...
Name | Organisation | |
---|---|---|
Maurizio Pillitu | FINOS | |
Former user (Deleted) | Morgan StanleyTosha Ellison | |
James McLeod (Unlicensed) | FINOSAlexandra Stratigos | FINOS |
Gabriele Columbro | FINOS | |
Tom Schady | GreenKey Technologies | |
Deepak Mehta | FOSSAMicheal | |
HollanderAitana Myohl | WhiteSource | |
Rhys Arkins | WhiteSource | |
David Habusha | WhiteSource | |
FINOS | ||
Rob Underwood (Deactivated) | FINOS |
Attendee Webex Screenshot
...
Time | Item | Who | Notes from the Meeting | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
5 mins | Convene & Roll Call | Former user (Deleted) | |||||||||
5 mins | WhiteSource Webinar on Wednesday November 6 | Maurizio Pillitu |
| 10 | FOSSA reporting format | Does Welcome James! | James McLeod (Unlicensed) | James is the new FINOS Community Director | |||
10 mins | FOSSA |
| |||||||||
15 mins | WhiteSource Webinar on Wednesday November 6 | Maurizio Pillitu |
| ||||||||
5 mins | Retrospective on current sprint | Group | |||||||||
10 mins | Planning next Next Sprint priorities | Group | |||||||||
10 mins | Backlog scrubbing | Group | |||||||||
5 | AOB & adjourn | Group |
FOSSA GitHub Action - (mao proposal)
Build a standard GitHub action that reacts on commits and Pull Requests (PRs) on a given GitHub repository, called FOSSA GitHub Action.
Every time that a commit is pushed or a PR is merged, the FOSSA GitHub Action is triggered, the action
- Reads a
.fossa-licenses.yaml
file, containing - A list of SPDX IDs called "compatibleLicenses"
- A list of SPDX IDs called "incompatibleLicenses"
- A list of strings called "whitelistedLibraries"
- ... (more will come after the MVP)
- Reads the
FOSSA_API_KEY
(encrypted) environment variable, containing the key of FINOS account - Invokes "
fossa init
" and "fossa report licenses --json
", generating a JSON payload with all library and license definitions - Parses the generated JSON (on step 5) and builds a report with
- List of libraries with compatible licenses (and the compatible license that applies)
- List of libraries with incompatible licenses
- List of libraries with unknown licenses
- Format the report in Markdown and post on a new github issue. If the action was triggered by a PR, the check will succeed or fail based on the amount of incompatible /unknown licenses found