FOSSA scan #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # (C) 2026 GoodData Corporation | |
| name: FOSSA scan | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| branch: | |
| description: Override the FOSSA branch label (defaults to the dispatched git ref). | |
| required: false | |
| default: "" | |
| concurrency: | |
| group: fossa-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # Each PyPI artifact is scanned as its own FOSSA project so license inventory, | |
| # policy gates, and attribution reports match what is actually shipped. The | |
| # FOSSA "branch" axis is left to its intended purpose (track license drift | |
| # across git branches over time). | |
| jobs: | |
| fossa: | |
| name: FOSSA ${{ matrix.package.project }} | |
| runs-on: | |
| group: infra1-runners-arc | |
| labels: runners-small | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| package: | |
| - { path: packages/gooddata-sdk, project: gooddata-sdk } | |
| steps: | |
| - name: Checkout the code | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Scope .fossa.yml to ${{ matrix.package.project }} | |
| shell: bash | |
| run: | | |
| # Target the existing "1.0" release of the gooddata-python-sdk | |
| # release group. FOSSA does not auto-create releases during analyze, | |
| # so the release must already exist; "1.0" is the one currently in | |
| # app.fossa.com. (TODO: create a per-version release before switching | |
| # the release label back to the workspace version.) | |
| cat > .fossa.yml <<EOF | |
| version: 3 | |
| project: | |
| id: ${{ matrix.package.project }} | |
| releaseGroup: | |
| name: gooddata-python-sdk | |
| release: "1.0" | |
| telemetry: | |
| scope: 'off' | |
| paths: | |
| only: | |
| - ${{ matrix.package.path }} | |
| EOF | |
| - name: Workaround for "no targets found" error | |
| shell: bash | |
| run: | | |
| [ -f ./requirements.txt ] || touch ./requirements.txt | |
| - name: Run FOSSA analyze | |
| uses: fossas/fossa-action@v1.9.0 | |
| with: | |
| api-key: ${{ secrets.FOSSA_API_KEY }} | |
| branch: ${{ inputs.branch != '' && inputs.branch || github.ref_name }} | |
| - name: Run FOSSA test (policy gate) | |
| uses: fossas/fossa-action@v1.9.0 | |
| with: | |
| api-key: ${{ secrets.FOSSA_API_KEY }} | |
| run-tests: true | |
| branch: ${{ inputs.branch != '' && inputs.branch || github.ref_name }} |