name: FOSSA
on:
push:
branches: [main]
pull_request:
paths:
- "Cargo.*"
- "src/**"
- "scripts/fossa-filter.py"
- "scripts/test_fossa_filter.py"
- ".github/workflows/fossa.yml"
workflow_dispatch:
concurrency:
group: fossa-${{ github.ref }}
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
permissions:
contents: read
jobs:
license-scan:
name: License Scan
if: >-
github.event.pull_request.user.login != 'dependabot[bot]' &&
!github.event.repository.private
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with:
egress-policy: audit
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with:
persist-credentials: false
- name: Check FOSSA API key
id: check-key
run: |
if [ -z "$FOSSA_API_KEY" ]; then
echo "FOSSA_API_KEY not configured, skipping"
echo "skip=true" >> "$GITHUB_OUTPUT"
fi
env:
FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
- name: Filter unit tests
run: python3 scripts/test_fossa_filter.py
- name: Install FOSSA CLI
if: steps.check-key.outputs.skip != 'true'
env:
FOSSA_VERSION: "3.17.10"
run: |
curl -fsSL -o "fossa_${FOSSA_VERSION}_linux_amd64.tar.gz" \
"https://github.com/fossas/fossa-cli/releases/download/v${FOSSA_VERSION}/fossa_${FOSSA_VERSION}_linux_amd64.tar.gz"
curl -fsSL -o "fossa_${FOSSA_VERSION}_linux_amd64.tar.gz.sha256" \
"https://github.com/fossas/fossa-cli/releases/download/v${FOSSA_VERSION}/fossa_${FOSSA_VERSION}_linux_amd64.tar.gz.sha256"
sha256sum -c "fossa_${FOSSA_VERSION}_linux_amd64.tar.gz.sha256"
tar xzf "fossa_${FOSSA_VERSION}_linux_amd64.tar.gz" fossa
sudo install fossa /usr/local/bin/fossa
- name: Run FOSSA analysis
if: steps.check-key.outputs.skip != 'true'
env:
FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
run: fossa analyze
- name: Run FOSSA license check
if: steps.check-key.outputs.skip != 'true'
env:
FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
run: |
set +e
fossa test --format json > fossa-results.json 2>fossa-stderr.txt
TEST_EXIT=$?
set -e
if [ "$TEST_EXIT" -eq 0 ]; then
echo "FOSSA test passed with no issues."
exit 0
fi
echo "FOSSA test found issues. Filtering known false positives..."
head -c 2000 fossa-stderr.txt
python3 scripts/fossa-filter.py fossa-results.json