canact 0.1.1

Probe an LLM and return host policy: max tools, edit format, XML fallback, JSON repair
Documentation
name: FOSSA

on:
  push:
    branches: [main]
  pull_request:
    paths:
      - "Cargo.*"
      - "src/**"
      - "scripts/fossa-filter.py"
      - "scripts/test_fossa_filter.py"
      - ".github/workflows/fossa.yml"
  workflow_dispatch:

concurrency:
  group: fossa-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

permissions:
  contents: read

jobs:
  license-scan:
    name: License Scan
    if: >-
      github.event.pull_request.user.login != 'dependabot[bot]' &&
      !github.event.repository.private
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2
        with:
          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Check FOSSA API key
        id: check-key
        run: |
          if [ -z "$FOSSA_API_KEY" ]; then
            echo "FOSSA_API_KEY not configured, skipping"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          fi
        env:
          FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
      - name: Filter unit tests
        run: python3 scripts/test_fossa_filter.py
      - name: Install FOSSA CLI
        if: steps.check-key.outputs.skip != 'true'
        env:
          FOSSA_VERSION: "3.17.10"
        run: |
          curl -fsSL -o "fossa_${FOSSA_VERSION}_linux_amd64.tar.gz" \
            "https://github.com/fossas/fossa-cli/releases/download/v${FOSSA_VERSION}/fossa_${FOSSA_VERSION}_linux_amd64.tar.gz"
          curl -fsSL -o "fossa_${FOSSA_VERSION}_linux_amd64.tar.gz.sha256" \
            "https://github.com/fossas/fossa-cli/releases/download/v${FOSSA_VERSION}/fossa_${FOSSA_VERSION}_linux_amd64.tar.gz.sha256"
          sha256sum -c "fossa_${FOSSA_VERSION}_linux_amd64.tar.gz.sha256"
          tar xzf "fossa_${FOSSA_VERSION}_linux_amd64.tar.gz" fossa
          sudo install fossa /usr/local/bin/fossa
      - name: Run FOSSA analysis
        if: steps.check-key.outputs.skip != 'true'
        env:
          FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
        run: fossa analyze
      - name: Run FOSSA license check
        if: steps.check-key.outputs.skip != 'true'
        env:
          FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
        run: |
          set +e
          fossa test --format json > fossa-results.json 2>fossa-stderr.txt
          TEST_EXIT=$?
          set -e

          if [ "$TEST_EXIT" -eq 0 ]; then
            echo "FOSSA test passed with no issues."
            exit 0
          fi

          echo "FOSSA test found issues. Filtering known false positives..."
          head -c 2000 fossa-stderr.txt
          python3 scripts/fossa-filter.py fossa-results.json