dependency-scan.yml

name: Dependency scan
on: [push]

jobs:
  dependency-scan:
    name: dependency-scan
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Debugging information
        run: |
          ghc --version || echo "no ghc"
          cabal --version || echo "no cabal"
          ghcup --version || echo "no ghcup"

      - name: Update cabal cache for spectrometer run
        run: |
          cabal update

      - name: Install spectrometer from github
        run: |
          ./install-latest.sh -d

      - name: Use Spectrometer's GHC and Cabal
        # The first line works around a ghcup issue:
        # https://github.com/actions/runner-images/issues/7061#issuecomment-1422639889
        run: |
          sudo chown -R $USER /usr/local/.ghcup
          ghcup install ghc 9.0.2
          ghcup set ghc 9.0.2
          ghcup install cabal 3.6.2.0
          ghcup set cabal 3.6.2.0
          cabal update

      - name: Run dependency scan on Spectrometer
        env:
          FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
        run: |
          fossa analyze --only-target cabal --only-target cargo

      - name: Check for scan results
        env:
          FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
        run: |
          fossa test