ci: Add blackduck scanning workflow

Author: jimmidyson

.github/workflows/synopsys.yaml

@@ -0,0 +1,69 @@
+# Copyright 2024 Nutanix. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Black Duck Policy Check
+on:
+  pull_request:
+    branches:
+      - main
+    # Only scan when product source dependencies change.
+    paths:
+      - '**/go.mod'
+      # Ignore source dependencies of build tooling.
+      - '!docs/go.mod'
+  push:
+    branches:
+      - main
+    # Only scan when product source dependencies change.
+    paths:
+      - '**/go.mod'
+      # Ignore source dependencies of build tooling.
+      - '!docs/go.mod'
+
+jobs:
+  security:
+    if: github.repository == 'nutanix-cloud-native/cluster-api-runtime-extensions-nutanix'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install devbox
+        uses: jetify-com/[email protected]
+        with:
+          enable-cache: true
+
+      - name: Go cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Build Project
+        run: devbox run -- make build-snapshot
+
+      - name: Black Duck Full Scan
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: synopsys-sig/[email protected]
+        with:
+          blackduck_url: ${{ secrets.BLACKDUCK_URL }}
+          blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          blackduck_scan_full: true
+          blackduck_scan_failure_severities: 'BLOCKER,CRITICAL'
+
+      - name: Black Duck PR Scan
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: synopsys-sig/[email protected]
+        env:
+          DETECT_PROJECT_VERSION_NAME: ${{ github.base_ref }}
+        with:
+          blackduck_url: ${{ secrets.BLACKDUCK_URL }}
+          blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          blackduck_scan_full: false
+          blackduck_prComment_enabled: true