Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GitHub Actions: Reinstate fossa.com integration #1244

Closed
lukpueh opened this issue Dec 17, 2020 · 7 comments · Fixed by #1767
Closed

GitHub Actions: Reinstate fossa.com integration #1244

lukpueh opened this issue Dec 17, 2020 · 7 comments · Fixed by #1767
Assignees

Comments

@lukpueh
Copy link
Member

lukpueh commented Dec 17, 2020

Description of issue or feature request:
A recent switch from Travis (and Appveyor) to GitHub Actions removed fossa.com integration from our CI setup. (see #1242)

Current behavior:
No publication of license data on fossa.com
No fossa.com badge

Expected behavior:
Re-instate publication of license data on fossa.com
Re-add fossa.com badge (revert 0ab9ee7)

@jku
Copy link
Member

jku commented Nov 3, 2021

Copying discussion from duplicate:

me:

There does not seem to be anything preventing enabling FOSSA now: GH actions is directly supported via an OAuth GitHub App.

Maybe it makes sense to evaluate the need for FOSSA before we enable it though:

  • dependency updates are handled by dependabot
  • dependabot also does vulnerability alerts (based on CVEs and advisories) for the pip ecosystem

That leaves ... license compliance checks? is there something else that fossa provides?

lukas

IIRC fossa is or at least was a requirement for the https://bestpractices.coreinfrastructure.org gold badge.

@jku
Copy link
Member

jku commented Nov 3, 2021

I had a look and I think the CII requirements do not ask for specific tools (and fossa is not mentioned in the TUF entry). The analysis section should be relevant: https://bestpractices.coreinfrastructure.org/en/projects/1351#analysis

I want to mention that I was honestly asking about the FOSSA features -- I'm not familiar with it and their documentation is a bit vague so I'm not sure if it does something we'd be interested in.

@lukpueh
Copy link
Member Author

lukpueh commented Nov 3, 2021

I had a look and I think the CII requirements do not ask for specific tools (and fossa is not mentioned in the TUF entry). The analysis section should be relevant: https://bestpractices.coreinfrastructure.org/en/projects/1351#analysis

Thanks for checking, but I think you looked up the "passing"-level criteria. "Gold"-level (you can toggle at the top) has the following criterion under Quality -> Automated test suite:

"The project MUST have FLOSS automated test suite(s) that provide at least 90% statement coverage if there is at least one FLOSS tool that can measure this criterion in the selected language"

I want to mention that I was honestly asking about the FOSSA features -- I'm not familiar with it and their documentation is a bit vague so I'm not sure if it does something we'd be interested in.

I am not familiar with it either.

@jku
Copy link
Member

jku commented Nov 3, 2021

"The project MUST have FLOSS automated test suite(s) that provide at least 90% statement coverage if there is at least one FLOSS tool that can measure this criterion in the selected language"

unittest + coverage fills this requirement, no?

@lukpueh
Copy link
Member Author

lukpueh commented Nov 3, 2021

🤦 I completely misread that sentence. For some reason I thought that "FLOSS automated test suite" was referring to license scanning.

@lukpueh
Copy link
Member Author

lukpueh commented Nov 3, 2021

Maybe @JustinCappos remembers why this was enabled in late 2017? (See 600e25f).

@lukpueh
Copy link
Member Author

lukpueh commented Nov 3, 2021

@caniszczyk, you seem to have initiated this feature in #509. Would you mind letting us in on the original motivation?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants