gooddata-python-sdk/.github/workflows/fossa.yaml at master · okrcmaGD/gooddata-python-sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
# (C) 2026 GoodData Corporation
name: FOSSA scan

on:
  workflow_dispatch:
    inputs:
      branch:
        description: Override the FOSSA branch label (defaults to the dispatched git ref).
        required: false
        default: ""

concurrency:
  group: fossa-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Each PyPI artifact is scanned as its own FOSSA project so license inventory,
# policy gates, and attribution reports match what is actually shipped. The
# FOSSA "branch" axis is left to its intended purpose (track license drift
# across git branches over time).
jobs:
  fossa:
    name: FOSSA ${{ matrix.package.project }}
    runs-on:
      group: infra1-runners-arc
      labels: runners-small
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        package:
          - { path: packages/gooddata-sdk,           project: gooddata-sdk }
          - { path: packages/gooddata-pandas,        project: gooddata-pandas }
          - { path: packages/gooddata-dbt,           project: gooddata-dbt }
          - { path: packages/gooddata-fdw,           project: gooddata-fdw }
          - { path: packages/gooddata-flight-server, project: gooddata-flight-server }
          - { path: packages/gooddata-flexconnect,   project: gooddata-flexconnect }
          - { path: packages/gooddata-pipelines,     project: gooddata-pipelines }
          - { path: packages/gooddata-eval,          project: gooddata-eval }
          - { path: gooddata-api-client,             project: gooddata-api-client }
    steps:
      - name: Checkout the code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Scope .fossa.yml to ${{ matrix.package.project }}
        shell: bash
        run: |
          # Target the existing "1.0" release of the gooddata-python-sdk
          # release group. FOSSA does not auto-create releases during analyze,
          # so the release must already exist; "1.0" is the one currently in
          # app.fossa.com. (TODO: create a per-version release before switching
          # the release label back to the workspace version.)
          cat > .fossa.yml <<EOF
          version: 3
          project:
            id: ${{ matrix.package.project }}
            releaseGroup:
              name: gooddata-python-sdk
              release: "1.0"
          telemetry:
            scope: 'off'
          paths:
            only:
              - ${{ matrix.package.path }}
          EOF

      - name: Workaround for "no targets found" error
        shell: bash
        run: |
          [ -f ./requirements.txt ] || touch ./requirements.txt

      - name: Run FOSSA analyze
        uses: fossas/fossa-action@v1.9.0
        with:
          api-key: ${{ secrets.FOSSA_API_KEY }}
          branch: ${{ inputs.branch != '' && inputs.branch || github.ref_name }}

      # `fossa test` resolves the revision by VCS hash and does not accept a
      # --branch flag (only `fossa analyze` does), so the branch input is
      # intentionally omitted here to avoid an "Invalid option `--branch'" error.
      - name: Run FOSSA test (policy gate)
        uses: fossas/fossa-action@v1.9.0
        with:
          api-key: ${{ secrets.FOSSA_API_KEY }}
          run-tests: true