Solve license compliance (again)

[chadwhitacre]

Last year we deployed FOSSA to help us manage open source license compliance. However, persistent stability issues forced us to turn FOSSA off in August. We need to solve license compliance again, either by turning FOSSA back on (we've been in conversation with them about product improvements to address our concerns) or through some other means.

To Do

• Confirm that FOSSA's new features address our concerns. - expected by Feb 15 March 1
• Verify all of our repos are license compliant
• Turn FOSSA back on.
  • Implement monitoring for FOSSA health. #121
  • Bump where pinned
    • (feat): Re-enable FOSSA sentry#47860
    • https://github.com/getsentry/getsentry/pull/10320
    • (feat): Re-enable fossa snuba#4078
• shipped post

Punchlist

• FOSSA Scan Punchlist Items #124

┆Issue is synchronized with this Jira Epic by Unito

[chadwhitacre]

We had a call with FOSSA yesterday. Most of the eng work on their side is done, there's one more small feature we're waiting for (est. next week or two).

[chadwhitacre]

FOSSA has shipped everything we we were waiting for!

[hubertdeng123]

Ah probably this one, it looks like the latest release has the changes we want:
fossas/fossa-cli#1165

[hubertdeng123]

Notes after investigating FOSSA and the past incidents

1. How will we know if FOSSA api is down? Is there an endpoint to query accurately to determine if FOSSA scanning is down?
2. It seems like fossa-action is using fossa-cli to perform fossa analyze and fossa test. Will properly detect when there is an issue with FOSSA? How will that be surfaced in GitHub?
3. If our GitHub action uses fossa-cli analyze and fossa-cli test instead, will that return appropriate erroring for Sentry to ignore the CI run? Seeing this change here but unsure if that applies to just error message or error code.

[hubertdeng123]

From FOSSA:

I reached out to our engineering team to give you all the info you need. This is our health endpoint that you can use:
https://app.fossa.com/health

The FOSSA action (which uses the CLI) will detect/fail on issues, such as not providing a token, providing the right access token (push-only tokens generated by users with the editor/admin role), no available targets to scan, etc. Those are pretty much application level issues that will exit on 1.
FOSSA will exit on non-zero codes for networked related events as well, whether

• FOSSA is down (maintenance upgrades or w/e reasons)
• GH action runners went down for some reason
  • Network between GH and FOSSA is somehow slow/blocking

If our health check passes, there's no guarantee that the FOSSA scan will then work (after you check) since they're independent events.
We recommend that if you don’t want to gate CI on FOSSA, either

• Add continue-on-error: true to the FOSSA action step, or
• If you run FOSSA manually (using the CLI), you can do fossa analyze || true in a step
  I'm not sure if you run fossa test afterwards, but if you do I'd place some Actions logic to say if the analysis step failed then bypass the fossa test step.

As such, it seems reasonable to add the continue-on-error to the FOSSA action step. I've verified that the FOSSA scan will not error out if there is a license compliance issue, the FOSSA test step will. FOSSA scan shouldn't fail for any important reason for us, and we should ignore the failure and skip the scan if it does.

[hubertdeng123]

Weekly Update 04/03

• check in with legal on FOSSA license compliance
• add Sentry to enforce license compliance action

[chadwhitacre]

https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-dependency-review#about-configuring-the-dependency-review-action 👀

[hubertdeng123]

Weekly Update 04/10

• discuss whether or not we want to continue using FOSSA
• check to see if it is possible to parse output of FOSSA action

[hubertdeng123]

Weekly Update 04/17

• merge Parse logs for FOSSA action to determine actual license scan failures action-enforce-license-compliance#16

[hubertdeng123]

Weekly Update 04/24

• Enable FOSSA across pinned repos (sentry, getsentry, snuba)
• shipped post

[hubertdeng123]

done! 🚢

[chadwhitacre]

Link the shipped! :)

[chadwhitacre]

https://vanguard.getsentry.net/p/clgy6bddv0000s60lkfcxlgha

[hubertdeng123]

FYI, I did link the shipped post above in the issue body and in the last weekly update for reference

[chadwhitacre]

Heeeeeeeey! 💃 🥔 @hubertdeng123