mend-scan.yaml

name: Mend CLI Scan

on:
  workflow_run:
    workflows: ["Tests"]
    types: [completed]
  workflow_dispatch:
  push:


jobs:
  mend-scan:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }} 
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup uv
        uses: astral-sh/setup-uv@v7

      - name: Create venv and sync packages
        run: |
          uv venv
          uv sync --all-packages

      - name: Install Mend CLI
        run: |
          MEND_DIR="$HOME/mend-cli"
          mkdir -p "$MEND_DIR"
          curl -fsSL -o "$MEND_DIR/mend" https://downloads.mend.io/cli/linux_amd64/mend
          chmod +x "$MEND_DIR/mend"
          echo "$MEND_DIR" >> $GITHUB_PATH
          echo "MEND_BIN=$MEND_DIR/mend" >> $GITHUB_ENV

      - name: Run Mend dependency scan
        env:
          MEND_URL: https://saas-eu.whitesourcesoftware.com
          MEND_USER_KEY: ${{ secrets.MEND_USER_KEY }}
          MEND_EMAIL: ${{ secrets.MEND_EMAIL }}
        run: |
          source .venv/bin/activate
          $MEND_BIN dep -d . -u --scope "Perfecto//perfecto-mcp"
          exitcode=$?
          # Exit 9 = policy violation; don't fail job
          [ $exitcode -eq 9 ] && exit 0 || exit $exitcode