fossa.yml

# Name of the GitHub Action workflow
name: FOSSA Report Generation

# Event triggers for the workflow
on:
  workflow_call:
    inputs:
      org:
        required: false
        type: string
        description: 'Organization name: liquibase or datical'
  workflow_dispatch:
  
# Define the jobs in the workflow
jobs:
  fossa-scan:
    # Specifies the type of runner to use
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    # Sequence of steps that make up a single job
    steps:
      # Checkout the code to the GitHub runner
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up JDK for Datical
        if: inputs.org == 'datical'
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '11'
          cache: 'maven'
          server-id: datical
          server-username: REPO_MAVEN_USER
          server-password: REPO_MAVEN_PASSWORD

      - name: Log inputs
        run: |
          echo "Org: ${{ inputs.org }}"

      - name: Set up JDK for Liquibase
        if: inputs.org == 'liquibase'
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'

            #look for dependencies in maven
      - name: maven-settings-xml-action for Liquibase
        if: inputs.org == 'liquibase'
        uses: whelk-io/maven-settings-xml-action@v22
        with:
          repositories: |
            [
              {
                "id": "liquibase",
                "url": "https://maven.pkg.github.com/liquibase/liquibase",
                "releases": {
                  "enabled": "false"
                },
                "snapshots": {
                  "enabled": "true",
                  "updatePolicy": "always"
                }
              },
              {
                "id": "liquibase-pro",
                "url": "https://maven.pkg.github.com/liquibase/liquibase-pro",
                "releases": {
                  "enabled": "false"
                },
                "snapshots": {
                  "enabled": "true",
                  "updatePolicy": "always"
                }
              }
            ]
          servers: |
            [
              {
                "id": "liquibase-pro",
                "username": "liquibot",
                "password": "${{ secrets.LIQUIBOT_PAT }}"
              },
              {
                "id": "liquibase",
                "username": "liquibot",
                "password": "${{ secrets.LIQUIBOT_PAT }}"
              }
            ]

      - name: run FOSSA CLI
        uses: fossas/fossa-action@main
        with:
          api-key: ${{ secrets.FOSSA_API_KEY }}
          branch: ${{ github.ref }}

      - name: Get the commit sha
        id: get_commit_sha
        run: |
          commit_sha=`(git rev-parse HEAD)`
          echo "commit_sha=${commit_sha}" >> $GITHUB_OUTPUT

      - name: Get repository name
        id: get_repo_name
        run: echo "repo_name=${{ github.event.repository.name }}" >> $GITHUB_OUTPUT

          # https://docs.fossa.com/docs/download-fossa-project-attribution-reports
          # 7retries×30seconds=210seconds
      -   name: Datical- Set the dependency metadata information
          if: inputs.org == 'datical'
          run: |
            mkdir -p /home/runner/work/${{ steps.get_repo_name.outputs.repo_name }}/fossa_reports
          
            max_retries=8
            retry_delay=30
            attempt=0
            success=0
          
            while [ $attempt -lt $max_retries ]; do
            curl --location 'https://app.fossa.com/api/revisions/custom%2B40163%2Fgithub.com%2FDatical%2F${{ steps.get_repo_name.outputs.repo_name }}%24${{ steps.get_commit_sha.outputs.commit_sha }}/attribution/download?format=CSV&includeDirectDependencies=true&includeDeepDependencies=true&download=true' \
            --header 'Authorization: Bearer ${{ secrets.FOSSA_COMBINED_REPORT }}' \
            -o /home/runner/work/${{ steps.get_repo_name.outputs.repo_name }}/fossa_reports/${{ steps.get_repo_name.outputs.repo_name }}.csv && success=1 && break
            
            echo "Curl failed, retrying in $retry_delay seconds..."
            attempt=$((attempt + 1))
            sleep $retry_delay
            done
          
            if [ $success -ne 1 ]; then
            echo "Failed to download the report after $max_retries attempts"
            exit 1
            fi
          
            ls -l /home/runner/work/${{ steps.get_repo_name.outputs.repo_name }}/fossa_reports
            cat /home/runner/work/${{ steps.get_repo_name.outputs.repo_name }}/fossa_reports/${{ steps.get_repo_name.outputs.repo_name }}.csv || echo "File is empty or not found"

          # 7retries×30seconds=210seconds
      -   name: Liquibase- Set the dependency metadata information
          if: inputs.org == 'liquibase'
          run: |
            mkdir -p /home/runner/work/${{ steps.get_repo_name.outputs.repo_name }}/fossa_reports
          
            max_retries=8
            retry_delay=30
            attempt=0
            success=0
          
            while [ $attempt -lt $max_retries ]; do
            curl --location 'https://app.fossa.com/api/revisions/custom%2B40163%2Fgithub.com%2Fliquibase%2F${{ steps.get_repo_name.outputs.repo_name }}%24${{ steps.get_commit_sha.outputs.commit_sha }}/attribution/download?format=CSV&includeDirectDependencies=true&includeDeepDependencies=true&download=true' \
            --header 'Authorization: Bearer ${{ secrets.FOSSA_COMBINED_REPORT }}' \
            -o /home/runner/work/${{ steps.get_repo_name.outputs.repo_name }}/fossa_reports/${{ steps.get_repo_name.outputs.repo_name }}.csv && success=1 && break
            
            echo "Curl failed, retrying in $retry_delay seconds..."
            attempt=$((attempt + 1))
            sleep $retry_delay
            done
          
            if [ $success -ne 1 ]; then
            echo "Failed to download the report after $max_retries attempts"
            exit 1
            fi
          
            ls -l /home/runner/work/${{ steps.get_repo_name.outputs.repo_name }}/fossa_reports
            cat /home/runner/work/${{ steps.get_repo_name.outputs.repo_name }}/fossa_reports/${{ steps.get_repo_name.outputs.repo_name }}.csv || echo "File is empty or not found"

      # Upload report to S3
      -   name: Upload report to S3
          if: always()
          run: |
            aws s3 cp /home/runner/work/${{ steps.get_repo_name.outputs.repo_name }}/fossa_reports/${{ steps.get_repo_name.outputs.repo_name }}.csv s3://liquibaseorg-origin/enterprise_fossa_report/
          env:
              AWS_ACCESS_KEY_ID: ${{ secrets.LIQUIBASEORIGIN_ACCESS_KEY_ID }}
              AWS_SECRET_ACCESS_KEY: ${{ secrets.LIQUIBASEORIGIN_SECRET_ACCESS_KEY }}
              AWS_DEFAULT_REGION: us-east-1

      -   name : Upload to build page
          uses: actions/upload-artifact@v4
          with:
            name: fossa-reports
            path: |
              /home/runner/work/${{ steps.get_repo_name.outputs.repo_name }}/fossa_reports/${{ steps.get_repo_name.outputs.repo_name }}.csv