veracode.yml

################################################################################
# Copyright (c) 2021-2022 Contributors to the Eclipse Foundation

# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.

# This program and the accompanying materials are made available under the
# terms of the Apache License, Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0.

# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.

# SPDX-License-Identifier: Apache-2.0
################################################################################
---

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Veracode 

# run on manual trigger or once a week
on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * *"
    
jobs:
  static_analysis:
    name: Static Analysis
    runs-on: ubuntu-latest
    
    steps:
      - name: Check out main branch
        uses: actions/checkout@v3

      - name: Zip Sources for Static Analysis
        run: yarn build:sources
        
      - name: Veracode Upload And Scan
        uses: veracode/veracode-uploadandscan-action@0.2.1
        with:
          appname: 'DFT Frontend'
          createprofile: false
          filepath: 'product-dft-frontend.zip'
          vid: '${{ secrets.ORG_VERACODE_API_ID }}'
          vkey: '${{ secrets.ORG_VERACODE_API_KEY }}'