Fix blackduck sca scan getting skipped

[sandhi18]

This pull request updates several GitHub Actions workflow files to improve support for multi-language projects (especially Ruby, Go, and Erlang), enhance security scanning controls, and increase flexibility for monorepo and non-root project structures. The changes add new input parameters, improve environment setup for different languages, and refine the handling of security and SCA scans.

Key changes:

Enhanced Security Scanning Controls

• Added a trivy-fail-on-high-critical input to .github/workflows/ci-main-pull-request.yml and a corresponding fail-on-high-critical input to .github/workflows/trivy.yml, allowing the pipeline to fail if Trivy finds HIGH or CRITICAL vulnerabilities. The Trivy workflow now conditionally fails the build based on this input. [1] [2] [3] [4]

Improved Support for Monorepo and Non-root Ruby Projects

• Introduced a ruby-app-directory input to both the main CI and SBOM workflows, enabling specification of a subdirectory containing the Ruby Gemfile. All relevant steps (Ruby setup, bundle install, artifact upload, and BlackDuck scan) now respect this input, making the workflows compatible with monorepos or projects where the Gemfile is not in the root. [1] [2] [3] [4] [5] [6] [7]

Language-specific Environment Setup

• Added steps to set up Erlang/OTP and rebar3 for Erlang projects, and improved Ruby setup (including disabling bundler cache and supporting directory overrides). Also added a stub for bundle in Erlang SAST scans to bypass unnecessary Ruby gem installations. [1] [2]

• For Go projects, added steps to configure git for private Go modules using the GH_TOKEN secret. [1] [2]

Improved Flexibility for Coverity/Polaris SAST Scans

• Updated polaris-coverity-clean-command and polaris-coverity-build-command defaults and descriptions to allow empty values for buildless analysis (e.g., Ruby, Python), increasing flexibility for language-specific SAST scans.

Workflow Robustness and Minor Fixes

• Changed continue-on-error to false for the Black Duck Polaris scan, ensuring that the pipeline fails on scan errors.
• Adjusted workflow dependencies to use the correct job (checkout) for SBOM generation and related steps.

These changes collectively make the CI/CD workflows more robust, modular, and suitable for complex multi-language repositories.