actions-marketplace-validations/Official FOSSA Action

Find license compliance and security issues in your applications with FOSSA

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Apr 21, 2026
License: MPL 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: actions-marketplace-validations/fossas_fossa-action@29693cc50323968e039056be419b32989fc5880c # no releases — HEAD as of 2026-07-13

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
api-key	Your FOSSA API key.	yes	—
pinned-cli-version	If set, use the specified FOSSA Cli version.	no	—
run-tests	If set to `true` FOSSA will run the `fossa test` command.	—	false
container	A container name or OCI image path. Set to use FOSSA's container scanning functionality. This will run `fossa container analyze` (default behavior) and `fossa container test` (if used in combination with `run-tests`).	no	—
endpoint	Endpoint passed to FOSSA CLI. Defaults to `app.fossa.com`.	no	—
branch	Override the detected FOSSA project branch. If running FOSSA analysis on a Pull Request, as a start you can use the contexts `github.ref` or `github.ref_name`.	no	—
project	Override the detected FOSSA project name. If running FOSSA analysis on a Pull Request, as a start you can use the contexts `github.ref` or `github.ref_name`.	no	—
team	Allows you to specify the team for your project. It uses the team name, just as `--team` in the CLI. This will only work when creating a project.	no	—
policy	Allows you to specify the policy for your project. It uses the policy name, just as `--policy` in the CLI. This will only work when creating a project.	—	—
debug	Run all FOSSA commands in debug mode. Running `fossa analyze` in debug mode will generate a debug bundle that can be uploaded as a build artifact after this action completes.	—	false
test-diff-revision	Run fossa test with the `--diff <revision>` option, which checks if there are new issues relative to `<revision>`. Requires `run-tests` to be set in order to take effect.	no	—
generate-report	If set, after analyzing your project, FOSSA will generate a report which is accessible from the `report` step output. The value must be a [report format](https://github.com/fossas/fossa-cli/blob/master/docs/references/subcommands/report.md#specifying-a-report-format). Currently only the attribution report is supported.	no	—
working-directory	The directory to analyze	no	—

Outputs

name	description
report	If `generate-report` is provided, this will contain the string contents of the report in the requested format.