feat(fossa): switch OSS PR scan to native gdc-fossa-cli action#29
Open
petr-klemsinsky wants to merge 1 commit into
Open
feat(fossa): switch OSS PR scan to native gdc-fossa-cli action#29petr-klemsinsky wants to merge 1 commit into
petr-klemsinsky wants to merge 1 commit into
Conversation
Replace Jenkins trigger with native fossa/pr-scan composite action using the gdc-fossa-cli container. Adds the fossa/pr-scan action to this repo following the same pattern as gooddata/github-actions. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe PR replaces a Jenkins-triggered FOSSA OSS scan workflow with a native GitHub composite action. It adds ChangesFOSSA PR scan path
Sequence Diagram(s)sequenceDiagram
participant GHWorkflow as GitHub Actions workflow
participant FossaAction as fossa/pr-scan action
participant ScanScript as scan.sh
participant DockerCLI as docker
participant FossaTool as fossa_scanning_tool
GHWorkflow->>FossaAction: runs PR scan step
FossaAction->>ScanScript: executes Bash with env vars
ScanScript->>DockerCLI: pulls selected scan image
ScanScript->>DockerCLI: starts container with mounts and scan args
DockerCLI->>FossaTool: runs the FOSSA scan
FossaTool-->>ScanScript: writes analyze_failed.txt or completes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fossa-oss-pr-scan.yaml:
- Around line 20-24: The workflow is still invoking the remote fossa/pr-scan
action via the gooddata/github-actions-public reference, so it won’t validate
the local action files introduced in this PR. Update the fossa-oss-pr-scan
workflow to use the in-repo fossa/pr-scan action after checking out the PR
branch, and change the checkout step from the nonexistent actions/checkout@v7 to
the stable actions/checkout@v4. Use the existing workflow job and fossa/pr-scan
action reference to locate the change.
In `@fossa/pr-scan/scan.sh`:
- Around line 57-63: The config handling in scan.sh is stripping gdc_conf down
to basename, which loses the path discovered under src_dir and can collide
across duplicate filenames. Update the gdc_conf handling in the config-loading
block and the later fossa_scanning_tool invocation to preserve the path relative
to the repo root instead of basename, using the existing gdc_conf variable so
each matched gdc_fossa*.yaml maps to the correct module.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 733afefd-f6fe-43e9-b7cf-c037f81b14c5
📒 Files selected for processing (3)
.github/workflows/fossa-oss-pr-scan.yamlfossa/pr-scan/action.ymlfossa/pr-scan/scan.sh
Comment on lines
+20
to
+24
| - uses: gooddata/github-actions-public/fossa/pr-scan@master | ||
| with: | ||
| server: ${{ secrets.JENKINS_ADDRESS }} | ||
| folder: compliance | ||
| job-name: "${{ github.event.repository.name }}-fossa-scanning-oss-zuul" | ||
| vault-url: ${{ secrets.VAULT_ADDRESS }} | ||
| params: |- | ||
| { | ||
| "GH_BRANCH":"${{ github.base_ref }}", | ||
| "GH_REF":"${{ github.ref }}", | ||
| "GH_COMMIT":"${{ github.event.pull_request.head.sha }}", | ||
| "GH_URL":"git@github.com:", | ||
| "GH_CHANGE":"${{ github.event.pull_request.number }}", | ||
| "GH_PROJECT":"${{ github.repository }}", | ||
| "GH_PR_NUMBER":"${{ github.event.pull_request.number }}", | ||
| "BUILD_BY_GITHUB":"true", | ||
| "GH_PIPELINE":"gate" | ||
| } | ||
| fossa-api-key: ${{ secrets.FOSSA_API_KEY }} | ||
| npm-auth-token: ${{ secrets.NPM_TOKEN }} | ||
| github-token: ${{ secrets.TOKEN_GITHUB_YENKINS }} |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if the fossa/pr-scan directory exists
fd -t d "fossa" --max-depth 2
# Check the full workflow file for existing checkout steps
cat -n .github/workflows/fossa-oss-pr-scan.yamlRepository: gooddata/github-actions-public
Length of output: 1010
Use the local in-repo action instead of @master and correct the checkout version.
uses: {owner}/{repo}/{path}@{ref} fetches the action from the remote reference, bypassing the new fossa/pr-scan files added in this PR. Since this PR introduces the local action, the workflow must check out the PR branch and run the local action to validate the changes. Additionally, actions/checkout@v7 does not exist; use the stable actions/checkout@v4.
Suggested change
steps:
+ - uses: actions/checkout@v4
- uses: gooddata/github-actions-public/fossa/pr-scan@master
+ with:
+ fossa-api-key: ${{ secrets.FOSSA_API_KEY }}
+ npm-auth-token: ${{ secrets.NPM_TOKEN }}
+ github-token: ${{ secrets.TOKEN_GITHUB_YENKINS }}Replace the remote uses with the local path:
- uses: gooddata/github-actions-public/fossa/pr-scan@master
+ uses: ./fossa/pr-scan📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - uses: gooddata/github-actions-public/fossa/pr-scan@master | |
| with: | |
| server: ${{ secrets.JENKINS_ADDRESS }} | |
| folder: compliance | |
| job-name: "${{ github.event.repository.name }}-fossa-scanning-oss-zuul" | |
| vault-url: ${{ secrets.VAULT_ADDRESS }} | |
| params: |- | |
| { | |
| "GH_BRANCH":"${{ github.base_ref }}", | |
| "GH_REF":"${{ github.ref }}", | |
| "GH_COMMIT":"${{ github.event.pull_request.head.sha }}", | |
| "GH_URL":"git@github.com:", | |
| "GH_CHANGE":"${{ github.event.pull_request.number }}", | |
| "GH_PROJECT":"${{ github.repository }}", | |
| "GH_PR_NUMBER":"${{ github.event.pull_request.number }}", | |
| "BUILD_BY_GITHUB":"true", | |
| "GH_PIPELINE":"gate" | |
| } | |
| fossa-api-key: ${{ secrets.FOSSA_API_KEY }} | |
| npm-auth-token: ${{ secrets.NPM_TOKEN }} | |
| github-token: ${{ secrets.TOKEN_GITHUB_YENKINS }} | |
| - uses: actions/checkout@v4 | |
| - uses: ./fossa/pr-scan | |
| with: | |
| fossa-api-key: ${{ secrets.FOSSA_API_KEY }} | |
| npm-auth-token: ${{ secrets.NPM_TOKEN }} | |
| github-token: ${{ secrets.TOKEN_GITHUB_YENKINS }} |
🧰 Tools
🪛 zizmor (1.26.1)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/fossa-oss-pr-scan.yaml around lines 20 - 24, The workflow
is still invoking the remote fossa/pr-scan action via the
gooddata/github-actions-public reference, so it won’t validate the local action
files introduced in this PR. Update the fossa-oss-pr-scan workflow to use the
in-repo fossa/pr-scan action after checking out the PR branch, and change the
checkout step from the nonexistent actions/checkout@v7 to the stable
actions/checkout@v4. Use the existing workflow job and fossa/pr-scan action
reference to locate the change.
Source: Linters/SAST tools
Comment on lines
+57
to
+63
| if [ -n "${gdc_conf}" ] && [ -f "${gdc_conf}" ]; then | ||
| local img_override | ||
| img_override="$(yq -r '.scan_image | select(. != null)' "${gdc_conf}")" | ||
| [ -n "${img_override}" ] && scan_img="${img_override}" | ||
| java_version="$(yq -r '.java_version | select(. != null)' "${gdc_conf}")" | ||
| conf_arg=(--gdc-conf "$(basename "${gdc_conf}")") | ||
| fi |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Preserve the config path relative to the repo root.
The loop deliberately finds gdc_fossa*.yaml anywhere under src_dir, but conf_arg drops each match to basename(...). Any config in a subdirectory—or two configs sharing the same filename—will be passed to fossa_scanning_tool with the wrong path or collide on the same name, so the wrong module gets scanned.
Suggested change
run_scan() {
local scan_img="$1" gdc_conf="$2"
local java_version="" conf_arg=()
local mount_args=()
if [ -n "${gdc_conf}" ] && [ -f "${gdc_conf}" ]; then
+ local rel_conf="${gdc_conf#${src_dir}/}"
local img_override
img_override="$(yq -r '.scan_image | select(. != null)' "${gdc_conf}")"
[ -n "${img_override}" ] && scan_img="${img_override}"
java_version="$(yq -r '.java_version | select(. != null)' "${gdc_conf}")"
- conf_arg=(--gdc-conf "$(basename "${gdc_conf}")")
+ conf_arg=(--gdc-conf "${rel_conf}")
fiAlso applies to: 88-95
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@fossa/pr-scan/scan.sh` around lines 57 - 63, The config handling in scan.sh
is stripping gdc_conf down to basename, which loses the path discovered under
src_dir and can collide across duplicate filenames. Update the gdc_conf handling
in the config-loading block and the later fossa_scanning_tool invocation to
preserve the path relative to the repo root instead of basename, using the
existing gdc_conf variable so each matched gdc_fossa*.yaml maps to the correct
module.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fossa-oss-pr-scan.yaml: Replace Jenkins trigger with the nativefossa/pr-scancomposite action usinggdc-fossa-cli(same tooling as the regular scan — OSS vs internal distinction is only in which repos the workflow is installed on)fossa/pr-scan/: Add the composite action andscan.shscript, mirrored fromgooddata/github-actionsTest plan
fossa-nativejob runs successfullyfossa-jenkinsjob appears in the Actions run🤖 Generated with Claude Code