GitHub Actions

​

Prerequisites

• An existing GitHub repository
• A valid SCANOSS API key

​

Getting Started

​

Configure GitHub Secrets

​

Create Workflow File

name: SCANOSS Code Scan

on:
  push:
    branches:
      - "main"
  pull_request:
    branches:
      - "*"

permissions:
  contents: write
  pull-requests: write
  checks: write
  actions: read

jobs:
  scanoss-analysis:
    name: SCANOSS Analysis
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Run SCANOSS scan
        id: scanoss-code-scan-step
        uses: scanoss/gha-code-scan@v1
        with:
          policies: undeclared
          api.key: ${{ secrets.SCANOSS_API_KEY }}

​

Commit and Push

git add .github/workflows/scanoss.yml
git commit -m "Add SCANOSS snippet detection"
git push

​

Understanding Results

​

GitHub Actions Summary

1. Navigate to Actions in your repository
2. Select the latest workflow run
3. Review the Annotations section to see detected snippets and matches

4. Click View detailed comments on commit to examine individual file matches with detailed comparison

​

Resolving Undeclared Components

1. Navigate to the failed Policy Check: Undeclared to see which components need declaration
2. If scanoss.json doesn’t exist in your repository, click Create scanoss.json file to generate it automatically
3. Review the pre-populated component list and click Commit Changes

4. The new commit automatically triggers a rescan, which will pass the undeclared policy check.