Merge pull request #250 from jiaqiluo/fossa

.github/workflows/fossa.yaml

@@ -4,30 +4,27 @@ on:
   push:
     branches:
       - master
-    tags:
-      - '*'
+    # For manual scans.
+    workflow_dispatch:
 
 jobs:
   fossa:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write # needed for the Vault authentication
-    continue-on-error: true # we know that fossa test will report errors
     steps:
-      - name: Load Secrets from Vault
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Read FOSSA token
         uses: rancher-eio/read-vault-secrets@main
         with:
           secrets: |
-            secret/data/github/repo/${{ github.repository }}/fossa/credentials token | FOSSA
-      - name: Checkout Repo
-        uses: actions/checkout@v4
-      - name: Run FOSSA Analyze
-        uses: fossas/[email protected]
-        with:
-          api-key: ${{ env.FOSSA }}
-      - name: Run FOSSA test
-        uses: fossas/[email protected]
+            secret/data/github/org/rancher/fossa/push token | FOSSA_API_KEY_PUSH_ONLY
+
+      - name: FOSSA scan
+        uses: fossas/fossa-action@main
         with:
-          api-key: ${{ env.FOSSA }}
-          run-tests: true
+          api-key: ${{ env.FOSSA_API_KEY_PUSH_ONLY }}
+          run-tests: false