Conversation
Adds the standard Solace SCA scan and solace-cloud-manifest write, matching
the other solacecommunity repos onboarded under the CRA compliance inventory
(Confluence "CRA Compliance - Product Inventory & Guardian Coverage Audit",
Annex A.12).
Two deliberate differences from the existing solacecommunity workflows:
- squad is "prof-services", not "cto". A.12 is the Professional Services
inventory; writing "cto" here would route findings into
cto_vulnerabilities and file CTO Jiras instead of PS ones.
- update_manifest also accepts workflow_dispatch. The existing repos gate
the write on `github.event_name == 'push'` only, which means a dispatched
run scans and then silently skips the manifest write. The default-branch
check still gates the write.
Scanning is read-only: the workflow adds no publish, release or image step.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The shared SCA workflow loads .github/workflow-config.json unconditionally and
exits 1 when it is absent ("Configuration file not found"), before it ever
reaches the FOSSA key. Matches the config used by the other solacecommunity
repos: policy and vulnerability gates in REPORT mode, so the scan publishes
findings without failing the build.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ain versions The FOSSA CLI only reads .fossa.yml from the scan root, so relocating it requires passing fossa.config explicitly via additional_scan_params -- without that the CLI silently falls back to defaults and registers the scan under a different project. Toolchain versions are now pinned rather than inherited: the shared workflow still defaults to node 20, which reached end-of-life in 2026. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds FOSSA SCA scanning so this repo is covered by Solace vulnerability reporting.
.fossa.yml— FOSSA project config.github/workflow-config.json— gates inREPORTmode.github/workflows/sca-scan-and-guard.yml— calls the shared Solace SCA workflowScanning is read-only: no publish, release, image-push or deploy step, and no application code, dependency or build changes. Gates are report-only, so a finding won't fail a build.