Fix blackduck sca scan getting skipped

.github/workflows/ci-main-pull-request.yml

@@ -101,6 +101,11 @@ on:
         required: false
         type: boolean
         default: true
+      trivy-fail-on-high-critical:
+        description: 'Fail pipeline if Trivy finds HIGH or CRITICAL vulnerabilities'
+        required: false
+        type: boolean
+        default: false
 
       build:
         description: 'CI Build (language-specific)'
@@ -164,15 +169,15 @@ on:
         type: string
       polaris-coverity-clean-command:
         # NEW IN 1.0.7
-        description: 'Coverity clean command, typically done before build stage by language or here as param 1-liner like "mvn clean"'
+        description: 'Coverity clean command, typically done before build stage by language or here as param 1-liner like "mvn clean". Leave empty for buildless analysis (Ruby, Python, etc.)'
         required: false
-        default: 'go clean'
+        default: ''
         type: string
       polaris-coverity-build-command:
         # NEW IN 1.0.7
-        description: 'Coverity build command, typically done in build stage by language or here as param 1-liner like "mvn clean install"'
+        description: 'Coverity build command, typically done in build stage by language or here as param 1-liner like "mvn clean install". Leave empty for buildless analysis (Ruby, Python, etc.)'
         required: false
-        default: 'go build'
+        default: ''
         type: string
       polaris-coverity-args:
         # NEW IN 1.0.7
@@ -369,6 +374,11 @@ on:
         required: false
         type: boolean
         default: false
+      ruby-app-directory:
+        description: 'Subdirectory containing Ruby Gemfile (e.g., "src/supermarket" for repos with non-root Gemfile location). Leave empty if Gemfile is in root.'
+        required: false
+        type: string
+        default: ''
 
       udf1:
         description: 'User defined flag 1'
@@ -715,6 +725,7 @@ jobs:
     needs: checkout
     with:
       version: ${{ inputs.version }}
+      fail-on-high-critical: ${{ inputs.trivy-fail-on-high-critical }}
 
     # run-srcclr:
     #   if: ${{ inputs.perform-srcclr-scan == true }}
@@ -743,6 +754,11 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
+      - name: Configure git for private Go modules
+        if: inputs.language == 'go'
+        env:
+          GOPRIVATE: ${{ inputs.go-private-modules }}
+        run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"
       - name: 'Go build'
         if: ${{ inputs.language == 'go' && env.GA_BUILD_PROFILE == 'cli' }}
         continue-on-error: true
@@ -1008,6 +1024,55 @@ jobs:
     runs-on: ubuntu-latest
     needs: checkout # TODO: fix set-application-version
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install build tools for Erlang
+        if: inputs.language == 'erlang'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential
+
+      - name: Set up Erlang/OTP and rebar3
+        if: inputs.language == 'erlang'
+        uses: erlef/setup-beam@v1
+        with:
+          otp-version: '25.3.2.16'
+          rebar3-version: '3.22.0'
+
+      - name: Set up Ruby
+        if: inputs.language == 'ruby'
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.4'
+          bundler-cache: false
+
+      - name: Create bundle stub for Erlang SAST scan
+        if: inputs.language == 'erlang'
+        working-directory: ${{ github.workspace }}
+        run: |
+          # Polaris scans Erlang source code for SAST - Ruby gems not needed
+          # System ruby-dev from apt provides Ruby runtime (already installed)
+          # Create bundle stub to skip gem installation during Polaris scan
+          echo "Creating bundle stub to bypass Ruby gem installation"
+
+          # Create no-op bundle script
+          mkdir -p "$HOME/.polaris-stubs"
+          cat > "$HOME/.polaris-stubs/bundle" << 'EOF'
+          #!/bin/bash
+          # Stub: skips gem installation during SAST scan
+          echo "[STUB] Skipping bundle $@ - not needed for Erlang SAST"
+          exit 0
+          EOF
+          chmod +x "$HOME/.polaris-stubs/bundle"
+
+          # Prepend to PATH so stub is found before any system bundler
+          echo "$HOME/.polaris-stubs" >> $GITHUB_PATH
+
+          echo "Bundle stub created and added to PATH"
+
       - name: Starting Black Duck Polaris scan
         run: |
           echo "Starting Polaris SAST scan"
@@ -1069,7 +1134,7 @@ jobs:
           #   polaris_upload_sarif_report: true
           # Mark build status if policy violating issues are found
           #   mark_build_status: 'success'
-        continue-on-error: true
+        continue-on-error: false
 
   package-binary:
     name: 'Creating packaged binaries'
@@ -1317,7 +1382,7 @@ jobs:
     #    Create software bill-of-materials (SBOM) using SPDX format
     if: ${{ inputs.generate-sbom == true }}
     uses: chef/common-github-actions/.github/workflows/sbom.yml@main
-    needs: ci-build
+    needs: checkout # TODO: fix set-application-version
     secrets: inherit
     with:
       version: ${{ inputs.version }}
@@ -1332,6 +1397,7 @@ jobs:
       blackduck-force-low-accuracy-mode: ${{ inputs.blackduck-force-low-accuracy-mode }}
       run-bundle-install: ${{ inputs.run-bundle-install }} # Passed to sbom.yml to generate Gemfile.lock at runtime
       language: ${{ inputs.language }}
+      ruby-app-directory: ${{ inputs.ruby-app-directory }}
 
   quality-dashboard:
     name: 'Reporting to quality dashboard'

.github/workflows/sbom.yml

@@ -77,6 +77,11 @@ on:
         required: false
         type: string
         default: 'ruby'
+      ruby-app-directory:
+        description: 'Subdirectory containing Ruby Gemfile (e.g., "src/supermarket" for repos with non-root Gemfile location). Leave empty if Gemfile is in root.'
+        required: false
+        type: string
+        default: ''
 
 env:
   # Set the default SBOM filename prefix
@@ -203,11 +208,19 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Ruby and run bundle install
-        if: ${{ inputs.language == 'ruby' }} # only run for Ruby projects where we need to generate Gemfile.lock at runtime, inputs.run-bundle-install == true 
+        if: inputs.language == 'ruby'
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: '3.4'
-          bundler-cache: true
+          ruby-version: '3.4.2'
+          bundler-cache: false
+          working-directory: ${{ inputs.ruby-app-directory != '' && inputs.ruby-app-directory || '.' }}
+
+      - name: Set up Erlang/OTP and rebar3
+        if: inputs.language == 'erlang'
+        uses: erlef/setup-beam@v1
+        with:
+          otp-version: '25.3.2.16'
+          rebar3-version: '3.22.0'
 
       - name: Configure git for private Go modules
         if : ${{ inputs.go-private-modules != '' }}
@@ -218,6 +231,7 @@ jobs:
       - name: generate Gemfile.lock if needed for Ruby projects
         if: ${{ inputs.run-bundle-install == true && inputs.language == 'ruby' }} 
         continue-on-error: true
+        working-directory: ${{ inputs.ruby-app-directory != '' && inputs.ruby-app-directory || '.' }}
         run: |
           if [ ! -f Gemfile.lock ]; then
             bundle install 
@@ -228,7 +242,7 @@ jobs:
         uses: actions/upload-artifact@v4
         continue-on-error: true
         with:
-          path: Gemfile.lock
+          path: ${{ inputs.ruby-app-directory != '' && format('{0}/Gemfile.lock', inputs.ruby-app-directory) || 'Gemfile.lock' }}
           name: ${{ github.event.repository.name }}-Gemfile-lock.txt 
 
       - name: BlackDuck SCA scan
@@ -242,7 +256,8 @@ jobs:
         with:
           blackducksca_url: ${{ secrets.BLACKDUCK_SBOM_URL }}  # BLACKDUCK_URL, should be https://progresssoftware.app.blackduck.com/ 
           blackducksca_token: ${{ secrets.BLACKDUCK_SCA_TOKEN }}  # was BLACKDUCK_API_KEY
-          detect_args: ${{ inputs.blackduck-force-low-accuracy-mode == true && '--detect.excluded.detector.types=PIP --detect.accuracy.required=NONE' || '--detect.excluded.detector.types=PIP' }}
+          blackducksca_scan_full: true  # Force INTELLIGENT scan mode for all branches (uploads results to server)
+          detect_args: ${{ inputs.ruby-app-directory != '' && format('{0} --detect.source.path={1}', inputs.blackduck-force-low-accuracy-mode == true && '--detect.excluded.detector.types=PIP --detect.accuracy.required=NONE' || '--detect.excluded.detector.types=PIP', inputs.ruby-app-directory) || (inputs.blackduck-force-low-accuracy-mode == true && '--detect.excluded.detector.types=PIP --detect.accuracy.required=NONE' || '--detect.excluded.detector.types=PIP') }}
           # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL'
           # ignore python per https://documentation.blackduck.com/bundle/detect/page/packagemgrs/python.html
 

.github/workflows/trivy.yml

@@ -15,6 +15,11 @@ on:
         required: false
         type: string
         default: '1.0.0'
+      fail-on-high-critical:
+        description: 'Fail the build if HIGH or CRITICAL vulnerabilities are found'
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   trivy:
@@ -67,14 +72,16 @@ jobs:
           # name: trivy-report-${{ github.event.repository.name }}-${{ github.ref_name }}-${{ inputs.version }}-$(date +'%Y%m%d')-text
           path: trivy-report.txt
           retention-days: 30
-          #   - name: Fail build on High/Criticial Vulnerabilities
-        #     uses: aquasecurity/trivy-action@master
-        #     with:
-        #       scan-type: "fs"
-        #       format: table
-        #       scan-ref: .
-        #       severity: HIGH,CRITICAL
-        #       ignore-unfixed: true
-        #       exit-code: 1
-        #       # On a subsequent call to the action we know trivy is already installed so can skip this
-        #       skip-setup-trivy: true
+
+      - name: Fail build on High/Critical Vulnerabilities
+        if: ${{ inputs.fail-on-high-critical }}
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: "fs"
+          format: table
+          scan-ref: .
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          exit-code: 1
+          # On a subsequent call to the action we know trivy is already installed so can skip this
+          skip-setup-trivy: true