diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml
index 4699ad4..7b29445 100644
--- a/.github/workflows/java-ci.yml
+++ b/.github/workflows/java-ci.yml
@@ -11,6 +11,8 @@ on:
jobs:
build_and_test:
runs-on: ubuntu-latest
+ env:
+ SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }}
steps:
- uses: actions/checkout@v4
diff --git a/.github/workflows/java-native-build.yml b/.github/workflows/java-native-build.yml
index 9ef85a5..1ccd033 100644
--- a/.github/workflows/java-native-build.yml
+++ b/.github/workflows/java-native-build.yml
@@ -14,6 +14,8 @@ on:
jobs:
build_and_test:
runs-on: ubuntu-latest
+ env:
+ SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }}
steps:
- uses: actions/checkout@v4
@@ -33,6 +35,8 @@ jobs:
needs: [ build_and_test ]
name: Build native on ${{ github.event.inputs.build_env }}
runs-on: ${{ github.event.inputs.build_env }}
+ env:
+ SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }}
steps:
- uses: actions/checkout@v4
- uses: graalvm/setup-graalvm@v1
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 77b65df..340cd06 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -11,6 +11,8 @@ jobs:
build_and_test:
name: Build and test java code
runs-on: ubuntu-latest
+ env:
+ SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }}
steps:
- uses: actions/checkout@v4
@@ -34,7 +36,8 @@ jobs:
MAVEN_USERNAME: ${{ secrets.OSSRH_USER_TOKEN }}
MAVEN_PASSWORD: ${{ secrets.OSSRH_PWD_TOKEN }}
MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PWD }}
-
+ SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }}
+
steps:
- uses: actions/checkout@v4
@@ -73,6 +76,8 @@ jobs:
strategy:
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
+ env:
+ SCANOSS_API_KEY: ${{ secrets.SC_API_KEY }}
steps:
- uses: actions/checkout@v4
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2fa2cf5..bfe30a4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]
+## [0.13.1] - 2026-03-25
+### Added
+- Added support to load a SCANOSS API key from an environment variable (`SCANOSS_API_KEY`) if available.
+
## [0.13.0] - 2026-02-04
### Added
- Added `file_snippet` scan configuration support in `scanoss.json` for engine tuning parameters (`min_snippet_hits`, `min_snippet_lines`, `honour_file_exts`, `ranking_enabled`, `ranking_threshold`, `skip_headers`, `skip_headers_limit`)
@@ -149,4 +153,5 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
[0.11.0]: https://github.com/scanoss/scanoss.java/compare/v0.10.1...v0.11.0
[0.12.0]: https://github.com/scanoss/scanoss.java/compare/v0.11.0...v0.12.0
[0.12.1]: https://github.com/scanoss/scanoss.java/compare/v0.12.0...v0.12.1
-[0.13.0]: https://github.com/scanoss/scanoss.java/compare/v0.12.1...v0.13.0
\ No newline at end of file
+[0.13.0]: https://github.com/scanoss/scanoss.java/compare/v0.12.1...v0.13.0
+[0.13.1]: https://github.com/scanoss/scanoss.java/compare/v0.13.0...v0.13.1
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index d6b6a26..ed3a1a1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
com.scanoss
scanoss
- 0.13.0
+ 0.13.1
jar
scanoss.java
https://github.com/scanoss/scanoss.java
@@ -60,7 +60,7 @@
commons-codec
commons-codec
- 1.20.0
+ 1.21.0
compile
@@ -72,7 +72,7 @@
org.apache.tika
tika-core
- 3.2.2
+ 3.3.0
compile
@@ -97,7 +97,7 @@
org.projectlombok
lombok
- 1.18.42
+ 1.18.44
true
compile
diff --git a/src/main/java/com/scanoss/Scanner.java b/src/main/java/com/scanoss/Scanner.java
index d8482c1..f2defb5 100644
--- a/src/main/java/com/scanoss/Scanner.java
+++ b/src/main/java/com/scanoss/Scanner.java
@@ -149,7 +149,7 @@ private Scanner(Boolean skipSnippets, Boolean allExtensions, Boolean obfuscate,
.skipHeadersLimit(fileSnippetConfig != null && fileSnippetConfig.getSkipHeadersLimit() != null ? fileSnippetConfig.getSkipHeadersLimit() : 0)
.build());
this.scanApi = Objects.requireNonNullElseGet(scanApi, () ->
- ScanApi.builder().url(url).apiKey(apiKey).timeout(timeout).retryLimit(retryLimit).flags(scanFlags)
+ ScanApi.builder().url(url).apiKey(this.apiKey).timeout(timeout).retryLimit(retryLimit).flags(scanFlags)
.sbomType(sbomType).sbom(sbom).customCert(customCert).proxy(proxy).settings(this.settings)
.build());
this.scanFileProcessor = Objects.requireNonNullElseGet(scanFileProcessor, () ->
diff --git a/src/main/java/com/scanoss/rest/ScanApi.java b/src/main/java/com/scanoss/rest/ScanApi.java
index 85361a2..41318c2 100644
--- a/src/main/java/com/scanoss/rest/ScanApi.java
+++ b/src/main/java/com/scanoss/rest/ScanApi.java
@@ -84,7 +84,7 @@ private ScanApi(String scanType, Duration timeout, Integer retryLimit, String ur
this.timeout = timeout;
this.retryLimit = retryLimit;
this.url = url;
- this.apiKey = apiKey;
+ this.apiKey = resolveApiKey(apiKey);
this.flags = flags;
this.sbomType = sbomType;
this.sbom = sbom;
@@ -130,6 +130,28 @@ private ScanApi(String scanType, Duration timeout, Integer retryLimit, String ur
}
}
+ /**
+ * Resolve the API key for Scanoss API
+ *
+ * @param apiKey The API key provided by the user
+ * @return The resolved API key, either from the user-provided value or environment variable
+ */
+ private static String resolveApiKey(String apiKey) {
+ if (apiKey != null && !apiKey.isBlank()) {
+ return apiKey;
+ }
+ try {
+ String envApiKey = System.getenv("SCANOSS_API_KEY");
+ if (envApiKey != null && !envApiKey.isBlank()) {
+ log.debug( "Using SCANOSS_API_KEY env value");
+ return envApiKey;
+ }
+ } catch (RuntimeException e) {
+ log.warn("Unable to read SCANOSS_API_KEY from environment: {}", e.getMessage());
+ }
+ return apiKey;
+ }
+
/**
* Scan the given WFP
*
diff --git a/src/test/java/com/scanoss/TestCli.java b/src/test/java/com/scanoss/TestCli.java
index 94b32b7..ce787a4 100644
--- a/src/test/java/com/scanoss/TestCli.java
+++ b/src/test/java/com/scanoss/TestCli.java
@@ -133,7 +133,7 @@ public void TestScanCommandPositive() {
assertEquals("command should not fail", 0, exitCode);
String[] args2 = new String[]{"-d", "scan", "src/test/java/com", "-T", "2", "--all-hidden",
- "--skip-snippets", "--all-extensions", "-F", "256"
+ "--skip-snippets", "--all-extensions", "-F", "2048"
};
exitCode = new picocli.CommandLine(new CommandLine()).execute(args2);
assertEquals("command should not fail", 0, exitCode);