diff --git a/.fossa.yml b/.fossa.yml new file mode 100644 index 0000000000..0a70affa4b --- /dev/null +++ b/.fossa.yml @@ -0,0 +1 @@ +version: 3 diff --git a/.github/workflows/fossa-scan.yaml b/.github/workflows/fossa-scan.yaml new file mode 100644 index 0000000000..652385bbba --- /dev/null +++ b/.github/workflows/fossa-scan.yaml @@ -0,0 +1,30 @@ +name: FOSSA Scan +on: + pull_request: + +permissions: + repository-projects: read + contents: write + id-token: write + packages: write + actions: write + +jobs: + fossa_scan: + runs-on: ubuntu-latest + + steps: + - name: Install LFS Dependencies + run: sudo apt update && sudo apt install git git-lfs -y + + - name: Checkout code + uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha }} + lfs: true + + - name: Install FOSSA CLI + run: | + curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash ; + export FOSSA_API_KEY=${{ secrets.FOSSA_API_KEY }}; + fossa analyze --experimental-force-first-party-scans --debug --revision 1.0 --branch fossa-test --unpack-archives