From 53340fe2d23ca2d14eab2c2617c77c9072d28298 Mon Sep 17 00:00:00 2001
From: Guilherme Macedo <guilherme@gmacedo.com>
Date: Wed, 14 Jan 2026 10:21:02 -0300
Subject: [PATCH 1/2] Add FOSSA scanning workflow

Signed-off-by: Guilherme Macedo <guilherme@gmacedo.com>
---
 .github/workflows/fossa.yml | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 .github/workflows/fossa.yml

diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
new file mode 100644
index 00000000..9c29135e
--- /dev/null
+++ b/.github/workflows/fossa.yml
@@ -0,0 +1,34 @@
+name: FOSSA Scanning
+
+on:
+  push:
+    branches: ["main", "master", "release/**"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  fossa-scanning:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+    - name: Checkout
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+
+    # The FOSSA token is shared between all repos in Harvester's GH org. It can
+    # be used directly and there is no need to request specific access to EIO.
+    - name: Read FOSSA token
+      uses: rancher-eio/read-vault-secrets@main
+      with:
+        secrets: |
+          secret/data/github/org/harvester/fossa/credentials token | FOSSA_API_KEY_PUSH_ONLY
+
+    - name: FOSSA scan
+      uses: fossas/fossa-action@main
+      with:
+        api-key: ${{ env.FOSSA_API_KEY_PUSH_ONLY }}
+        # Only runs the scan and do not provide/returns any results back to the
+        # pipeline.
+        run-tests: false

From 861e887bb057992cc66c8082e6b2de80a5208dda Mon Sep 17 00:00:00 2001
From: Ivan Sim <1330522+ihcsim@users.noreply.github.com>
Date: Mon, 19 Jan 2026 12:38:29 -0800
Subject: [PATCH 2/2] Update branch patterns for FOSSA scanning

Signed-off-by: Ivan Sim <1330522+ihcsim@users.noreply.github.com>
---
 .github/workflows/fossa.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index 9c29135e..cabd8902 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -2,7 +2,7 @@ name: FOSSA Scanning
 
 on:
   push:
-    branches: ["main", "master", "release/**"]
+    branches: ["main", "master", "v[0-9]+.[0-9]+"]
   workflow_dispatch:
 
 permissions: