fossa.yml

name: FOSSA

on:
  push:
    branches: [main]

  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ (github.event.pull_request && github.event.pull_request.number) || github.ref || github.run_id }}
  cancel-in-progress: true

# See https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
permissions:
  contents: read

jobs:
  fossa-license-scan:
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2

      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: 1.22.x

      - name: Add GOPATH
        run: |
          echo "GOPATH=$(go env GOPATH)"
          echo "GOPATH=$(go env GOPATH)" >>"$GITHUB_ENV"
          echo "$GOPATH/bin" >>"$GITHUB_PATH"

      - name: Run FOSSA scan and upload report
        uses: fossa-contrib/fossa-action@cdc5065bcdee31a32e47d4585df72d66e8e941c2
        with:
          # FOSSA Push-Only API Token
          fossa-api-key: 304657e2357ba57b416b94e6b119131b
          github-token: ${{ github.token }}