FOSSA scan added

[idvoretskyi]

Signed-off-by: Ihor Dvoretskyi ihor@linux.com

[systay]

Hi @idvoretskyi 👋

The build errors are because of infrastructure problems we are facing with github actions. We'll make sure they go green once the issue has been fixed.

In the mean time, would you mind adding a description to the PR?

[idvoretskyi]

@systay sorry, the reference issue is here - cncf/foundation#109; also we had a direct request by @askdba to the CNCF ServiceDesk to enable the FOSSA scanning.

[askdba]

LGTM

[deepthi]

It doesn't look like the scan covers all the code (excluding tests):

INFO Analyzing module (31/45): vitess.io/vitess/go/vt/sqlparser/goyacc
INFO Analyzing module (32/45): vitess.io/vitess/go/vt/throttler/demo
INFO Analyzing module (33/45): vitess.io/vitess/go/vt/vtctl/grpcvtctldclient/codegen

There are a lot more sub-directories under go/vt/ and that is where the bulk of the code lives.

[idvoretskyi]

@deepthi I made a significant update of the workflow file - now it uses the official FOSSA GitHub Action; let's see how it works.

[deepthi]

I assume the license scan is recursive? Then this is probably ok. The rest of the go/vt/... packages are probably covered by inclusion from the go/cmd/... packages.