From 1b5ef3bd9900c10b973c8cc118348cc26459bcf3 Mon Sep 17 00:00:00 2001 From: Aman Riat Date: Tue, 1 Sep 2026 18:16:59 -0400 Subject: [PATCH 1/2] feat: add FOSSA SCA scanning and dependency manifest registration Adds a single root FOSSA scan (no matrix -- one repo, one FOSSA project, one manifest row) plus a manifest write guarded to push-on-default-branch, so pull request runs scan without writing. Co-Authored-By: Claude Opus 5 (1M context) --- .fossa.yml | 25 ++++++++++ .github/workflow-config.json | 8 ++++ .github/workflows/sca-scan-and-guard.yml | 60 ++++++++++++++++++++++++ 3 files changed, 93 insertions(+) create mode 100644 .fossa.yml create mode 100644 .github/workflow-config.json create mode 100644 .github/workflows/sca-scan-and-guard.yml diff --git a/.fossa.yml b/.fossa.yml new file mode 100644 index 0000000..fa43ba0 --- /dev/null +++ b/.fossa.yml @@ -0,0 +1,25 @@ +version: 3 + +project: + locator: solacecommunity_angular-solace-message-client + id: solacecommunity_angular-solace-message-client + name: angular-solace-message-client + teams: [] + labels: + - typescript + +vendoredDependencies: + forceRescans: false + scanMethod: CLILicenseScan + licenseScanPathFilters: + exclude: + - "./.git" + - "./.github" + +paths: + exclude: + - ./.git + - ./.github + +telemetry: + scope: full diff --git a/.github/workflow-config.json b/.github/workflow-config.json new file mode 100644 index 0000000..cacb8de --- /dev/null +++ b/.github/workflow-config.json @@ -0,0 +1,8 @@ +{ + "sca_scanning": { + "fossa": { + "policy": { "mode": "REPORT" }, + "vulnerability": { "mode": "REPORT" } + } + } +} diff --git a/.github/workflows/sca-scan-and-guard.yml b/.github/workflows/sca-scan-and-guard.yml new file mode 100644 index 0000000..31cc247 --- /dev/null +++ b/.github/workflows/sca-scan-and-guard.yml @@ -0,0 +1,60 @@ +name: SCA Scan +on: + pull_request: + branches: [master] + push: + branches: [master] + +permissions: + contents: read + id-token: write + packages: read + actions: read + statuses: write + checks: write + pull-requests: write + +jobs: + sca_scan: + uses: SolaceDev/solace-public-workflows/.github/workflows/sca-scan-and-guard.yaml@main + with: + setup_actions: '["setup-node"]' + secrets: + FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }} + + update_manifest: + needs: sca_scan + # The manifest records what landed on the default branch, so it must never + # be written from a PR run -- the scan still runs, the write does not. + if: >- + needs.sca_scan.result == 'success' + && github.event_name == 'push' + && github.ref_name == github.event.repository.default_branch + runs-on: ubuntu-latest + permissions: + id-token: write + contents: read + packages: read + steps: + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 + with: + role-to-assume: ${{ secrets.MANIFEST_AWS_ROLE }} + aws-region: us-east-1 + + - name: Update solace-cloud-manifest + uses: SolaceDev/solace-public-workflows/.github/actions/cicd-helper@main + with: + rc_step: add_item_from_json_to_dynamodb_table + ddb_table_name: solace-cloud-manifest + ddb_partition_key: squad + ddb_sort_key: repository + ddb_item_to_be_added: | + { + "squad": "cto", + "repository": "${{ github.event.repository.name }}", + "dev": { + "sha": "${{ github.sha }}", + "version": "${{ github.ref_name }}" + } + } From 7bc82ad864c76839f7f917c9d306a4c424b92621 Mon Sep 17 00:00:00 2001 From: Aman Riat Date: Thu, 3 Sep 2026 13:34:05 -0400 Subject: [PATCH 2/2] feat: allow the scan and manifest write to be triggered manually [skip ci] This repo publishes an artifact on push to its default branch, so merging the onboarding change would also cut a release. Adding workflow_dispatch means the merge can carry a skip-ci commit -- which suppresses every workflow on that push, the publish one included -- and the scan plus manifest write can then be run by hand against the default branch. The update_manifest guard previously required github.event_name == 'push', so a dispatched run would have scanned and silently skipped the write. It now accepts either event while keeping the default-branch check, so dispatching against any other ref still scans without writing. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/sca-scan-and-guard.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sca-scan-and-guard.yml b/.github/workflows/sca-scan-and-guard.yml index 31cc247..325b246 100644 --- a/.github/workflows/sca-scan-and-guard.yml +++ b/.github/workflows/sca-scan-and-guard.yml @@ -4,6 +4,7 @@ on: branches: [master] push: branches: [master] + workflow_dispatch: permissions: contents: read @@ -26,9 +27,15 @@ jobs: needs: sca_scan # The manifest records what landed on the default branch, so it must never # be written from a PR run -- the scan still runs, the write does not. + # + # workflow_dispatch is allowed so this repo can be merged with a skip-ci + # commit (which suppresses every workflow on that push, including the + # release/publish one) and then have the scan and manifest write triggered + # by hand. The default-branch check still applies, so dispatching against + # any other ref scans without writing. if: >- needs.sca_scan.result == 'success' - && github.event_name == 'push' + && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref_name == github.event.repository.default_branch runs-on: ubuntu-latest permissions: