feat: ADDON-87374 Split FOSSA license and vulnerability checks in reusable release workflow by nayanak-896 · Pull Request #503 · splunk/addonfactory-workflow-addon-release

nayanak-896 · 2026-06-12T13:16:44Z

Summary

This PR updates the reusable add-on build-test-release workflow to split FOSSA findings into separate license and vulnerability checks, improve release gating, and document the new workflow behavior.
JIRA Link - https://splunk.atlassian.net/browse/ADDON-87374

Changes

Adds separate FOSSA CI jobs:
- fossa-license-test
- fossa-vulnerability-test
Exposes separate pipeline outputs for:
- active license issues
- active vulnerability issues
- release-blocking critical/high/medium vulnerability issues
Publishes separate job summaries for license and vulnerability findings.
Uploads separate raw FOSSA artifacts:
- fossa-license-issues
- fossa-vulnerability-issues
Updates pre-publish release gating so release paths can block independently on:
- unresolved license compliance issues
- unresolved critical/high/medium vulnerability issues
Keeps merge-to-develop and other non-release workflows usable by reporting split FOSSA results without enforcing release gating there.
Preserves the existing combined fossa-test behavior while split results are available.
Updates README documentation for the new split FOSSA jobs and release gating behavior.

Checklist

Tested TA GitHub Actions run:

Successful FOSSA Tests for Apache web server TA - https://github.com/splunk/splunk-add-on-for-apache-web-server/actions/runs/27413564545
Crowdstrike TA FOSSA tests failure - https://github.com/splunk/splunk-add-on-for-crowdstrike-fdr/actions/runs/27403537555
Salesforce TA FOSSA tests failure - https://github.com/splunk/splunk-add-on-for-salesforce/actions/runs/27403791531

### Description - Appinspect CLI action bump to v2.11 - Java version for pre-commit updated - don't require GSSA execution for docs only changes. ### Checklist - [x] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done splunk/splunk-add-on-for-microsoft-office-365#932 splunk/splunk-add-on-for-okta-identity-cloud#420

### Description Build job for certain TAs requires newer Java. ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done https://github.com/splunk/splunk-dbx-add-on-for-weaviate/actions/runs/23184277927

### Description Update the GSSA image version to 1.2 to replace the deprecated Claude 3.6. The new GSSA image now uses Claude 4.6 by defualt. ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [x] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done https://github.com/splunk/splunk-add-on-for-salesforce/actions/runs/25112929634/job/73592285875?pr=853 ### Description (PR description goes here) ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here)

### Description Release v5.4.0 Notes: feat: adding support spl2 integration tests fix: bump gssa version ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here) --------- Co-authored-by: mkolasinski-splunk <105011638+mkolasinski-splunk@users.noreply.github.com> Co-authored-by: Dariusz Karas <dkaras@splunk.com> Co-authored-by: Dariusz Karas <78362586+dkaras-splunk@users.noreply.github.com>

### Description fix: shorter job name https://github.com/splunk/splunk-add-on-for-palo-alto-networks/actions/runs/26407104971 ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here)

### Description (PR description goes here) ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here)

### Description drop ubuntu:16.04 from scripted input tests (EOL) ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here)

### Description -n paralel execution for spl2 tests (PR description goes here) ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here)

…e_empty_strings

--ignore_additional_fields_in_actual --ignore_empty_strings ### Description (PR description goes here) ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here)

### Description fix: add missing secret ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here)

) ## Summary The PAT → GitHub App migration in #484 rewrites private-repo clones via: ``` git config --global --add url."https://${TOKEN}@github.com".insteadOf https://github.com git config --global --add url."https://${TOKEN}@github.com".insteadOf ssh://git@github.com ``` That worked for PATs (GitHub accepts a PAT as the *username*), but **GitHub App installation tokens require the literal username `x-access-token`**. With only `<TOKEN>@github.com`, git treats the token as the username, GitHub returns 401, and git falls back to a non-interactive password prompt: ``` fatal: could not read Password for 'https://***@github.com': No such device or address exit code: 128 ``` This is currently breaking downstream add-ons that install private \`git+ssh\` dependencies (e.g. \`splunk/psa-cim-models\`) during the reusable workflow's \`run-unit-tests\` step. Example failing run: <https://github.com/splunk/splunk-add-on-for-microsoft-cloud-services/actions/runs/27150540186/job/80206858148>. ## Fix Prefix the rewritten URL with \`x-access-token:\` in all three jobs that perform the rewrite: - \`run-unit-tests\` - \`build\` - \`run-ucc-modinput-functional-tests\` (setup-poetry) ```diff - git config --global --add url."https://${{ steps.app-token.outputs.token }}@github.com".insteadOf https://github.com - git config --global --add url."https://${{ steps.app-token.outputs.token }}@github.com".insteadOf ssh://git@github.com + git config --global --add url."https://x-access-token:${{ steps.app-token.outputs.token }}@github.com".insteadOf https://github.com + git config --global --add url."https://x-access-token:${{ steps.app-token.outputs.token }}@github.com".insteadOf ssh://git@github.com ``` Targeting \`main\` so it can ship as a \`v5.5.x\` patch (matches the path taken by #495/#496/#497/#500). ## Note on App scope (not part of this PR) Even with this fix, the GitHub App identified by \`GH_APP_CLIENT_ID\` / \`GH_APP_PRIVATE_KEY\` must be installed on the private dependency repo (e.g. \`splunk/psa-cim-models\`) with \`contents: read\`. Otherwise the clone will now fail with a clearer 403/404 instead of the password-prompt error. The \`create-github-app-token\` call only specifies \`owner: \${{ github.repository_owner }}\`, so it inherits whatever repos the App is installed on in the org. ## Checklist - [ ] \`README.md\` has been updated or is not required - [x] push trigger tests - [ ] manual release test - [ ] automated releases test - [x] pull request trigger tests - [ ] schedule trigger tests - [x] workflow errors/warnings reviewed and addressed ## Testing done To verify after merge & v5.5.x tag: re-run the failing \`splunk-add-on-for-microsoft-cloud-services\` pipeline pinned to the new tag and confirm \`run-unit-tests\` clones \`splunk/psa-cim-models\` successfully. Made with [Cursor](https://cursor.com) Co-authored-by: Cursor <cursoragent@cursor.com>

…ON-87374

mkolasinski-splunk and others added 24 commits March 13, 2026 13:26

fix: shorter job name

7cc7441

fix: trigger release for v5.4.2

da62317

fix: retrigger release for v5.4.2

6303ad5

fix: drop ubuntu:16.04 from scripted input tests (EOL)

04b478e

fix: spl2-tests run with 8 workers

616f913

fix: spl2-tests run with --ignore_additional_fields_in_actual --ignor…

3cf178d

…e_empty_strings

Merge branch 'develop' into main

5be095c

feat: fossa license and vulnerability checks split in reusable WF ADD…

c92d07f

…ON-87374

fix: derive fossa project locator from report url ADDON-87374

d8f06f1

feat: add fossa split test summaries ADDON-87374

1639017

feat: improve fossa split test reporting ADDON-87374

91a596e

fix: handle fossa issue string fields ADDON-87374

07e093f

fix: extract fossa source package details ADDON-87374

89bd209

nayanak-896 requested a review from a team as a code owner June 12, 2026 13:16

fix: satisfy actionlint for fossa release gate ADDON-87374

fcb76d4

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: ADDON-87374 Split FOSSA license and vulnerability checks in reusable release workflow#503

feat: ADDON-87374 Split FOSSA license and vulnerability checks in reusable release workflow#503
nayanak-896 wants to merge 25 commits into
developfrom
feature/fossa-license-vuln-split-addon-87374

nayanak-896 commented Jun 12, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

nayanak-896 commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Checklist

Tested TA GitHub Actions run:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

nayanak-896 commented Jun 12, 2026 •

edited

Loading