7 ms·

This looks great, alas I am unable to test it. When I try to sign up, they want write access to my repos, to the org repos I am a member off, etc. Let's make

This looks great, alas I am unable to test it. When I try to sign up, they want write access to my repos, to the org repos I am a member off, etc. Let's make this clear: I am not giving to anyone write access to my repos and certainly not to other people repos. Read permissions should be enough. You want to add something to my repo? Do a PR. So what remains, is to test the command line app without using the online service. But the documentation is bad, so I am not able to do that either. No docs for scala, when trying with go, I get cryptic errors, like 'no supported Go build tools detected' until I install a third party go binary (godep or govendor) and 'could not find Go project folder (maybe your Go build tool is not supported?)'. The idea is great, the execution needs some work.

XiZhao 9y ago
Unfortunately, the permissions issue is a limitation of Github's Oauth API. There's no way to ask for "read-only" permissions using their current integration scheme. You can, however get a FOSSA API key without signing up for Github -- just register with an email here: https://app.fossa.io/account/register https://app.fossa.io/account/register Thanks! I filed a ticket for sbt documentation here: https://github.com/fossas/fossa-cli/issues/105 https://github.com/fossas/fossa-cli/issues/105. For Golang, you need to be running the cli in a repo within your gopath; we should have some better feedback for it however. I opened another issue here (https://github.com/fossas/fossa-cli/issues/106 https://github.com/fossas/fossa-cli/issues/106), anything you can contribute?
- andmarios 9y ago
  Thanks for the quick reply! Happy to see I can test this without giving github access. Still have some issues, hope I will work them out.
lancefisher 9y ago
This is a GitHub limitation. I get around it for other services by making a dedicated GitHub user account, granting that user read-only access, and then connecting to the 3rd-party app. It's a somewhat annoying workaround, but it works.
andmarios 9y ago
An update, since I see some upvotes. I followed @XiZhao's advise and managed to sign up without giving access to github which is very good. If I want to have scans run automatically on github projects, I still have to grant write access. The other option is to run the tests myself, which probably is what someone in a professional setup will do anyway, so I think it is not a very serious issue, although it would be nice to be fixed. As for my go endeavors, I haven't yet managed to analyze my go projects, but I did have better luck with javascript and scala (gradle) which was very impressive. Great project overall and I am sure it will be a success, because I know firsthand how cumbersome can be to do this important task manually.

XiZhao 9y ago

Unfortunately, the permissions issue is a limitation of Github's Oauth API. There's no way to ask for "read-only" permissions using their current integration scheme. You can, however get a FOSSA API key without signing up for Github -- just register with an email here: https://app.fossa.io/account/register https://app.fossa.io/account/register Thanks! I filed a ticket for sbt documentation here: https://github.com/fossas/fossa-cli/issues/105 https://github.com/fossas/fossa-cli/issues/105. For Golang, you need to be running the cli in a repo within your gopath; we should have some better feedback for it however. I opened another issue here (https://github.com/fossas/fossa-cli/issues/106 https://github.com/fossas/fossa-cli/issues/106), anything you can contribute?

andmarios 9y ago
Thanks for the quick reply! Happy to see I can test this without giving github access. Still have some issues, hope I will work them out.

lancefisher 9y ago

This is a GitHub limitation. I get around it for other services by making a dedicated GitHub user account, granting that user read-only access, and then connecting to the 3rd-party app. It's a somewhat annoying workaround, but it works.

andmarios 9y ago

An update, since I see some upvotes. I followed @XiZhao's advise and managed to sign up without giving access to github which is very good. If I want to have scans run automatically on github projects, I still have to grant write access. The other option is to run the tests myself, which probably is what someone in a professional setup will do anyway, so I think it is not a very serious issue, although it would be nice to be fixed. As for my go endeavors, I haven't yet managed to analyze my go projects, but I did have better luck with javascript and scala (gradle) which was very impressive. Great project overall and I am sure it will be a success, because I know firsthand how cumbersome can be to do this important task manually.