Fix Synopsys workflow: remove spacing inconsistencies, replace placeholders, add error handling#10
Fix Synopsys workflow: remove spacing inconsistencies, replace placeholders, add error handling#10Copilot wants to merge 2 commits intoLukeLarge-patch-1from
Conversation
Co-authored-by: LukeLarge <162439255+LukeLarge@users.noreply.github.com>
Lawrence Lucas Large (LukeLarge)
left a comment
Lawrence Lucas Large (LukeLarge)
left a comment
There was a problem hiding this comment.
Fix Synopsys workflow: remove spacing inconsistencies, replace placeholders, add error handling
#10
There was a problem hiding this comment.
Pull request overview
Updates the Synopsys Intelligent Security Scan GitHub Actions workflow to standardize expression formatting, replace templated placeholders with GitHub context values, and improve step robustness.
Changes:
- Standardized GitHub Actions expression formatting in secret references.
- Replaced
{{PROJECT_NAME}}/{{PROJECT_VERSION}}placeholders withgithub.*context values. - Converted
additionalWorkflowArgsto folded YAML (>-) and added fail-fast behavior in the Polaris CLI step.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| export POLARIS_SERVER_URL=${{ secrets.POLARIS_SERVER_URL}} | ||
| export POLARIS_ACCESS_TOKEN=${{ secrets.POLARIS_ACCESS_TOKEN}} | ||
| wget -q ${{ secrets.POLARIS_SERVER_URL}}/api/tools/polaris_cli-linux64.zip | ||
| set -e |
There was a problem hiding this comment.
set -e is likely redundant in GitHub Actions run: steps on Linux runners (the default bash invocation is typically already -e and -o pipefail). Consider removing this to avoid implying behavior changes that may already be present, or add a brief comment explaining why it’s needed here (e.g., if shell: is overridden elsewhere).
| set -e |
| export POLARIS_SERVER_URL=${{secrets.POLARIS_SERVER_URL}} | ||
| export POLARIS_ACCESS_TOKEN=${{secrets.POLARIS_ACCESS_TOKEN}} | ||
| wget -q ${{secrets.POLARIS_SERVER_URL}}/api/tools/polaris_cli-linux64.zip |
There was a problem hiding this comment.
These unquoted expansions can break the shell script if the secret values contain characters significant to the shell (spaces, &, ?, etc.). Quote the assigned values and the URL used by wget (or use the exported POLARIS_SERVER_URL variable) to ensure the command behaves correctly for all valid secret contents.
| export POLARIS_SERVER_URL=${{secrets.POLARIS_SERVER_URL}} | |
| export POLARIS_ACCESS_TOKEN=${{secrets.POLARIS_ACCESS_TOKEN}} | |
| wget -q ${{secrets.POLARIS_SERVER_URL}}/api/tools/polaris_cli-linux64.zip | |
| export POLARIS_SERVER_URL="${{secrets.POLARIS_SERVER_URL}}" | |
| export POLARIS_ACCESS_TOKEN="${{secrets.POLARIS_ACCESS_TOKEN}}" | |
| wget -q "${POLARIS_SERVER_URL}/api/tools/polaris_cli-linux64.zip" |
| uses: blackducksoftware/github-action@9ea442b34409737f64743781e9adc71fd8e17d38 | ||
| with: | ||
| args: '--blackduck.url="${{ secrets.BLACKDUCK_URL}}" --blackduck.api.token="${{ secrets.BLACKDUCK_TOKEN}}" --detect.tools="SIGNATURE_SCAN,DETECTOR"' | ||
| args: '--blackduck.url="${{secrets.BLACKDUCK_URL}}" --blackduck.api.token="${{secrets.BLACKDUCK_TOKEN}}" --detect.tools="SIGNATURE_SCAN,DETECTOR"' |
There was a problem hiding this comment.
Expression formatting is inconsistent (some use ${{secrets.X}}, others ${{ github.* }} with spaces). Consider standardizing to a single style across the workflow (commonly ${{ secrets.X }} / ${{ github.X }}) to reduce churn and make future diffs easier to review.
| ioServerUrl: ${{secrets.IO_SERVER_URL}} | ||
| ioServerToken: ${{secrets.IO_SERVER_TOKEN}} | ||
| workflowServerUrl: ${{secrets.WORKFLOW_SERVER_URL}} | ||
| additionalWorkflowArgs: --IS_SAST_ENABLED=${{steps.prescription.outputs.sastScan}} --IS_SCA_ENABLED=${{steps.prescription.outputs.scaScan}} | ||
| --polaris.project.name={{PROJECT_NAME}} --polaris.url=${{secrets.POLARIS_SERVER_URL}} --polaris.token=${{secrets.POLARIS_ACCESS_TOKEN}} | ||
| --blackduck.project.name={{PROJECT_NAME}}:{{PROJECT_VERSION}} --blackduck.url=${{secrets.BLACKDUCK_URL}} --blackduck.api.token=${{secrets.BLACKDUCK_TOKEN}} | ||
| additionalWorkflowArgs: >- | ||
| --IS_SAST_ENABLED=${{steps.prescription.outputs.sastScan}} --IS_SCA_ENABLED=${{steps.prescription.outputs.scaScan}} | ||
| --polaris.project.name=${{ github.event.repository.name }} --polaris.url=${{secrets.POLARIS_SERVER_URL}} --polaris.token=${{secrets.POLARIS_ACCESS_TOKEN}} | ||
| --blackduck.project.name=${{ github.event.repository.name }}:${{ github.ref_name }} --blackduck.url=${{secrets.BLACKDUCK_URL}} --blackduck.api.token=${{secrets.BLACKDUCK_TOKEN}} |
There was a problem hiding this comment.
Expression formatting is inconsistent (some use ${{secrets.X}}, others ${{ github.* }} with spaces). Consider standardizing to a single style across the workflow (commonly ${{ secrets.X }} / ${{ github.X }}) to reduce churn and make future diffs easier to review.
Addresses review feedback on the Synopsys Intelligent Security Scan workflow configuration.
Changes
{{PROJECT_NAME}}→${{ github.event.repository.name }}{{PROJECT_VERSION}}→${{ github.ref_name }}>-operator foradditionalWorkflowArgsset -eto Polaris step for fail-fast on wget/unzip failuresRequires
Supports
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.