Skip to content

add fossa CI #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ruslanti merged 1 commit into from
Sep 5, 2025
Merged

add fossa CI #13

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .github/workflows/fossa.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
name: FOSSA

on:
push:
pull_request:
workflow_dispatch:
merge_group:
types: [checks_requested]

jobs:
fossa:
runs-on: ubuntu-latest

steps:
- name: Checkout repository
uses: actions/checkout@v5

- name: Install FOSSA CLI
run: |
curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash

- name: Set FOSSA API Key
run: echo "FOSSA_API_KEY=${{ secrets.FOSSA_PUB_API_KEY }}" >> $GITHUB_ENV
Copy link

Copilot AI Sep 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting the API key as an environment variable in this manner may expose it in logs. Consider using the env key at the step level or job level instead.

Copilot uses AI. Check for mistakes.

- name: Run FOSSA Analysis
run: fossa analyze

- name: Run FOSSA Test
run: fossa test
Comment on lines +18 to +29
Copy link

Copilot AI Sep 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Downloading and executing a shell script directly from the internet without verification poses a security risk. Consider pinning to a specific version or using the official FOSSA GitHub Action instead.

Suggested change
- name: Install FOSSA CLI
run: |
curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash
- name: Set FOSSA API Key
run: echo "FOSSA_API_KEY=${{ secrets.FOSSA_PUB_API_KEY }}" >> $GITHUB_ENV
- name: Run FOSSA Analysis
run: fossa analyze
- name: Run FOSSA Test
run: fossa test
- name: Run FOSSA Analysis
uses: fossas/fossa-action@v1
with:
api-key: ${{ secrets.FOSSA_PUB_API_KEY }}

Copilot uses AI. Check for mistakes.