-
Notifications
You must be signed in to change notification settings - Fork 2.4k
41 lines (32 loc) · 1.12 KB
/
fossa.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
name: FOSSA
on:
push:
branches: [main]
pull_request:
branches: [main]
# See https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
permissions:
contents: read
jobs:
fossa-license-scan:
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
- uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
with:
go-version: 1.20.x
- name: Add GOPATH
run: |
echo "GOPATH=$(go env GOPATH)"
echo "GOPATH=$(go env GOPATH)" >>"$GITHUB_ENV"
echo "$GOPATH/bin" >>"$GITHUB_PATH"
- name: Run FOSSA scan and upload report
uses: fossa-contrib/fossa-action@6728dc6fe9a068c648d080c33829ffbe56565023
with:
# FOSSA Push-Only API Token
fossa-api-key: 304657e2357ba57b416b94e6b119131b
github-token: ${{ github.token }}