v1.7.0

What's Changed

Added

• Snippet and full file match comments now link to the matched OSS file (and line range, for snippets) for GitHub-hosted components, instead of only referencing the repository
• Match comments display an informational note when the matched component is registry-sourced (e.g. npm, PyPI), where a browsable source link cannot be generated

Notes

• The matched file link is only generated for GitHub-hosted components (where the source url points to github.com). For components sourced from package registries (e.g. npm, PyPI), the registry version and packaged file paths do not map to a GitHub source location, so these comments keep the repository Source and show the note instead

Full Changelog: v1...v1.7.0

v1.6.4

Fixed

• Corrected copyleft documentation in README.md: copyleft is determined by scanoss.py (scanoss-py inspect copyleft) using the OSADL checklist, including -or-later licenses, rather than the internal license.utils.ts list

Removed

• Removed the unused default copyleft license list and its include/exclude/explicit parsing from license.utils.ts (dead code)

v1.6.3

What's Changed

• Updated dependencies
• Moved to Node 24
• Moved to actions/checkout@v6
• Changed action name in README.md to 'gha-code-scan'

Full Changelog: v1...v1.6.3

v1.6.2

What's Changed

Changed

• Upgraded scanoss.py runtime container to v1.52.1

Full Changelog: v1...v1.6.2

v1.6.1

What's Changed

Fixed

• Fixed policy check runs remaining in "queued" status when the workflow fails before policy execution

Full Changelog: v1...v1.6.1

v1.6.0

What's Changed

Changed

• Replaced vercel/ncc by esbuild to support ESM modules
• Migrated ESLint 8 to ESLint 9 with flat config (eslint.config.mjs)
• Upgraded @typescript-eslint from v6 to v8 for TypeScript 5.9 compatibility
• Upgraded eslint-plugin-github from v4 to v5 and eslint-plugin-jest from v27 to v28
• Removed redundant linter.yml workflow (linting already covered by ci.yml)
• Upgraded scanoss.py runtime container to v1.46.0

Fixed

• Fixed corrupted artifact files
• Fixed @actions/artifact ESM module resolution in Jest tests

Full Changelog: v1...v1.6.0

v1.5.0

What's Changed

Added

• Added support for scan tuning parameters

Changed

• Upgraded scanoss-py version to v1.45.0

Full Changelog: v1...v1.5.0

Alternate scan root/sub-folder

• Add support to specify alternative scan root inside a repository

v1.3.1

What's Changed

• Added conversion from raw result to spdxlite and csv
• Changed default raw results file name to scanoss-raw.json

Full Changelog: v1.3.0...v1.3.1

v1.3.0

What's Changed

• Added delta scanning for pull requests and pushes

Full Changelog: v1.2.5...v1.3.0