foss.yaml

# SPDX-License-Identifier: MIT
# Jobs to run Blackduck based FOSS scan
name: FOSS Scan
on:
  workflow_dispatch: {}
  push:
    branches:
    - main

jobs:
  foss-scan:
    strategy:
      max-parallel: 2
    name: foss-scan
    runs-on: ubuntu-latest
    steps:
    - name: Set up Go 1.x
      uses: actions/setup-go@v5
      with:
        go-version: '1.23.2'
      id: go

    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    - name: Synopsys Detect
      run: |
        GITHUB_REF="$(echo $GITHUB_REF_NAME | tr ':/' '_')"
        BLACKDUCK_SCAN_VERSION_NAME="${GITHUB_REF}_${GITHUB_SHA}"
        export BLACKDUCK_SCAN_VERSION_NAME

        # create the tmp directory as we also do during the release process
        mkdir -p tmp

        ./hack/foss-scan.sh
      env:
        BLACKDUCK_URL: ${{ secrets.BLACKDUCK_URL }}
        BLACKDUCK_PROJECT_NAME: ${{ secrets.BLACKDUCK_PROJECT_NAME }}
        BLACKDUCK_TOKEN: ${{ secrets.BLACKDUCK_TOKEN }}

    - name: Archive foss scan notices report
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
      with:
        name: 3RD_PARTY_LICENSES.txt
        path: tmp/Black_Duck_Notices_Report.txt

    - name: Archive foss scan risk report
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
      with:
        name: foss-scan-risk-report
        path: tmp/BlackDuck_RiskReport.pdf