name: FOSSA Scan (Manual)

# Manual FOSSA scan workflow for ad-hoc security and licensing checks
# Allows scanning any branch on-demand without opening a PR or triggering a release

on:
  workflow_dispatch:
    inputs:
      git_ref:
        description: 'Git ref to scan (branch, tag, or SHA). Leave empty to scan current branch.'
        required: false
        type: string

permissions:
  contents: read
  pull-requests: write  # sca-scan-and-guard requires write to comment on PRs
  actions: read         # required by sca-scan-and-guard reusable workflow
  issues: write         # required by sca-scan-and-guard for PR/issue comments
  checks: write
  statuses: write       # required by sca-scan-and-guard to update commit status

jobs:
  fossa_scan:
    name: FOSSA Scan
    uses: SolaceDev/solace-public-workflows/.github/workflows/sca-scan-and-guard.yaml@main
    with:
      git_ref: ${{ inputs.git_ref }}
      use_vault: false
      config_file: '.github/workflow-config.json'
      setup_actions: '["setup-uv"]'
      custom_setup_script: 'uv export --format requirements-txt --no-dev --output-file requirements.txt'
    secrets:
      FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
