name: Fossa scan

on:
    push: 
      branches:
        - '**'
      tags:
        - '*'

jobs:
  fossa:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    timeout-minutes: 20
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
      - name: Read FOSSA token
        uses: rancher-eio/read-vault-secrets@main
        with:
          secrets: |
            secret/data/github/org/rancher/fossa/push token | FOSSA_API_KEY_PUSH_ONLY
      - name: FOSSA scan
        uses: fossas/fossa-action@main
        with:
          api-key: ${{ env.FOSSA_API_KEY_PUSH_ONLY }}
          run-tests: false