From ed7959816740128b195ef7a367dc7c6f0dfff804 Mon Sep 17 00:00:00 2001 From: Vaughn Dice Date: Thu, 15 May 2025 12:42:53 -0600 Subject: [PATCH 1/2] ci(.github): add fossa.yml and .fossa.yml config Signed-off-by: Vaughn Dice Co-authored-by: Kate Goldenring Co-authored-by: Lann --- .github/workflows/fossa.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .github/workflows/fossa.yml diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml new file mode 100644 index 000000000..67a9a4335 --- /dev/null +++ b/.github/workflows/fossa.yml @@ -0,0 +1,25 @@ +name: fossa +on: + push: + branches: + - main + - v* + pull_request: + branches: + - main + workflow_dispatch: + +jobs: + fossa-scan: + # Don't attempt to run FOSSA on forks + if: github.repository_owner == 'spinframework' + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@v4 + + - name: "Run FOSSA Scan" + uses: fossas/fossa-action@v1.7.0 + with: + api-key: d21f74dd762b95fa3e318b70e8428ca5 # This is a push-only token that is safe to be exposed From 6c41bcf08e832122f1b1ab9e7e7cc0c65fc5c9c1 Mon Sep 17 00:00:00 2001 From: Vaughn Dice Date: Thu, 22 May 2025 11:32:47 -0600 Subject: [PATCH 2/2] ci(fossa): add test step Signed-off-by: Vaughn Dice --- .github/workflows/fossa.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index 67a9a4335..cba5fff4a 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -14,6 +14,8 @@ jobs: # Don't attempt to run FOSSA on forks if: github.repository_owner == 'spinframework' runs-on: ubuntu-latest + env: + FOSSA_API_KEY: d21f74dd762b95fa3e318b70e8428ca5 # This is a push-only token that is safe to be exposed permissions: contents: read steps: @@ -22,4 +24,13 @@ jobs: - name: "Run FOSSA Scan" uses: fossas/fossa-action@v1.7.0 with: - api-key: d21f74dd762b95fa3e318b70e8428ca5 # This is a push-only token that is safe to be exposed + api-key: ${{ env.FOSSA_API_KEY }} + + - name: "Run FOSSA Test" + if: github.event_name == 'pull_request' + uses: fossas/fossa-action@v1.7.0 + with: + api-key: ${{ env.FOSSA_API_KEY }} + run-tests: true + # TODO: uncomment once we have scans from the main branch + # test-diff-revision: ${{ github.event.pull_request.base.sha }}