Repository navigation
Conversation
Runs the Mend CLI dependency scan ("mend dep"), the path the DataStax Mend
onboarding runbook requires for repos outside IBM's GitHub Enterprise space.
Pushes to main and PRs against main report only; release tags also update the
Mend platform. Critical or High findings turn the job red without blocking
merges. Fork PRs are skipped because they get no secrets.
Needs MEND_USER_KEY, MEND_EMAIL and MEND_PRODUCTNAME before it can run.
Contributor
➡️ Unit Test Coverage Delta vs Main Branch
|
Contributor
Unit Test Coverage Report
|
Contributor
➡️ Integration Test Coverage Delta vs Main Branch (hcd-it)
|
Contributor
Integration Test Coverage Report (hcd-it)
|
Contributor
➡️ Integration Test Coverage Delta vs Main Branch (dse69-it)
|
Contributor
Integration Test Coverage Report (dse69-it)
|
Follows the riptano/shared-github-actions Mend workflows that
riptano/cloud-billing uses. The steps are copied rather than called,
because a public repository cannot use reusable workflows from an
internal one.
SAST ("mend sast") fails on a finding of any severity. SCA still fails on
Critical or High, now as a real failure instead of continue-on-error, and
skips CVEs listed in .github/mend-allowlist.txt. Settings move to the
cloud-billing names: ASTRA_DB_MEND_EMAIL and ASTRA_DB_MEND_PRODUCTNAME
variables, optional ASTRA_DB_MEND_PROJECTNAME ("Astra DB") and
ASTRA_DB_MEND_URL variables, and the ASTRA_DB_MEND_USER_KEY secret.
Dependabot PRs are skipped along with fork PRs, since neither gets
Actions secrets.
erichare
changed the title
erichare
marked this pull request as ready for review
October 28, 2026 15:17
data-api is public, so anyone signed in to GitHub can read its run logs and download its artifacts. Both scans now write the CLI output to a runner temp file, the logs show only finding counts, and no report is uploaded. If the CLI fails, only lines that look like connection or credential errors are printed, never a findings table row. SCA now also updates the Mend platform on pushes to main, not only on release tags, so main's findings have somewhere to live.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does:
Adds an IBM Mend workflow with two jobs, built on the shared Mend workflows that riptano/cloud-billing calls. The SCA job runs
mend depon our dependencies and fails on Critical or High findings, except CVEs listed in.github/mend-allowlist.txt. The SAST job runsmend saston our own code and fails on a finding of any severity, the same gate cloud-billing has. The steps are copied instead of called, because a public repo can't use reusable workflows from an internal repo like riptano/shared-github-actions. This repo being public also means anyone signed in to GitHub can read its run logs, so scan output stays on the runner. The logs show only finding counts, no report is uploaded, and the findings live on the Mend platform. Pushes tomainand release tags update the SCA project there, and every SAST run does. Fork and Dependabot PRs skip both jobs, since neither gets Actions secrets.Which issue(s) this PR fixes:
Fixes #2668
Companion to #2663, which adds the IBM SonarQube scan.
Verification
actionlintis clean, with shellcheck on the run steps. Against a stub Mend CLI, 26 local checks passed. They cover when SCA updates the platform, that CLI output never reaches the log, that a CLI failure shows its error line but no finding rows, and both gates on sample outputs../mvnw compilepassed. Neither scan has run against IBM Mend yet. The Mend variables and secret on the stargate org are shared only with private and internal repos, so both Mend jobs fail on this PR until data-api is added to their repository access.A first real run still needs to confirm the summary line the SCA gate reads. Every SAST run uploads to one Mend project, so a PR scan replaces the main baseline there, as it does on cloud-billing.
Checklist