fossology/FOSSology Scan
Run license and copyright scans
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Aug 20, 2025
- License
- GPL 2.0
Pinned Snippet
uses: fossology/fossology-action@77ce100b60db6a92aa122c9103908dda44a06514 # v1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| scan_mode | Run the scan in one of the following modes: repo, differential, scan-only-deps, scan-dir | no | diff |
| scanners | One of the scanner to invoke: nomos, copyright, keyword, ojo | no | nomos ojo copyright keyword |
| report_format | Report format to generate reports in: TEXT, SPDX_JSON, SPDX_YAML, SPDX_RDF, SPDX_TAG_VALUE | no | TEXT |
| keyword_conf_file_path | Path to custom keyword.conf file | no | "" |
| allowlist_file_path | Path to allowlist.json file | no | "" |
| from_tag | If in differential mode, can provide a starting tag to scan from. Ex. v1 | no | "" |
| to_tag | If in differential mode, can provide an ending tag to scan to. Ex. v2 | no | "" |
| sbom_path | If in scan-only-deps mode, path of of the SBOM file to scan. | no | sbom.json |
| scan_dir | If in scan-dir mode, path of the directory to scan. | no | "" |
| github_api_url | Base URL of Github API | no | ${{ github.api_url }} |
| github_repository | Repository name | no | ${{ github.repository }} |
| github_token | Github Token | no | ${{ github.token }} |
| github_pull_request | Github PR | no | ${{ github.event.number }} |
| github_repo_url | Github Repo URL | no | ${{ github.repositoryUrl }} |
| github_repo_owner | Github Repo Owner | no | ${{ github.repository_owner }} |
Outputs
no outputs