veracode-scan.yml

name: veracode-scan

on:
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
  schedule:
    - cron: '0 16 * * 6'

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up JDK 8
      uses: actions/setup-java@v4
      with:
        java-version: '8'
        distribution: 'temurin'

    - name: Build project
      run: mvn -B package -Dmaven.test.skip=true --file pom.xml

    - name: Veracode static application security testing (SAST)
      uses: veracode/veracode-uploadandscan-action@0.2.10
      with:
        appname: 'lf-repository-api-client-java'
        createprofile: true
        filepath: 'target'
        vid: '${{ secrets.VERACODE_API_ID }}'
        vkey: '${{ secrets.VERACODE_API_KEY }}'

    - name: Run Veracode Software Composition Analysis (SCA)
      env:
        SRCCLR_API_TOKEN: ${{ secrets.SRCCLR_API_TOKEN }}
      run: curl --silent --show-error --location https://download.sourceclear.com/ci.sh | sh -s -- scan ./ --update-advisor --allow-dirty