fossa.yml

name: FOSSA

on:
  push:
    branches: [main]

  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ (github.event.pull_request && github.event.pull_request.number) || github.ref || github.run_id }}
  cancel-in-progress: true

# See https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
permissions:
  contents: read

jobs:
  fossa-license-scan:
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

      - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: 1.22.x

      - name: Add GOPATH
        run: |
          echo "GOPATH=$(go env GOPATH)"
          echo "GOPATH=$(go env GOPATH)" >>"$GITHUB_ENV"
          echo "$GOPATH/bin" >>"$GITHUB_PATH"

      - name: Run FOSSA scan and upload report
        uses: fossa-contrib/fossa-action@cdc5065bcdee31a32e47d4585df72d66e8e941c2
        with:
          # FOSSA Push-Only API Token
          fossa-api-key: 304657e2357ba57b416b94e6b119131b
          github-token: ${{ github.token }}