From 7497212d372804ba912b6d5a21377e3f9e2cd53e Mon Sep 17 00:00:00 2001
From: Przemyslaw Tomaszewski <Przemyslaw.Tomaszewski@ibm.com>
Date: Wed, 23 Sep 2026 13:03:39 +0200
Subject: [PATCH 1/2] Bump node to v18 in pipeline

---
 .github/workflows/on_pr_master.yml | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/on_pr_master.yml b/.github/workflows/on_pr_master.yml
index c3aa35e..ce45e59 100644
--- a/.github/workflows/on_pr_master.yml
+++ b/.github/workflows/on_pr_master.yml
@@ -9,28 +9,22 @@ on:
 jobs:
   linter:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [16.x, 18.x]
     steps:
-    - uses: actions/checkout@v2
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+    - uses: actions/checkout@v3
+    - name: Set up Node.js
+      uses: actions/setup-node@v3
       with:
-        node-version: ${{ matrix.node-version }}
+        node-version: 18
     - run: npm ci
     - run: npm run lint
 
   test:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [16.x, 18.x]
     steps:
-    - uses: actions/checkout@v2
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+    - uses: actions/checkout@v3
+    - name: Set up Node.js
+      uses: actions/setup-node@v3
       with:
-        node-version: ${{ matrix.node-version }}
+        node-version: 18
     - run: npm ci
     - run: npm run test

From 71a41c7fbe18b9c3e412041471083f3c5cbf8989 Mon Sep 17 00:00:00 2001
From: Przemyslaw Tomaszewski <Przemyslaw.Tomaszewski@ibm.com>
Date: Wed, 23 Sep 2026 13:25:28 +0200
Subject: [PATCH 2/2] Integrate mend with pipelines

---
 .github/workflows/on_pr_master.yml | 45 ++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/.github/workflows/on_pr_master.yml b/.github/workflows/on_pr_master.yml
index ce45e59..512dd30 100644
--- a/.github/workflows/on_pr_master.yml
+++ b/.github/workflows/on_pr_master.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   linter:
     runs-on: ubuntu-latest
@@ -28,3 +31,45 @@ jobs:
         node-version: 18
     - run: npm ci
     - run: npm run test
+
+  scan:
+    runs-on: ubuntu-latest
+    # Skip for dependabot PRs and forks
+    if: >-
+      github.actor != 'dependabot[bot]'
+      && (github.event_name == 'push'
+      || github.event.pull_request.head.repo.full_name == github.repository)
+    env:
+      MEND_EMAIL: ${{secrets.MEND_EMAIL}}
+      MEND_USER_KEY: ${{secrets.MEND_USER_KEY}}
+      MEND_URL: ${{secrets.MEND_URL}}
+      MEND_ORGNAME: ${{secrets.MEND_ORGNAME}}
+      MEND_PRODUCTNAME: ${{secrets.MEND_PRODUCTNAME}}
+      MEND_PROJECTNAME: ${{secrets.MEND_PROJECTNAME}}
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Node.js
+      uses: actions/setup-node@v3
+      with:
+        node-version: 18
+    - run: npm ci
+    - name: Download Mend CLI
+      run: |
+        curl -sSf https://downloads.mend.io/cli/linux_amd64/mend -o /usr/local/bin/mend
+        chmod +x /usr/local/bin/mend
+    - name: Mend baseline scan
+      if: github.event_name == 'push'
+      run: |
+        echo Run Mend dependencies scan
+        mend dep --dir . --scope "$MEND_ORGNAME//$MEND_PRODUCTNAME//$MEND_PROJECTNAME" --export-results "mend_report.json" --update
+        echo Run Mend code scan
+        mend code --dir . --scope "$MEND_ORGNAME//$MEND_PRODUCTNAME//$MEND_PROJECTNAME" --report --formats "csv,html" --filename "mend_report"
+    - name: Mend PR scan
+      if: github.event_name == 'pull_request'
+      env:
+        HEAD_REF: ${{ github.head_ref }}
+      run: |
+        # Branch names might contain slashes
+        SAFE_REF="${HEAD_REF//\//-}"
+        echo Run Mend code scan
+        mend code --dir . --scope "$MEND_ORGNAME//$MEND_PRODUCTNAME//${MEND_PROJECTNAME}_${SAFE_REF}" --report --formats "csv,html" --filename "mend_report"