From 402daeba471fdc2fa9423b731675331e0fe284ee Mon Sep 17 00:00:00 2001 From: Aman Riat Date: Fri, 4 Sep 2026 15:44:24 -0400 Subject: [PATCH 1/3] chore(cra): onboard solace-queue-browser to FOSSA SCA scanning Adds the standard Solace SCA scan and solace-cloud-manifest write, matching the other solacecommunity repos onboarded under the CRA compliance inventory (Confluence "CRA Compliance - Product Inventory & Guardian Coverage Audit", Annex A.12). Two deliberate differences from the existing solacecommunity workflows: - squad is "prof-services", not "cto". A.12 is the Professional Services inventory; writing "cto" here would route findings into cto_vulnerabilities and file CTO Jiras instead of PS ones. - update_manifest also accepts workflow_dispatch. The existing repos gate the write on `github.event_name == 'push'` only, which means a dispatched run scans and then silently skips the manifest write. The default-branch check still gates the write. Scanning is read-only: the workflow adds no publish, release or image step. Co-Authored-By: Claude Opus 5 (1M context) --- .fossa.yml | 25 +++++++++ .github/workflows/sca-scan-and-guard.yml | 67 ++++++++++++++++++++++++ 2 files changed, 92 insertions(+) create mode 100644 .fossa.yml create mode 100644 .github/workflows/sca-scan-and-guard.yml diff --git a/.fossa.yml b/.fossa.yml new file mode 100644 index 0000000..4e5fccd --- /dev/null +++ b/.fossa.yml @@ -0,0 +1,25 @@ +version: 3 + +project: + locator: solacecommunity_solace-queue-browser + id: solacecommunity_solace-queue-browser + name: solace-queue-browser + teams: [] + labels: + - javascript + +vendoredDependencies: + forceRescans: false + scanMethod: CLILicenseScan + licenseScanPathFilters: + exclude: + - "./.git" + - "./.github" + +paths: + exclude: + - ./.git + - ./.github + +telemetry: + scope: full diff --git a/.github/workflows/sca-scan-and-guard.yml b/.github/workflows/sca-scan-and-guard.yml new file mode 100644 index 0000000..320dedc --- /dev/null +++ b/.github/workflows/sca-scan-and-guard.yml @@ -0,0 +1,67 @@ +name: SCA Scan +on: + pull_request: + branches: [main] + push: + branches: [main] + # Lets the scan be re-run against trunk without waiting for a push. Needed + # because a merge commit carrying [skip ci] in its body produces no run at + # all, which leaves the repo scanned-but-unregistered (DATAGO-150669). + workflow_dispatch: + +permissions: + contents: read + id-token: write + packages: read + actions: read + statuses: write + checks: write + pull-requests: write + +jobs: + sca_scan: + uses: SolaceDev/solace-public-workflows/.github/workflows/sca-scan-and-guard.yaml@main + with: + setup_actions: '["setup-node"]' + secrets: + FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }} + + update_manifest: + needs: sca_scan + # The manifest records what landed on the default branch, so it must never + # be written from a PR run -- the scan still runs, the write does not. + # workflow_dispatch is allowed through because a dispatched run against + # trunk is exactly how a [skip ci] merge gets registered after the fact; + # the default-branch check still gates the write either way. + if: >- + needs.sca_scan.result == 'success' + && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') + && github.ref_name == github.event.repository.default_branch + runs-on: ubuntu-latest + permissions: + id-token: write + contents: read + packages: read + steps: + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 + with: + role-to-assume: ${{ secrets.MANIFEST_AWS_ROLE }} + aws-region: us-east-1 + + - name: Update solace-cloud-manifest + uses: SolaceDev/solace-public-workflows/.github/actions/cicd-helper@main + with: + rc_step: add_item_from_json_to_dynamodb_table + ddb_table_name: solace-cloud-manifest + ddb_partition_key: squad + ddb_sort_key: repository + ddb_item_to_be_added: | + { + "squad": "prof-services", + "repository": "${{ github.event.repository.name }}", + "dev": { + "sha": "${{ github.sha }}", + "version": "${{ github.ref_name }}" + } + } From 30a07502f6099ef62d51292948ad7c2aa9883b21 Mon Sep 17 00:00:00 2001 From: Aman Riat Date: Fri, 4 Sep 2026 15:46:12 -0400 Subject: [PATCH 2/3] chore(cra): add required .github/workflow-config.json The shared SCA workflow loads .github/workflow-config.json unconditionally and exits 1 when it is absent ("Configuration file not found"), before it ever reaches the FOSSA key. Matches the config used by the other solacecommunity repos: policy and vulnerability gates in REPORT mode, so the scan publishes findings without failing the build. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflow-config.json | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 .github/workflow-config.json diff --git a/.github/workflow-config.json b/.github/workflow-config.json new file mode 100644 index 0000000..cacb8de --- /dev/null +++ b/.github/workflow-config.json @@ -0,0 +1,8 @@ +{ + "sca_scanning": { + "fossa": { + "policy": { "mode": "REPORT" }, + "vulnerability": { "mode": "REPORT" } + } + } +} From 2d31ab955a9c114baf46ab1f2ad6fa08961ffd5c Mon Sep 17 00:00:00 2001 From: Aman Riat Date: Wed, 16 Sep 2026 16:13:00 -0400 Subject: [PATCH 3/3] refactor(cra): move .fossa.yml under .github/workflows and pin toolchain versions The FOSSA CLI only reads .fossa.yml from the scan root, so relocating it requires passing fossa.config explicitly via additional_scan_params -- without that the CLI silently falls back to defaults and registers the scan under a different project. Toolchain versions are now pinned rather than inherited: the shared workflow still defaults to node 20, which reached end-of-life in 2026. Co-Authored-By: Claude Opus 5 --- .fossa.yml => .github/workflows/.fossa.yml | 0 .github/workflows/sca-scan-and-guard.yml | 3 +++ 2 files changed, 3 insertions(+) rename .fossa.yml => .github/workflows/.fossa.yml (100%) diff --git a/.fossa.yml b/.github/workflows/.fossa.yml similarity index 100% rename from .fossa.yml rename to .github/workflows/.fossa.yml diff --git a/.github/workflows/sca-scan-and-guard.yml b/.github/workflows/sca-scan-and-guard.yml index 320dedc..bf504e7 100644 --- a/.github/workflows/sca-scan-and-guard.yml +++ b/.github/workflows/sca-scan-and-guard.yml @@ -22,6 +22,9 @@ jobs: sca_scan: uses: SolaceDev/solace-public-workflows/.github/workflows/sca-scan-and-guard.yaml@main with: + additional_scan_params: | + fossa.config=.github/workflows/.fossa.yml + node_version: "24" setup_actions: '["setup-node"]' secrets: FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}