Input required and not supplied: api-key

[zhujian7]

I have an organization secret FOSSA_API_KEY, but still get an error Input required and not supplied: api-key:

/home/runner/work/_actions/fossas/fossa-action/main/node_modules/@actions/core/lib/core.js:106
        throw new Error(`Input required and not supplied: ${name}`);
^
Error: Input required and not supplied: api-key

Here is my action yaml:

name: FOSSA License Scanning

on:
  push:
    branches:
      - main
      - release-*
  pull_request:
    branches:
      - main
      - release-*

permissions:
  contents: read
  actions: read

jobs:
  fossa-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout tree
        uses: actions/checkout@v4
      - name: Run FOSSA scan and upload build data
        uses: fossas/fossa-action@main
        with:
          api-key: ${{ env.fossa_api_key }}
          debug: true

Any suggestions?

[pieterocp]

From the information you've provided, the most likely issue looks like the api-key needs setting with a key and some SCREAMING_SNAKE_CASE? e.g. swap it out for:

jobs:
  fossa-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout tree
        uses: actions/checkout@v4
      - name: Run FOSSA scan and upload build data
        uses: fossas/fossa-action@main
        with:
          api-key: ${{ secret.FOSSA_API_KEY}}
          debug: true

[zhujian7]

@pieterocp Thanks for you reply, I tried both, ${{ secrets.FOSSA_API_KEY}} and ${{ env.fossa_api_key }}, neither worked.

      - name: Run FOSSA scan and upload build data
        uses: fossas/fossa-action@main
        with:
          api-key: ${{ env.fossa_api_key }}
          debug: true
        env:
          fossa_api_key: ${{ secrets.FOSSA_API_KEY }}

      - name: Run FOSSA scan and upload build data
        uses: fossas/fossa-action@main
        with:
          api-key: ${{ secrets.FOSSA_API_KEY }}
          debug: true

here is my PR

[pieterocp]

Only think I can think of is that the secret isn't setup in the right place? - https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow e.g. it should be somewhere set in this menu via github below or it won't be there?

Beyond that, I'm not too sure how to further help. Maybe fossa support can set you up with more assistance? (I don't work for them in any capacity)

[zhujian7]

We have set it as an org secret, anyway, @pieterocp thanks for your help.

[lacroixthomas]

@zhujian7 Did you manage to make it work ?
I got the same issue, I wonder if it's not because it's a PR coming from a fork or something ? 🤔

[lacroixthomas]

It might have been an issue of security, PR from a fork might not have access to the secret from the main repo, which fails, I did the test on my fork directly and it worked all fine (I had to add the secret on my fork too), I'm pretty sure once merged on the main repo it will also work fine ! 🎉