[CI] issue: 4705805 Add Blackduck to release job

Signed-off-by: Noam Tsemah <[email protected]>

Author: ntsemah

.ci/blackduck_source.sh

@@ -25,7 +25,7 @@ echo "    SRC_PATH: ${PROJECT_SRC_PATH}"
 
 # clone BlackDuck
 [[ -d /tmp/blackduck ]] && rm -rf /tmp/blackduck
-sudo -u swx-jenkins git clone -c core.sshCommand="ssh -i ~/.ssh/id_ed25519" -b master --single-branch --depth=1 ssh://git-nbu.nvidia.com:12023/DevOps/Tools/blackduck /tmp/blackduck
+git clone -c core.sshCommand="ssh -i ~/.ssh/id_ed25519" -b master --single-branch --depth=1 ssh://git-nbu.nvidia.com:12023/DevOps/Tools/blackduck /tmp/blackduck
 cd /tmp/blackduck
 
 # disable check errors

.ci/pipeline/release_jjb.yaml

@@ -35,6 +35,10 @@
             name: "do_release"
             default: true
             description: "Release build packges into the release folder, set to false for debugging"
+        - bool:
+            name: "do_blackduck"
+            default: true
+            description: "Run BlackDuck."
         - string:
             name: "notification_email"
             default: "{jjb_release_email}"

.ci/pipeline/release_matrix_job.yaml

@@ -4,6 +4,8 @@ registry_host: nbu-harbor.gtm.nvidia.com
 registry_auth: swx-infra_harbor_credentials
 registry_path: /swx-infra/media/libvma
 
+failFast: true
+
 kubernetes:
   privileged: true
   cloud: il-ipp-blossom-prod
@@ -16,6 +18,9 @@ kubernetes:
       nodeSelector: 'kubernetes.io/arch=amd64'
       jnlpImage: 'harbor.mellanox.com/toolbox/c3po-jnlp:latest'
 
+credentials:
+  - {credentialsId: 'blackduck_api_token', type: 'string', variable: 'BLACKDUCK_API_TOKEN'}
+
 env:
   MAIL_FROM: [email protected]
 
@@ -37,14 +42,38 @@ runs_on_dockers:
       arch: 'x86_64',
       tag: '20250128'
     }
+  - {
+      name: 'blackduck',
+      file: '.ci/dockerfiles/Dockerfile.rhel8.6',
+      category: 'tool',
+      arch: 'x86_64',
+      tag: '20250630',
+      uri: 'vma/$arch/$name/bduck',
+      build_args: '--no-cache --target bduck',
+      runAsUser: '6213',
+      runAsGroup: '101'
+    }
 
 steps:
   - name: Release
     parallel: false
+    containerSelector:
+      - "{name: 'rhel8.6', variant:1}"
     run: |
       .ci/do_release.sh
     archiveArtifacts: pkg/build_pkg.log,pkg/packages/*.rpm
 
+  - name: Blackduck
+    parallel: false
+    enable: ${do_blackduck}
+    containerSelector:
+      - "{name: 'blackduck', category:'tool', variant:1}"
+    run: |
+        .ci/blackduck_source.sh
+    archiveArtifacts: 'logs/'
+    credentialsId:
+      - "blackduck_api_token"
+
 pipeline_start:
     shell: action
     module: groovy