Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: fossas/fossa-action
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v1.3.1
Choose a base ref
...
head repository: fossas/fossa-action
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v1.3.2
Choose a head ref
  • 3 commits
  • 12 files changed
  • 4 contributors

Commits on Oct 13, 2022

  1. Add debug mode option (#28) 

    Co-authored-by: Dave Lunny <4298089+himynameisdave@users.noreply.github.com>
    @himynameisdave
    Rodrigo López Dato and himynameisdave authored Oct 13, 2022
    Copy the full SHA
    5eca819 View commit details

Commits on Oct 19, 2022

  1. add a CODEOWNERS file (#29)

    @spatten
    spatten authored Oct 19, 2022
    Copy the full SHA
    45d0cd8 View commit details

Commits on Feb 14, 2024

  1. Use node20 in action. (#37) 

    * Use node20 in action.

* Use node 20 in actions workflow

* Upgrade @actions/core to fix vuln warning.

* Update semver and @actions/tool-cache and semver to fix vuln warnings.

* Upgrade ncc to fix minification bug.

* Build action.
    @csasarak
    csasarak authored Feb 14, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    32c7979 View commit details
Showing with 140 additions and 52 deletions.
  1. +1 −0 .github/CODEOWNERS
  2. +10 −3 .github/workflows/test.yml
  3. +23 −0 README.md
  4. +7 −1 action.yml
  5. +47 −3 dist/LICENSE
  6. +3 −1 dist/index.js
  7. +1 −1 dist/index.js.map
  8. +1 −1 dist/sourcemap-register.js
  9. +1 −1 package.json
  10. +1 −0 src/config.ts
  11. +2 −0 src/index.ts
  12. +43 −41 yarn.lock
1 change: 1 addition & 0 deletions .github/CODEOWNERS
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
* @fossas/analysis
13 changes: 10 additions & 3 deletions .github/workflows/test.yml
View file
Original file line number Diff line number Diff line change
@@ -19,21 +19,28 @@ jobs:
- name: Checkout code
uses: actions/checkout@v3

- name: Use Node.js 16.x
- name: Use Node.js 20.x
uses: actions/setup-node@v3
with:
node-version: 16.x
node-version: 20.x

- name: Install npm packages
run: yarn --frozen-lockfile

- name: Build
run: yarn build

- name: Run FOSSA scan and upload build data
- name: Run FOSSA scan in debug mode and upload build data
uses: ./
with:
api-key: ${{secrets.fossaApiKey}}
debug: true

- name: Upload FOSSA debug bundle as a build artifact
uses: actions/upload-artifact@v3
with:
name: fossa.debug.json.gz
path: ./fossa.debug.json.gz

- name: Run FOSSA container scan and upload build data
uses: ./
23 changes: 23 additions & 0 deletions README.md
View file
Original file line number Diff line number Diff line change
@@ -103,6 +103,29 @@ jobs:
endpoint: fossa.my-company.com
```

### `debug`

**Optional** If set to `true`, run all FOSSA commands in debug mode. Running `fossa analyze` in debug mode will generate a debug bundle that can be uploaded as a build artifact after this action completes.

One way to upload build artifacts is to use the [`upload-artifact`](https://github.com/actions/upload-artifact) GitHub action. Example:

```yml
jobs:
fossa-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: fossas/fossa-action@main
with:
api-key: ${{secrets.fossaApiKey}}
debug: true
- uses: actions/upload-artifact@v3
with:
name: fossa.debug.json.gz
path: ./fossa.debug.json.gz
```


## Examples
We've provided a few examples of how to use FOSSA's Github Action in your own project. These examples use an API key stored as a Github secret environment variable `fossaAPiKey`.

8 changes: 7 additions & 1 deletion action.yml
View file
Original file line number Diff line number Diff line change
@@ -24,9 +24,15 @@ inputs:
Override the detected FOSSA project branch. If running FOSSA analysis on a
Pull Request, as a start you can use the contexts `github.ref` or `github.ref_name`.
required: false
debug:
description: >-
Run all FOSSA commands in debug mode. Running `fossa analyze` in debug
mode will generate a debug bundle that can be uploaded as a build artifact
after this action completes.
default: false

runs:
using: node16
using: node20
main: dist/index.js

branding:
50 changes: 47 additions & 3 deletions dist/LICENSE
View file
Original file line number Diff line number Diff line change
@@ -49,6 +49,15 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

@actions/io
MIT
The MIT License (MIT)

Copyright 2019 GitHub

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

@actions/tool-cache
MIT
@@ -62,6 +71,28 @@ The above copyright notice and this permission notice shall be included in all c

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

@fastify/busboy
MIT
Copyright Brian White. All rights reserved.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to
deal in the Software without restriction, including without limitation the
rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
sell copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
IN THE SOFTWARE.

semver
ISC
The ISC License
@@ -106,11 +137,11 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.


uuid
undici
MIT
The MIT License (MIT)
MIT License

Copyright (c) 2010-2016 Robert Kieffer and other contributors
Copyright (c) Matteo Collina and Undici contributors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
@@ -129,3 +160,16 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.


uuid
MIT
The MIT License (MIT)

Copyright (c) 2010-2020 Robert Kieffer and other contributors

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
4 changes: 3 additions & 1 deletion dist/index.js
View file

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion dist/index.js.map
View file

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion dist/sourcemap-register.js
View file

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion package.json
View file
Original file line number Diff line number Diff line change
@@ -18,7 +18,7 @@
"@types/node": "^16.11.26",
"@typescript-eslint/eslint-plugin": "^2.3.0",
"@typescript-eslint/parser": "^2.8.0",
"@vercel/ncc": "^0.33.3",
"@vercel/ncc": "^0.38",
"eslint": "^7.10.0",
"eslint-config-airbnb-base": "^14.2.0",
"eslint-config-standard": "^14.1.0",
1 change: 1 addition & 0 deletions src/config.ts
View file
Original file line number Diff line number Diff line change
@@ -12,3 +12,4 @@ export const CONTAINER = getInput('container', getInputOptions());
export const RUN_TESTS = getBooleanInput('run-tests', {required: false});
export const ENDPOINT = getInput('endpoint', getInputOptions());
export const BRANCH = getInput('branch', getInputOptions());
export const DEBUG = getBooleanInput('debug', {required: false});
2 changes: 2 additions & 0 deletions src/index.ts
View file
Original file line number Diff line number Diff line change
@@ -6,6 +6,7 @@ import {
RUN_TESTS,
ENDPOINT,
BRANCH,
DEBUG,
} from './config';
import { fetchFossaCli } from './download-cli';

@@ -26,6 +27,7 @@ export async function analyze(): Promise<void> {
cmd,
...getEndpointArgs(),
...getBranchArgs(),
DEBUG ? '--debug' : null,
].filter(arg => arg);

// Setup listeners
84 changes: 43 additions & 41 deletions yarn.lock
View file
Original file line number Diff line number Diff line change
@@ -2,55 +2,40 @@
# yarn lockfile v1


"@actions/core@^1.2.6":
version "1.2.6"
resolved "https://registry.yarnpkg.com/@actions/core/-/core-1.2.6.tgz#a78d49f41a4def18e88ce47c2cac615d5694bf09"
integrity sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA==

"@actions/core@^1.6.0":
version "1.6.0"
resolved "https://registry.yarnpkg.com/@actions/core/-/core-1.6.0.tgz#0568e47039bfb6a9170393a73f3b7eb3b22462cb"
integrity sha512-NB1UAZomZlCV/LmJqkLhNTqtKfFXJZAUPcfl/zqG7EfsQdeUJtaWO98SGbuQ3pydJ3fHl2CvI/51OKYlCYYcaw==
dependencies:
"@actions/http-client" "^1.0.11"

"@actions/exec@^1.0.0":
version "1.0.4"
resolved "https://registry.yarnpkg.com/@actions/exec/-/exec-1.0.4.tgz#99d75310e62e59fc37d2ee6dcff6d4bffadd3a5d"
integrity sha512-4DPChWow9yc9W3WqEbUj8Nr86xkpyE29ZzWjXucHItclLbEW6jr80Zx4nqv18QL6KK65+cifiQZXvnqgTV6oHw==
"@actions/core@^1.2.6", "@actions/core@^1.6.0":
version "1.10.1"
resolved "https://registry.yarnpkg.com/@actions/core/-/core-1.10.1.tgz#61108e7ac40acae95ee36da074fa5850ca4ced8a"
integrity sha512-3lBR9EDAY+iYIpTnTIXmWcNbX3T2kCkAEQGIQx4NVQ0575nk2k3GRZDTPQG+vVtS2izSLmINlxXf0uLtnrTP+g==
dependencies:
"@actions/io" "^1.0.1"
"@actions/http-client" "^2.0.1"
uuid "^8.3.2"

"@actions/exec@^1.1.1":
"@actions/exec@^1.0.0", "@actions/exec@^1.1.1":
version "1.1.1"
resolved "https://registry.yarnpkg.com/@actions/exec/-/exec-1.1.1.tgz#2e43f28c54022537172819a7cf886c844221a611"
integrity sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==
dependencies:
"@actions/io" "^1.0.1"

"@actions/http-client@^1.0.11":
"@actions/http-client@^1.0.8":
version "1.0.11"
resolved "https://registry.yarnpkg.com/@actions/http-client/-/http-client-1.0.11.tgz#c58b12e9aa8b159ee39e7dd6cbd0e91d905633c0"
integrity sha512-VRYHGQV1rqnROJqdMvGUbY/Kn8vriQe/F9HR2AlYHzmKuM/p3kjNuXhmdBfcVgsvRWTz5C5XW5xvndZrVBuAYg==
dependencies:
tunnel "0.0.6"

"@actions/http-client@^1.0.8":
version "1.0.9"
resolved "https://registry.yarnpkg.com/@actions/http-client/-/http-client-1.0.9.tgz#af1947d020043dbc6a3b4c5918892095c30ffb52"
integrity sha512-0O4SsJ7q+MK0ycvXPl2e6bMXV7dxAXOGjrXS1eTF9s2S401Tp6c/P3c3Joz04QefC1J6Gt942Wl2jbm3f4mLcg==
"@actions/http-client@^2.0.1":
version "2.2.0"
resolved "https://registry.yarnpkg.com/@actions/http-client/-/http-client-2.2.0.tgz#f8239f375be6185fcd07765efdcf0031ad5df1a0"
integrity sha512-q+epW0trjVUUHboliPb4UF9g2msf+w61b32tAkFEwL/IwP0DQWgbCMM0Hbe3e3WXSKz5VcUXbzJQgy8Hkra/Lg==
dependencies:
tunnel "0.0.6"
tunnel "^0.0.6"
undici "^5.25.4"

"@actions/io@^1.0.1":
version "1.0.2"
resolved "https://registry.yarnpkg.com/@actions/io/-/io-1.0.2.tgz#2f614b6e69ce14d191180451eb38e6576a6e6b27"
integrity sha512-J8KuFqVPr3p6U8W93DOXlXW6zFvrQAJANdS+vw0YhusLIq+bszW8zmK2Fh1C2kDPX8FMvwIl1OUcFgvJoXLbAg==

"@actions/io@^1.1.1":
version "1.1.2"
resolved "https://registry.yarnpkg.com/@actions/io/-/io-1.1.2.tgz#766ac09674a289ce0f1550ffe0a6eac9261a8ea9"
integrity sha512-d+RwPlMp+2qmBfeLYPLXuSRykDIFEwdTA0MMxzS9kh4kvP1ftrc/9fzy6pX6qAjthdXruHQ6/6kjT/DNo5ALuw==
"@actions/io@^1.0.1", "@actions/io@^1.1.1":
version "1.1.3"
resolved "https://registry.yarnpkg.com/@actions/io/-/io-1.1.3.tgz#4cdb6254da7962b07473ff5c335f3da485d94d71"
integrity sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==

"@actions/tool-cache@^1.7.2":
version "1.7.2"
@@ -100,6 +85,11 @@
minimatch "^3.0.4"
strip-json-comments "^3.1.1"

"@fastify/busboy@^2.0.0":
version "2.1.0"
resolved "https://registry.yarnpkg.com/@fastify/busboy/-/busboy-2.1.0.tgz#0709e9f4cb252351c609c6e6d8d6779a8d25edff"
integrity sha512-+KpH+QxZU7O4675t3mnkQKcZZg56u+K/Ct2K+N2AZYNVK8kyeo/bI18tI8aPm3tvNNRyTWfj6s5tnGNlcbQRsA==

"@types/eslint-visitor-keys@^1.0.0":
version "1.0.0"
resolved "https://registry.yarnpkg.com/@types/eslint-visitor-keys/-/eslint-visitor-keys-1.0.0.tgz#1ee30d79544ca84d68d4b3cdb0af4f205663dd2d"
@@ -163,10 +153,10 @@
semver "^7.3.2"
tsutils "^3.17.1"

"@vercel/ncc@^0.33.3":
version "0.33.3"
resolved "https://registry.yarnpkg.com/@vercel/ncc/-/ncc-0.33.3.tgz#aacc6b3ea9f7b175e0c9a18c9b97e4005a2f4fcc"
integrity sha512-JGZ11QV+/ZcfudW2Cz2JVp54/pJNXbsuWRgSh2ZmmZdQBKXqBtIGrwI1Wyx8nlbzAiEFe7FHi4K1zX4//jxTnQ==
"@vercel/ncc@^0.38":
version "0.38.1"
resolved "https://registry.yarnpkg.com/@vercel/ncc/-/ncc-0.38.1.tgz#13f08738111e1d9e8a22fd6141f3590e54d9a60e"
integrity sha512-IBBb+iI2NLu4VQn3Vwldyi2QwaXt5+hTyh58ggAMoCGE6DJmPvwL3KPBWcJl1m9LYPChBLE980Jw+CS4Wokqxw==

acorn-jsx@^5.3.1:
version "5.3.1"
@@ -1352,9 +1342,9 @@ rimraf@^3.0.2:
glob "^7.1.3"

semver@^6.1.0:
version "6.3.0"
resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.0.tgz#ee0a64c8af5e8ceea67687b133761e1becbd1d3d"
integrity sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==
version "6.3.1"
resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.1.tgz#556d2ef8689146e46dcea4bfdd095f3434dffcb4"
integrity sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==

semver@^7.2.1, semver@^7.3.2:
version "7.3.4"
@@ -1509,7 +1499,7 @@ tsutils@^3.17.1:
dependencies:
tslib "^1.8.1"

tunnel@0.0.6:
tunnel@0.0.6, tunnel@^0.0.6:
version "0.0.6"
resolved "https://registry.yarnpkg.com/tunnel/-/tunnel-0.0.6.tgz#72f1314b34a5b192db012324df2cc587ca47f92c"
integrity sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==
@@ -1556,6 +1546,13 @@ unbox-primitive@^1.0.1:
has-symbols "^1.0.2"
which-boxed-primitive "^1.0.2"

undici@^5.25.4:
version "5.28.3"
resolved "https://registry.yarnpkg.com/undici/-/undici-5.28.3.tgz#a731e0eff2c3fcfd41c1169a869062be222d1e5b"
integrity sha512-3ItfzbrhDlINjaP0duwnNsKpDQk3acHI3gVJ1z4fmwMK31k5G9OVIAMLSIaP6w4FaGkaAkN6zaQO9LUvZ1t7VA==
dependencies:
"@fastify/busboy" "^2.0.0"

uri-js@^4.2.2:
version "4.4.1"
resolved "https://registry.yarnpkg.com/uri-js/-/uri-js-4.4.1.tgz#9b1a52595225859e55f669d928f88c6c57f2a77e"
@@ -1568,6 +1565,11 @@ uuid@^3.3.2:
resolved "https://registry.yarnpkg.com/uuid/-/uuid-3.4.0.tgz#b23e4358afa8a202fe7a100af1f5f883f02007ee"
integrity sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==

uuid@^8.3.2:
version "8.3.2"
resolved "https://registry.yarnpkg.com/uuid/-/uuid-8.3.2.tgz#80d5b5ced271bb9af6c445f21a1a04c606cefbe2"
integrity sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==

v8-compile-cache@^2.0.3:
version "2.3.0"
resolved "https://registry.yarnpkg.com/v8-compile-cache/-/v8-compile-cache-2.3.0.tgz#2de19618c66dc247dcfb6f99338035d8245a2cee"