fossa.yml

name: "Run FOSSA scan"
on:
  push:
    branches:
      - main
  pull_request:
    types:
      - "labeled"

jobs:
  fossa-scan:
    name: 'trigger FOSSA scan'
    runs-on: ubuntu-latest
    container:
      image: vdaas/vald-ci-container:nightly
    if: github.ref == 'refs/heads/main' || github.event.action == 'labeled' && github.event.label.name == 'actions/fossa'
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: '17'
      - name: 'Install fossa-cli'
        run: |
          curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash
      - name: 'Run for main branch'
        if: github.ref == 'refs/heads/main'
        run: |
          fossa analyze --branch main --revision ${GITHUB_SHA}
        env:
          FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_SHA: ${{ github.sha }}
      - name: 'Run for PRs'
        if: github.event_name == 'pull_request'
        run: |
          curl -s ${PR_INFO_URL} > /tmp/pr_info.json
          PR_RESP=`cat /tmp/pr_info.json`
          HEAD_BRANCH=$(cat /tmp/pr_info.json | jq -r .head.ref)
          if [ -z "$HEAD_BRANCH" ]; then
            echo "Cannot get head branch information for PR #${PR_NUM}!"
            echo "API response: $PR_RESP"
            fossa analyze --revision ${GITHUB_SHA}
          else
            echo "Head branch for PR #${PR_NUM} is ${HEAD_BRANCH}"

            fossa analyze --branch ${HEAD_BRANCH} --revision ${GITHUB_SHA}

            ESCAPED=`echo -n "${HEAD_BRANCH}" | python3 -c 'import urllib.parse; import sys; print(urllib.parse.quote(sys.stdin.read(), safe=""))'`

            curl --include --verbose --fail \
            -H "Accept: application/json" \
            -H "Content-Type:application/json" \
            -H "Authorization: token ${GITHUB_TOKEN}" \
            --request POST \
            --data "{\"body\": \"**[FOSSA]** The scan result will be available at https://app.fossa.com/projects/custom%2B21465%2Fvald-client-java/refs/branch/${ESCAPED}/${GITHUB_SHA}\"}" \
            $API_URL
          fi
        env:
          FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_SHA: ${{ github.sha }}
          PR_INFO_URL: ${{ github.event.pull_request.url }}
          API_URL: ${{ github.event.pull_request.comments_url }}
          PR_NUM: ${{ github.event.pull_request.number }}