FOSSA scan #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # (C) 2026 GoodData Corporation | |
| name: FOSSA scan | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| branch: | |
| description: Override the FOSSA branch label (defaults to the dispatched git ref). | |
| required: false | |
| default: "" | |
| concurrency: | |
| group: fossa-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # Each PyPI artifact is scanned as its own FOSSA project so license inventory, | |
| # policy gates, and attribution reports match what is actually shipped. The | |
| # FOSSA "branch" axis is left to its intended purpose (track license drift | |
| # across git branches over time). | |
| jobs: | |
| fossa: | |
| name: FOSSA ${{ matrix.package.project }} | |
| runs-on: | |
| group: infra1-runners-arc | |
| labels: runners-small | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| package: | |
| - { path: packages/gooddata-sdk, project: gooddata-sdk } | |
| steps: | |
| - name: Checkout the code | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Scope .fossa.yml to ${{ matrix.package.project }} | |
| shell: bash | |
| run: | | |
| # Read the workspace version from the root pyproject.toml so the | |
| # FOSSA release in the gooddata-python-sdk release group tracks | |
| # the SDK version we ship. | |
| VERSION=$(awk -F'"' '/^version = /{print $2; exit}' pyproject.toml) | |
| if [ -z "$VERSION" ]; then | |
| echo "Could not parse workspace version from pyproject.toml" >&2 | |
| exit 1 | |
| fi | |
| cat > .fossa.yml <<EOF | |
| version: 3 | |
| project: | |
| id: ${{ matrix.package.project }} | |
| releaseGroup: | |
| name: gooddata-python-sdk | |
| release: "${VERSION}" | |
| telemetry: | |
| scope: 'off' | |
| paths: | |
| only: | |
| - ${{ matrix.package.path }} | |
| EOF | |
| - name: Workaround for "no targets found" error | |
| shell: bash | |
| run: | | |
| [ -f ./requirements.txt ] || touch ./requirements.txt | |
| - name: Run FOSSA analyze | |
| uses: fossas/fossa-action@v1.9.0 | |
| with: | |
| api-key: ${{ secrets.FOSSA_API_KEY }} | |
| branch: ${{ inputs.branch != '' && inputs.branch || github.ref_name }} | |
| - name: Run FOSSA test (policy gate) | |
| uses: fossas/fossa-action@v1.9.0 | |
| with: | |
| api-key: ${{ secrets.FOSSA_API_KEY }} | |
| run-tests: true | |
| branch: ${{ inputs.branch != '' && inputs.branch || github.ref_name }} |