diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml index 4699ad4..7b29445 100644 --- a/.github/workflows/java-ci.yml +++ b/.github/workflows/java-ci.yml @@ -11,6 +11,8 @@ on: jobs: build_and_test: runs-on: ubuntu-latest + env: + SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }} steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/java-native-build.yml b/.github/workflows/java-native-build.yml index 9ef85a5..1ccd033 100644 --- a/.github/workflows/java-native-build.yml +++ b/.github/workflows/java-native-build.yml @@ -14,6 +14,8 @@ on: jobs: build_and_test: runs-on: ubuntu-latest + env: + SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }} steps: - uses: actions/checkout@v4 @@ -33,6 +35,8 @@ jobs: needs: [ build_and_test ] name: Build native on ${{ github.event.inputs.build_env }} runs-on: ${{ github.event.inputs.build_env }} + env: + SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }} steps: - uses: actions/checkout@v4 - uses: graalvm/setup-graalvm@v1 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 77b65df..340cd06 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -11,6 +11,8 @@ jobs: build_and_test: name: Build and test java code runs-on: ubuntu-latest + env: + SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }} steps: - uses: actions/checkout@v4 @@ -34,7 +36,8 @@ jobs: MAVEN_USERNAME: ${{ secrets.OSSRH_USER_TOKEN }} MAVEN_PASSWORD: ${{ secrets.OSSRH_PWD_TOKEN }} MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PWD }} - + SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }} + steps: - uses: actions/checkout@v4 @@ -73,6 +76,8 @@ jobs: strategy: matrix: os: [ubuntu-latest, macos-latest, windows-latest] + env: + SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }} steps: - uses: actions/checkout@v4 diff --git a/CHANGELOG.md b/CHANGELOG.md index 2fa2cf5..bfe30a4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.13.1] - 2026-03-25 +### Added +- Added support to load a SCANOSS API key from an environment variable (`SCANOSS_API_KEY`) if available. + ## [0.13.0] - 2026-02-04 ### Added - Added `file_snippet` scan configuration support in `scanoss.json` for engine tuning parameters (`min_snippet_hits`, `min_snippet_lines`, `honour_file_exts`, `ranking_enabled`, `ranking_threshold`, `skip_headers`, `skip_headers_limit`) @@ -149,4 +153,5 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 [0.11.0]: https://github.com/scanoss/scanoss.java/compare/v0.10.1...v0.11.0 [0.12.0]: https://github.com/scanoss/scanoss.java/compare/v0.11.0...v0.12.0 [0.12.1]: https://github.com/scanoss/scanoss.java/compare/v0.12.0...v0.12.1 -[0.13.0]: https://github.com/scanoss/scanoss.java/compare/v0.12.1...v0.13.0 \ No newline at end of file +[0.13.0]: https://github.com/scanoss/scanoss.java/compare/v0.12.1...v0.13.0 +[0.13.1]: https://github.com/scanoss/scanoss.java/compare/v0.13.0...v0.13.1 \ No newline at end of file diff --git a/pom.xml b/pom.xml index d6b6a26..ed3a1a1 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ com.scanoss scanoss - 0.13.0 + 0.13.1 jar scanoss.java https://github.com/scanoss/scanoss.java @@ -60,7 +60,7 @@ commons-codec commons-codec - 1.20.0 + 1.21.0 compile @@ -72,7 +72,7 @@ org.apache.tika tika-core - 3.2.2 + 3.3.0 compile @@ -97,7 +97,7 @@ org.projectlombok lombok - 1.18.42 + 1.18.44 true compile diff --git a/src/main/java/com/scanoss/Scanner.java b/src/main/java/com/scanoss/Scanner.java index d8482c1..f2defb5 100644 --- a/src/main/java/com/scanoss/Scanner.java +++ b/src/main/java/com/scanoss/Scanner.java @@ -149,7 +149,7 @@ private Scanner(Boolean skipSnippets, Boolean allExtensions, Boolean obfuscate, .skipHeadersLimit(fileSnippetConfig != null && fileSnippetConfig.getSkipHeadersLimit() != null ? fileSnippetConfig.getSkipHeadersLimit() : 0) .build()); this.scanApi = Objects.requireNonNullElseGet(scanApi, () -> - ScanApi.builder().url(url).apiKey(apiKey).timeout(timeout).retryLimit(retryLimit).flags(scanFlags) + ScanApi.builder().url(url).apiKey(this.apiKey).timeout(timeout).retryLimit(retryLimit).flags(scanFlags) .sbomType(sbomType).sbom(sbom).customCert(customCert).proxy(proxy).settings(this.settings) .build()); this.scanFileProcessor = Objects.requireNonNullElseGet(scanFileProcessor, () -> diff --git a/src/main/java/com/scanoss/rest/ScanApi.java b/src/main/java/com/scanoss/rest/ScanApi.java index 85361a2..41318c2 100644 --- a/src/main/java/com/scanoss/rest/ScanApi.java +++ b/src/main/java/com/scanoss/rest/ScanApi.java @@ -84,7 +84,7 @@ private ScanApi(String scanType, Duration timeout, Integer retryLimit, String ur this.timeout = timeout; this.retryLimit = retryLimit; this.url = url; - this.apiKey = apiKey; + this.apiKey = resolveApiKey(apiKey); this.flags = flags; this.sbomType = sbomType; this.sbom = sbom; @@ -130,6 +130,28 @@ private ScanApi(String scanType, Duration timeout, Integer retryLimit, String ur } } + /** + * Resolve the API key for Scanoss API + * + * @param apiKey The API key provided by the user + * @return The resolved API key, either from the user-provided value or environment variable + */ + private static String resolveApiKey(String apiKey) { + if (apiKey != null && !apiKey.isBlank()) { + return apiKey; + } + try { + String envApiKey = System.getenv("SCANOSS_API_KEY"); + if (envApiKey != null && !envApiKey.isBlank()) { + log.debug( "Using SCANOSS_API_KEY env value"); + return envApiKey; + } + } catch (RuntimeException e) { + log.warn("Unable to read SCANOSS_API_KEY from environment: {}", e.getMessage()); + } + return apiKey; + } + /** * Scan the given WFP * diff --git a/src/test/java/com/scanoss/TestCli.java b/src/test/java/com/scanoss/TestCli.java index 94b32b7..ce787a4 100644 --- a/src/test/java/com/scanoss/TestCli.java +++ b/src/test/java/com/scanoss/TestCli.java @@ -133,7 +133,7 @@ public void TestScanCommandPositive() { assertEquals("command should not fail", 0, exitCode); String[] args2 = new String[]{"-d", "scan", "src/test/java/com", "-T", "2", "--all-hidden", - "--skip-snippets", "--all-extensions", "-F", "256" + "--skip-snippets", "--all-extensions", "-F", "2048" }; exitCode = new picocli.CommandLine(new CommandLine()).execute(args2); assertEquals("command should not fail", 0, exitCode);