Introduce a reusable GitHub Action for FOSSA SCA scans with monorepo and selective-scan support#13
Introduce a reusable GitHub Action for FOSSA SCA scans with monorepo and selective-scan support#13sureshrupasinghe89 wants to merge 7 commits into
Conversation
📝 WalkthroughOverviewThis pull request introduces a reusable GitHub Action for running FOSSA SCA scans, enabling standardized scanning patterns across repositories. The action supports both single-repository scans from the root directory and monorepo/multi-component scans using configurable working directories and distinct FOSSA project identifiers. Key ChangesNew GitHub Action ImplementationAdded
The action defines 13 inputs (required DocumentationAdded
Repository-Level Changes
ImpactProvides teams with a standardized, reusable scanning solution that supports both simple single-directory scans and complex monorepo architectures through configurable parameters and matrix-based workflows. WalkthroughThis pull request introduces a new FOSSA SCA (Software Composition Analysis) GitHub composite action that performs supply chain scanning and provides optional gating based on dependency licensing, security testing, and vulnerability severity. The action installs a pinned FOSSA CLI version, runs scans, optionally tests results and generates attribution reports, and can enforce a security gate by querying FOSSA's vulnerability API. Supporting documentation includes detailed configuration reference, usage examples ranging from basic scans to monorepo matrix setups, and admin guidance. The main repository README now references the new action, and 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/security/sca-fossa/action.yaml (1)
123-125: ⚡ Quick winConsider verifying CLI binary integrity.
The CLI version is pinned, which is good. For additional assurance, consider verifying the binary's checksum after download against a known value. FOSSA publishes checksums that can be used for this purpose.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/security/sca-fossa/action.yaml around lines 123 - 125, The install step currently pipes the remote install script via curl and executes it (curl ... | bash -s -- "${fossa_cli_version}"); update this to fetch the installer and the published checksum (using the same fossa_cli_version), verify the downloaded install-latest.sh or the downloaded fossa binary checksum against the published checksum before running bash -s --, and fail the action if the checksum does not match; reference the existing fossa_cli_version variable and the curl install-latest.sh invocation so you add a checksum download/verify step and only execute the installer on successful verification.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/security/sca-fossa/action.yaml:
- Around line 235-237: The heredoc using the fixed delimiter "EOF" when writing
the attribution report to GITHUB_OUTPUT can collide with report content; change
the script to generate and use a unique delimiter (e.g., compute a random/UUID
string stored in a variable like report_delim) and replace the three occurrences
of the hardcoded "EOF" in the block that writes to "${GITHUB_OUTPUT}" (the lines
using echo "report<<EOF", printf ... >> "${GITHUB_OUTPUT}", and echo "EOF" >>
"${GITHUB_OUTPUT}") so the heredoc start, body and end all use the unique
delimiter variable to prevent premature truncation.
In @.github/security/sca-fossa/README.md:
- Line 20: Prose says to pin actions but all action usage examples use `@main`;
update the README so examples match guidance by replacing occurrences of "`@main`"
in the examples with pinned refs (e.g., "`@v1.0.0`" or a commit SHA like
"`@abc1234`") OR alter the guidance line to explicitly allow using "`@main`" during
initial adoption and recommend pinning for production. Ensure the change touches
the instances shown in the document examples (the action references that
currently use "`@main`") so examples and advice are consistent.
- Line 293: The sentence in the README contains a grammatical redundancy ("when
there is a new latest stable version is available"); edit that sentence to
remove the extra verb — replace the phrase with either "when a new latest stable
version is available" or better "when a new stable version is available" so the
line reads: "The action currently installs a repo-managed FOSSA CLI version:
`v3.17.10`. Update the action itself when a new stable version is available."
---
Nitpick comments:
In @.github/security/sca-fossa/action.yaml:
- Around line 123-125: The install step currently pipes the remote install
script via curl and executes it (curl ... | bash -s -- "${fossa_cli_version}");
update this to fetch the installer and the published checksum (using the same
fossa_cli_version), verify the downloaded install-latest.sh or the downloaded
fossa binary checksum against the published checksum before running bash -s --,
and fail the action if the checksum does not match; reference the existing
fossa_cli_version variable and the curl install-latest.sh invocation so you add
a checksum download/verify step and only execute the installer on successful
verification.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 5bcd65bd-4cd2-4f1c-9fc6-cd15a5c9262a
⛔ Files ignored due to path filters (1)
.DS_Storeis excluded by!**/.DS_Store
📒 Files selected for processing (4)
.github/security/sca-fossa/README.md.github/security/sca-fossa/action.yaml.gitignoreREADME.md
| echo "report<<EOF" >> "${GITHUB_OUTPUT}" | ||
| printf '%s\n' "${report_output}" >> "${GITHUB_OUTPUT}" | ||
| echo "EOF" >> "${GITHUB_OUTPUT}" |
There was a problem hiding this comment.
Heredoc delimiter could collide with report content.
The delimiter EOF could appear as a standalone line in the attribution report, causing premature truncation of the report output. Consider using a more unique delimiter (e.g., a generated UUID or a longer random string) to eliminate this edge case.
Proposed fix
- echo "report<<EOF" >> "${GITHUB_OUTPUT}"
+ delimiter="FOSSA_REPORT_$(date +%s%N)"
+ echo "report<<${delimiter}" >> "${GITHUB_OUTPUT}"
printf '%s\n' "${report_output}" >> "${GITHUB_OUTPUT}"
- echo "EOF" >> "${GITHUB_OUTPUT}"
+ echo "${delimiter}" >> "${GITHUB_OUTPUT}"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| echo "report<<EOF" >> "${GITHUB_OUTPUT}" | |
| printf '%s\n' "${report_output}" >> "${GITHUB_OUTPUT}" | |
| echo "EOF" >> "${GITHUB_OUTPUT}" | |
| delimiter="FOSSA_REPORT_$(date +%s%N)" | |
| echo "report<<${delimiter}" >> "${GITHUB_OUTPUT}" | |
| printf '%s\n' "${report_output}" >> "${GITHUB_OUTPUT}" | |
| echo "${delimiter}" >> "${GITHUB_OUTPUT}" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/security/sca-fossa/action.yaml around lines 235 - 237, The heredoc
using the fixed delimiter "EOF" when writing the attribution report to
GITHUB_OUTPUT can collide with report content; change the script to generate and
use a unique delimiter (e.g., compute a random/UUID string stored in a variable
like report_delim) and replace the three occurrences of the hardcoded "EOF" in
the block that writes to "${GITHUB_OUTPUT}" (the lines using echo "report<<EOF",
printf ... >> "${GITHUB_OUTPUT}", and echo "EOF" >> "${GITHUB_OUTPUT}") so the
heredoc start, body and end all use the unique delimiter variable to prevent
premature truncation.
|
|
||
| ## Usage | ||
|
|
||
| Use a pinned release tag or commit SHA when consuming this action from another repository. |
There was a problem hiding this comment.
Pinning advice contradicts all examples.
Line 20 advises using pinned tags or SHAs, but every example in the document (lines 31, 47, 62, 80, 97, 114, 176, 251) uses @main. Users typically copy examples rather than follow prose guidance. Either update the examples to demonstrate pinning (e.g., @v1.0.0 or @abc1234) or revise the advice to acknowledge that @main is acceptable during initial adoption.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/security/sca-fossa/README.md at line 20, Prose says to pin actions
but all action usage examples use `@main`; update the README so examples match
guidance by replacing occurrences of "`@main`" in the examples with pinned refs
(e.g., "`@v1.0.0`" or a commit SHA like "`@abc1234`") OR alter the guidance line to
explicitly allow using "`@main`" during initial adoption and recommend pinning for
production. Ensure the change touches the instances shown in the document
examples (the action references that currently use "`@main`") so examples and
advice are consistent.
| needs: | ||
| - detect-changes |
There was a problem hiding this comment.
Workflow dependency prevents workflow_dispatch execution.
The fossa-scan job declares needs: detect-changes, but detect-changes is skipped when github.event_name == 'workflow_dispatch' (line 215). GitHub Actions skips jobs when a required dependency is skipped, so fossa-scan will never run on manual dispatch despite the job-level condition at lines 233-236.
🔧 Proposed fix: make the dependency conditional
fossa-scan:
if: |
github.event_name == 'workflow_dispatch' ||
needs.detect-changes.outputs.nextjs == 'true' ||
needs.detect-changes.outputs.go == 'true'
- needs:
- - detect-changes
+ needs: ${{ github.event_name != 'workflow_dispatch' && 'detect-changes' || '' }}
runs-on: ubuntu-latestAlternatively, restructure to avoid the conditional needs:
detect-changes:
- if: github.event_name != 'workflow_dispatch'
runs-on: ubuntu-latest
outputs:
nextjs: ${{ steps.filter.outputs.nextjs }}
go: ${{ steps.filter.outputs.go }}
steps:
+ - if: github.event_name != 'workflow_dispatch'
+ id: filter
- - id: filter
uses: dorny/paths-filter@v3| ## Notes | ||
|
|
||
| - The vulnerability gate is a WSO2-specific extension on top of the standard FOSSA analyze/test flow. | ||
| - The action currently installs a repo-managed FOSSA CLI version: `v3.17.10`. Update the action itself when there is a new latest stable version is available. |
There was a problem hiding this comment.
Fix grammatical error.
"when there is a new latest stable version is available" contains a double verb.
📝 Suggested fix
-- The action currently installs a repo-managed FOSSA CLI version: `v3.17.10`. Update the action itself when there is a new latest stable version is available.
+- The action currently installs a repo-managed FOSSA CLI version: `v3.17.10`. Update the action itself when a new stable version is available.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/security/sca-fossa/README.md at line 293, The sentence in the README
contains a grammatical redundancy ("when there is a new latest stable version is
available"); edit that sentence to remove the extra verb — replace the phrase
with either "when a new latest stable version is available" or better "when a
new stable version is available" so the line reads: "The action currently
installs a repo-managed FOSSA CLI version: `v3.17.10`. Update the action itself
when a new stable version is available."
|
Let's remove the |
2 participants
Description
This PR adds a reusable GitHub Action at .github/security/sca-fossa to standardize FOSSA SCA scanning across GitHub repositories.
The action is designed to cover both:
It also includes documentation for product teams on how to integrate the action into product specific repositories.
What was added
A reusable composite GitHub Action:
A consumer-facing integration guide:
A top-level repo reference in:
Key capabilities