From f6fb40acba69d2c3b53a19a5fd14fb99086710ec Mon Sep 17 00:00:00 2001 From: Mustafa Al-Sakkaf Date: Sun, 26 Jul 2026 19:52:20 -0400 Subject: [PATCH 1/5] Add FOSSA SCA scan and Guardian manifest workflow Adds .fossa.yml, .github/workflows/sca-scan-and-guard.yml, and .github/workflow-config.json to onboard this repo to FOSSA scanning on merge to default branch per DATAGO-142436. Co-Authored-By: Claude Opus 4.7 (1M context) --- .fossa.yml | 25 ++++++++++++ .github/workflow-config.json | 8 ++++ .github/workflows/sca-scan-and-guard.yml | 51 ++++++++++++++++++++++++ 3 files changed, 84 insertions(+) create mode 100644 .fossa.yml create mode 100644 .github/workflow-config.json create mode 100644 .github/workflows/sca-scan-and-guard.yml diff --git a/.fossa.yml b/.fossa.yml new file mode 100644 index 0000000..0b0526a --- /dev/null +++ b/.fossa.yml @@ -0,0 +1,25 @@ +version: 3 + +project: + locator: SolaceLabs_solace-cloud-cli + id: SolaceLabs_solace-cloud-cli + name: solace-cloud-cli + teams: [] + labels: + - typescript + +vendoredDependencies: + forceRescans: false + scanMethod: CLILicenseScan + licenseScanPathFilters: + exclude: + - "./.git" + - "./.github" + +paths: + exclude: + - ./.git + - ./.github + +telemetry: + scope: full diff --git a/.github/workflow-config.json b/.github/workflow-config.json new file mode 100644 index 0000000..cacb8de --- /dev/null +++ b/.github/workflow-config.json @@ -0,0 +1,8 @@ +{ + "sca_scanning": { + "fossa": { + "policy": { "mode": "REPORT" }, + "vulnerability": { "mode": "REPORT" } + } + } +} diff --git a/.github/workflows/sca-scan-and-guard.yml b/.github/workflows/sca-scan-and-guard.yml new file mode 100644 index 0000000..8e9bde1 --- /dev/null +++ b/.github/workflows/sca-scan-and-guard.yml @@ -0,0 +1,51 @@ +name: SCA Scan on merge to main +on: + push: + branches: [main] + +permissions: + contents: read + id-token: write + packages: read + actions: read + statuses: write + checks: write + pull-requests: write + +jobs: + sca_scan: + uses: SolaceDev/solace-public-workflows/.github/workflows/sca-scan-and-guard.yaml@main + secrets: + FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }} + + update_manifest: + needs: sca_scan + if: needs.sca_scan.result == 'success' && github.ref_name == github.event.repository.default_branch + runs-on: ubuntu-latest + permissions: + id-token: write + contents: read + packages: read + steps: + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 + with: + role-to-assume: arn:aws:iam::868978040651:role/github-solace-cloud-manifest-rw + aws-region: us-east-1 + + - name: Update solace-cloud-manifest + uses: SolaceDev/solace-public-workflows/.github/actions/cicd-helper@main + with: + rc_step: add_item_from_json_to_dynamodb_table + ddb_table_name: solace-cloud-manifest + ddb_partition_key: squad + ddb_sort_key: repository + ddb_item_to_be_added: | + { + "squad": "ebp", + "repository": "${{ github.event.repository.name }}", + "dev": { + "sha": "${{ github.sha }}", + "version": "${{ github.ref_name }}" + } + } From bede66fef5a03ef4c1950aef244dd501b67b3e40 Mon Sep 17 00:00:00 2001 From: Mustafa Al-Sakkaf Date: Mon, 27 Jul 2026 12:03:03 -0400 Subject: [PATCH 2/5] fix: update squad to temp --- .github/workflows/sca-scan-and-guard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sca-scan-and-guard.yml b/.github/workflows/sca-scan-and-guard.yml index 8e9bde1..1c81369 100644 --- a/.github/workflows/sca-scan-and-guard.yml +++ b/.github/workflows/sca-scan-and-guard.yml @@ -42,7 +42,7 @@ jobs: ddb_sort_key: repository ddb_item_to_be_added: | { - "squad": "ebp", + "squad": "temp", "repository": "${{ github.event.repository.name }}", "dev": { "sha": "${{ github.sha }}", From 9dfbcd4f5d00322bb100b438cde98551b8997f57 Mon Sep 17 00:00:00 2001 From: Aman Riat Date: Thu, 27 Aug 2026 18:25:44 -0400 Subject: [PATCH 3/5] DATAGO-142436: route manifest write to the prof-services squad and scan on PRs squad was 'temp', which exists in neither the Guardian products collection nor products.json, so the DynamoDB row would land under a partition nothing reads. Also adds a pull_request trigger so the FOSSA scan is verifiable before merge rather than after, and guards the manifest write on github.event_name == 'push' so a PR run can never write to DynamoDB. --- .github/workflows/sca-scan-and-guard.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/sca-scan-and-guard.yml b/.github/workflows/sca-scan-and-guard.yml index 1c81369..a22dc7f 100644 --- a/.github/workflows/sca-scan-and-guard.yml +++ b/.github/workflows/sca-scan-and-guard.yml @@ -1,5 +1,7 @@ -name: SCA Scan on merge to main +name: SCA Scan on: + pull_request: + branches: [main] push: branches: [main] @@ -15,12 +17,19 @@ permissions: jobs: sca_scan: uses: SolaceDev/solace-public-workflows/.github/workflows/sca-scan-and-guard.yaml@main + with: + setup_actions: '["setup-node"]' secrets: FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }} update_manifest: needs: sca_scan - if: needs.sca_scan.result == 'success' && github.ref_name == github.event.repository.default_branch + # The manifest records what landed on the default branch, so it must never + # be written from a PR run -- the scan still runs, the write does not. + if: >- + needs.sca_scan.result == 'success' + && github.event_name == 'push' + && github.ref_name == github.event.repository.default_branch runs-on: ubuntu-latest permissions: id-token: write @@ -42,7 +51,7 @@ jobs: ddb_sort_key: repository ddb_item_to_be_added: | { - "squad": "temp", + "squad": "prof-services", "repository": "${{ github.event.repository.name }}", "dev": { "sha": "${{ github.sha }}", From 10797fd40596e2354a5fa3adb5ec76500ff49121 Mon Sep 17 00:00:00 2001 From: Aman Riat Date: Fri, 28 Aug 2026 14:36:53 -0400 Subject: [PATCH 4/5] DATAGO-142436: source the manifest AWS role from MANIFEST_AWS_ROLE Replaces the hardcoded role ARN with the org secret. Adds a temporary job asserting the secret reaches this repository, because update_manifest only runs on push to the default branch and is never exercised by a PR. --- .github/workflows/sca-scan-and-guard.yml | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sca-scan-and-guard.yml b/.github/workflows/sca-scan-and-guard.yml index a22dc7f..fcf57cf 100644 --- a/.github/workflows/sca-scan-and-guard.yml +++ b/.github/workflows/sca-scan-and-guard.yml @@ -22,6 +22,24 @@ jobs: secrets: FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }} + verify_manifest_role_secret: + # TEMPORARY -- delete once verified. update_manifest never runs on a PR, so + # this is the only way to confirm the org secret reaches this repository. + runs-on: ubuntu-latest + steps: + - name: Assert MANIFEST_AWS_ROLE is present + env: + ROLE: ${{ secrets.MANIFEST_AWS_ROLE }} + run: | + if [[ -z "$ROLE" ]]; then + echo "::error::MANIFEST_AWS_ROLE is empty - org secret not visible to this repo" + exit 1 + fi + echo "MANIFEST_AWS_ROLE is set (${#ROLE} chars)" + [[ "$ROLE" == arn:aws:iam::*:role/* ]] \ + && echo "shape looks like an IAM role ARN" \ + || { echo "::error::value does not look like an IAM role ARN"; exit 1; } + update_manifest: needs: sca_scan # The manifest records what landed on the default branch, so it must never @@ -39,7 +57,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 with: - role-to-assume: arn:aws:iam::868978040651:role/github-solace-cloud-manifest-rw + role-to-assume: ${{ secrets.MANIFEST_AWS_ROLE }} aws-region: us-east-1 - name: Update solace-cloud-manifest From 1a5fb7b8dc1f7c4a1cb28870a6d59a26abaa8790 Mon Sep 17 00:00:00 2001 From: Aman Riat Date: Fri, 28 Aug 2026 14:41:01 -0400 Subject: [PATCH 5/5] DATAGO-142436: drop the temporary MANIFEST_AWS_ROLE probe job The org secret was confirmed visible to this repository; the probe has served its purpose. --- .github/workflows/sca-scan-and-guard.yml | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/.github/workflows/sca-scan-and-guard.yml b/.github/workflows/sca-scan-and-guard.yml index fcf57cf..c165b4d 100644 --- a/.github/workflows/sca-scan-and-guard.yml +++ b/.github/workflows/sca-scan-and-guard.yml @@ -22,24 +22,6 @@ jobs: secrets: FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }} - verify_manifest_role_secret: - # TEMPORARY -- delete once verified. update_manifest never runs on a PR, so - # this is the only way to confirm the org secret reaches this repository. - runs-on: ubuntu-latest - steps: - - name: Assert MANIFEST_AWS_ROLE is present - env: - ROLE: ${{ secrets.MANIFEST_AWS_ROLE }} - run: | - if [[ -z "$ROLE" ]]; then - echo "::error::MANIFEST_AWS_ROLE is empty - org secret not visible to this repo" - exit 1 - fi - echo "MANIFEST_AWS_ROLE is set (${#ROLE} chars)" - [[ "$ROLE" == arn:aws:iam::*:role/* ]] \ - && echo "shape looks like an IAM role ARN" \ - || { echo "::error::value does not look like an IAM role ARN"; exit 1; } - update_manifest: needs: sca_scan # The manifest records what landed on the default branch, so it must never