation (Policy Severity counts: 1 match has a severity level of UNSPECIFIED, 0 matches have a severity level of BLOCKER"
+            BLOCKER_COUNT=$(grep "severity level of BLOCKER" "$BRIDGE_LOG" | grep -oE '[0-9]+ matches have a severity level of BLOCKER' | grep -oE '^[0-9]+' || echo 0)
+            CRITICAL_COUNT=$(grep "severity level of CRITICAL" "$BRIDGE_LOG" | grep -oE '[0-9]+ matches have a severity level of CRITICAL' | grep -oE '^[0-9]+' || echo 0)
+            MAJOR_COUNT=$(grep "severity level of MAJOR" "$BRIDGE_LOG" | grep -oE '[0-9]+ matches have a severity level of MAJOR' | grep -oE '^[0-9]+' || echo 0)
           else
             echo "⚠️  No policy violation summary found in bridge.log"
             exit 0