fossa.yaml

name: fossa
on:
  repository_dispatch:
    types: [fossa]
  push:
    branches:
      - main
      - release-*
    tags:
      - v*
  pull_request:
    branches:
      - main
      - release-*
  workflow_dispatch: {}
jobs:
  fossa-scan:
    if: github.repository_owner == 'dapr' # FOSSA is not intended to run on forks.
    runs-on: ubuntu-latest
    env:
      FOSSA_API_KEY: b88e1f4287c3108c8751bf106fb46db6 # This is a PUSH ONLY token that is safe to be shared with the public
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v3

      - name: "Run FOSSA Scan"
        uses: fossas/fossa-action@v1.1.0 # Use a specific version if locking is preferred
        with:
          api-key: ${{ env.FOSSA_API_KEY }}
          
      - name: "Run FOSSA Test"
        uses: fossas/fossa-action@v1.1.0 # Use a specific version if locking is preferred
        with:
          api-key: ${{ env.FOSSA_API_KEY }}
          run-tests: true