fossa.yml

name: FOSSA

on:
  push:
    branches: [main]

  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ (github.event.pull_request && github.event.pull_request.number) || github.ref || github.run_id }}
  cancel-in-progress: true

# See https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
permissions:
  contents: read

jobs:
  fossa-license-scan:
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
        with:
          go-version: 1.21.x

      - name: Add GOPATH
        run: |
          echo "GOPATH=$(go env GOPATH)"
          echo "GOPATH=$(go env GOPATH)" >>"$GITHUB_ENV"
          echo "$GOPATH/bin" >>"$GITHUB_PATH"

      - name: Run FOSSA scan and upload report
        uses: fossa-contrib/fossa-action@6728dc6fe9a068c648d080c33829ffbe56565023
        with:
          # FOSSA Push-Only API Token
          fossa-api-key: 304657e2357ba57b416b94e6b119131b
          github-token: ${{ github.token }}