[ANE-2564] Remove fossa snippets subcommand
#1623
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
spatten
changed the title
fossa snippets subcommand
nficca
approved these changes
Jan 12, 2026
jnewton03
added a commit
to liquibase/build-logic
that referenced
this pull request
Jan 13, 2026
FOSSA CLI removed the `fossa snippets` command (fossas/fossa-cli#1623). This updates the workflow to use `fossa analyze --snippet-scan` instead. - Remove deprecated "Run FOSSA Snippets Detection" step - Remove deprecated "Generate Snippet Dependencies" step - Add conditional --snippet-scan flag to analyze command - Update input description for clarity Fixes: DAT-21701 Co-Authored-By: Claude Opus 4.5 <[email protected]>
Merged
3 tasks
jnewton03
added a commit
to liquibase/build-logic
that referenced
this pull request
Jan 13, 2026
…ag (#464) * fix: replace deprecated fossa snippets command with --snippet-scan flag FOSSA CLI removed the `fossa snippets` command (fossas/fossa-cli#1623). This updates the workflow to use `fossa analyze --snippet-scan` instead. - Remove deprecated "Run FOSSA Snippets Detection" step - Remove deprecated "Generate Snippet Dependencies" step - Add conditional --snippet-scan flag to analyze command - Update input description for clarity Fixes: DAT-21701 Co-Authored-By: Claude Opus 4.5 <[email protected]> * fix: address CodeQL code injection warnings Use environment variables instead of direct ${{ }} interpolation in shell scripts to prevent potential code injection vulnerabilities. Changes: - Pass github.event.repository.name through REPO_NAME env var - Pass github.head_ref through BRANCH_NAME env var - Pass check_snippets flag through SNIPPET_FLAG env var - Quote all variable references in shell commands Co-Authored-By: Claude Opus 4.5 <[email protected]> --------- Co-authored-by: Claude Opus 4.5 <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Delivers ANE-2565
Now that we have
fossa analyze --snippet-scanin GA, we no longer need thefossa snippetssubcommand.Also, here's a Slack thread where Cortez notes that the existence of
fossa snippetsandfossa analyze --snippet-scanis causing confusion.This PR removes the subcommand and any associated documentation.
Millhone is still used by Jars in Containers, so we will keep Millhone around for that.
Acceptance criteria
fossa snippetssubcommand no longer existsfossa snippetssubcommand are removedTesting plan
fossa snippetsfossa helpdoes not mentionfossa snippetsfossa snippetsRisks
Metrics
References
Checklist
docs/.docs/README.msand gave consideration to how discoverable or not my documentation is.Changelog.md. If this PR did not mark a release, I added my changes into an## Unreleasedsection at the top..fossa.ymlorfossa-deps.{json.yml}, I updateddocs/references/files/*.schema.jsonAND I have updated example files used byfossa initcommand. You may also need to update these if you have added/removed new dependency type (e.g.pip) or analysis target type (e.g.poetry).docs/references/subcommands/<subcommand>.md.