From 1f26905024852f9821a418349a821615fbbb3260 Mon Sep 17 00:00:00 2001 From: Ihor Dvoretskyi Date: Thu, 14 Jan 2021 15:17:43 +0200 Subject: [PATCH 1/9] FOSSA scan enabled Signed-off-by: Ihor Dvoretskyi --- .github/workflows/fossa.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/workflows/fossa.yml diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml new file mode 100644 index 0000000000..c018bc2deb --- /dev/null +++ b/.github/workflows/fossa.yml @@ -0,0 +1,34 @@ +name: FOSSA +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + + runs-on: ubuntu-latest + + strategy: + matrix: + node-version: [10.x, 12.x, 14.x, 15.x] + + steps: + - uses: actions/checkout@v2 + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v1 + with: + node-version: ${{ matrix.node-version }} + - run: npm ci + - run: npm run build --if-present + - run: npm test + # Runs a set of commands to initialize and analyze with FOSSA + - name: run FOSSA analysis + env: + # FOSSA Push-Only API Token + FOSSA_API_KEY: '9ee7e8893660832a7387dcc32377fb61' + run: | + curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash + fossa init + fossa analyze From 4dc5cf516c605438c1a025256a8f717ee5d9cef4 Mon Sep 17 00:00:00 2001 From: Ihor Dvoretskyi Date: Thu, 14 Jan 2021 15:53:05 +0200 Subject: [PATCH 2/9] Formatting fixes Signed-off-by: Ihor Dvoretskyi --- .github/workflows/fossa.yml | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index c018bc2deb..ae01683b3c 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -1,13 +1,12 @@ name: FOSSA on: push: - branches: [ master ] + branches: [master] pull_request: - branches: [ master ] + branches: [master] jobs: build: - runs-on: ubuntu-latest strategy: @@ -15,19 +14,19 @@ jobs: node-version: [10.x, 12.x, 14.x, 15.x] steps: - - uses: actions/checkout@v2 - - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v1 - with: - node-version: ${{ matrix.node-version }} - - run: npm ci - - run: npm run build --if-present - - run: npm test - # Runs a set of commands to initialize and analyze with FOSSA + - uses: actions/checkout@v2 + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v1 + with: + node-version: ${{ matrix.node-version }} + - run: npm ci + - run: npm run build --if-present + - run: npm test + # Runs a set of commands to initialize and analyze with FOSSA - name: run FOSSA analysis env: - # FOSSA Push-Only API Token - FOSSA_API_KEY: '9ee7e8893660832a7387dcc32377fb61' + # FOSSA Push-Only API Token + FOSSA_API_KEY: '9ee7e8893660832a7387dcc32377fb61' run: | curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash fossa init From 56ba877a7b1cc51d892555c31e63d76f2c6f9943 Mon Sep 17 00:00:00 2001 From: Ihor Dvoretskyi Date: Thu, 14 Jan 2021 16:33:01 +0200 Subject: [PATCH 3/9] Formatting fixes Signed-off-by: Ihor Dvoretskyi --- .github/workflows/fossa.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index ae01683b3c..cd17eb2e49 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -25,8 +25,8 @@ jobs: # Runs a set of commands to initialize and analyze with FOSSA - name: run FOSSA analysis env: - # FOSSA Push-Only API Token - FOSSA_API_KEY: '9ee7e8893660832a7387dcc32377fb61' + # FOSSA Push-Only API Token + FOSSA_API_KEY: '9ee7e8893660832a7387dcc32377fb61' run: | curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash fossa init From 4d3ed6bef514969d2f24f4bb8da9283b298424da Mon Sep 17 00:00:00 2001 From: Ihor Dvoretskyi Date: Thu, 14 Jan 2021 16:37:20 +0200 Subject: [PATCH 4/9] fossa.yml uses yarn instead of npm Signed-off-by: Ihor Dvoretskyi --- .github/workflows/fossa.yml | 38 +++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index cd17eb2e49..854c52832c 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -13,21 +13,23 @@ jobs: matrix: node-version: [10.x, 12.x, 14.x, 15.x] - steps: - - uses: actions/checkout@v2 - - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v1 - with: - node-version: ${{ matrix.node-version }} - - run: npm ci - - run: npm run build --if-present - - run: npm test - # Runs a set of commands to initialize and analyze with FOSSA - - name: run FOSSA analysis - env: - # FOSSA Push-Only API Token - FOSSA_API_KEY: '9ee7e8893660832a7387dcc32377fb61' - run: | - curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash - fossa init - fossa analyze +steps: + - uses: actions/checkout@v2 + - uses: borales/actions-yarn@v2.0.0 + with: + cmd: install + - uses: borales/actions-yarn@v2.0.0 + with: + cmd: build + - uses: borales/actions-yarn@v2.0.0 + with: + cmd: test + # Runs a set of commands to initialize and analyze with FOSSA + - name: run FOSSA analysis + env: + # FOSSA Push-Only API Token + FOSSA_API_KEY: '9ee7e8893660832a7387dcc32377fb61' + run: | + curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash + fossa init + fossa analyze From e7846659e01726a69253a82002ccc61a637f7ca7 Mon Sep 17 00:00:00 2001 From: Ihor Dvoretskyi Date: Mon, 18 Jan 2021 22:28:04 +0200 Subject: [PATCH 5/9] fossa.yml cleanup Signed-off-by: Ihor Dvoretskyi --- .github/workflows/fossa.yml | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index 854c52832c..7707c355de 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -11,19 +11,10 @@ jobs: strategy: matrix: - node-version: [10.x, 12.x, 14.x, 15.x] + node-version: [14.x] steps: - uses: actions/checkout@v2 - - uses: borales/actions-yarn@v2.0.0 - with: - cmd: install - - uses: borales/actions-yarn@v2.0.0 - with: - cmd: build - - uses: borales/actions-yarn@v2.0.0 - with: - cmd: test # Runs a set of commands to initialize and analyze with FOSSA - name: run FOSSA analysis env: From 3ca368e6295320580fe1ff2435b45eba6dd16e6f Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Wed, 20 Jan 2021 16:23:23 +0100 Subject: [PATCH 6/9] Update fossa.yml --- .github/workflows/fossa.yml | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index 7707c355de..7ab012687b 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -13,14 +13,14 @@ jobs: matrix: node-version: [14.x] -steps: - - uses: actions/checkout@v2 - # Runs a set of commands to initialize and analyze with FOSSA - - name: run FOSSA analysis - env: - # FOSSA Push-Only API Token - FOSSA_API_KEY: '9ee7e8893660832a7387dcc32377fb61' - run: | - curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash - fossa init - fossa analyze + steps: + - uses: actions/checkout@v2 + # Runs a set of commands to initialize and analyze with FOSSA + - name: run FOSSA analysis + env: + # FOSSA Push-Only API Token + FOSSA_API_KEY: '9ee7e8893660832a7387dcc32377fb61' + run: | + curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash + fossa init + fossa analyze From 56ccf85d429901db7dfc7f7fc0790c7070230d0c Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Wed, 20 Jan 2021 17:39:40 +0100 Subject: [PATCH 7/9] Update fossa.yml --- .github/workflows/fossa.yml | 36 +++++++++++++++++++++++------------- 1 file changed, 23 insertions(+), 13 deletions(-) diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index 7ab012687b..38f227d88b 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -9,18 +9,28 @@ jobs: build: runs-on: ubuntu-latest - strategy: - matrix: - node-version: [14.x] - steps: - - uses: actions/checkout@v2 - # Runs a set of commands to initialize and analyze with FOSSA - - name: run FOSSA analysis - env: - # FOSSA Push-Only API Token - FOSSA_API_KEY: '9ee7e8893660832a7387dcc32377fb61' + - name: Checkout + uses: actions/checkout@v2.3.4 + + # We use this to modify the generated .fossa.yml + - name: Install yq + run: sudo snap install yq + + - name: Install Fossa + run: "curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash" + + - name: Configure Fossa + # The --option flag for fossa init does not work yet, see https://github.com/fossas/fossa-cli/issues/614 run: | - curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash - fossa init - fossa analyze + fossa init --project PROJECT_NAME + yq eval -i '.analyze.modules[].options.strategy = "yarn-list"' .fossa.yml + yq eval -i 'del(.analyze.modules[] | select(.type == "mvn"))' .fossa.yml + + - name: Show config + run: cat .fossa.yml + + - name: Fossa Analyze + env: + FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }} + run: fossa analyze --branch "$GITHUB_REF" From 586142f9cdd348c0b0be51605af95a4962232f06 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Wed, 20 Jan 2021 17:43:28 +0100 Subject: [PATCH 8/9] Update fossa.yml --- .github/workflows/fossa.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index 38f227d88b..0038658178 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -32,5 +32,6 @@ jobs: - name: Fossa Analyze env: - FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }} + # FOSSA Push-Only API Token + FOSSA_API_KEY: 9ee7e8893660832a7387dcc32377fb61 run: fossa analyze --branch "$GITHUB_REF" From b828d6733109f7846840053e98a64dc6939b1ff8 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Wed, 20 Jan 2021 18:16:15 +0100 Subject: [PATCH 9/9] Update fossa.yml --- .github/workflows/fossa.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index 0038658178..9f95854f01 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -25,7 +25,14 @@ jobs: run: | fossa init --project PROJECT_NAME yq eval -i '.analyze.modules[].options.strategy = "yarn-list"' .fossa.yml - yq eval -i 'del(.analyze.modules[] | select(.type == "mvn"))' .fossa.yml + + # This deletes entries for template and example packages found within packages and plugins + # Seems like yq has a bug that causes only a subset of all matches to be deleted each run + yq eval -i 'del(.analyze.modules[] | select(.path == "*/*/**"))' .fossa.yml + yq eval -i 'del(.analyze.modules[] | select(.path == "*/*/**"))' .fossa.yml + yq eval -i 'del(.analyze.modules[] | select(.path == "*/*/**"))' .fossa.yml + yq eval -i 'del(.analyze.modules[] | select(.path == "*/*/**"))' .fossa.yml + yq eval -i 'del(.analyze.modules[] | select(.path == "*/*/**"))' .fossa.yml - name: Show config run: cat .fossa.yml