Enable fossa scan

.fossa.yml

@@ -0,0 +1,16 @@
+version: 3
+
+targets:
+  only:
+    - type: gomod
+    - type: maven
+      path: java/jmx
+    - type: maven
+      path: java/runner
+    - type: setuptools
+      path: python
+
+paths:
+  exclude:
+    - test-services
+    - tests

.gitlab-ci.yml

@@ -3,6 +3,7 @@ default:
 
 stages:
   - update-stage-cache
+  - sast-oss-scan
   - win-bundle-build
   - win-bundle-sign
   - win-msi-build
@@ -15,6 +16,9 @@ stages:
 include:
   - project: 'core-ee/signing/api-integration'
     file: '/templates/.sign-client.yml'
+  - project: 'ci-cd/templates'
+    ref: master
+    file: '/prodsec/.oss-scan.yml'
 
 .sign-release-cache:
   variables:
@@ -41,6 +45,15 @@ update-stage-cache:
   script:
     - make stage-cache
 
+fossa:
+  extends: .oss-scan
+  stage: sast-oss-scan
+  needs: []
+  only:
+    - main
+    - schedules
+  # allow_failure: false
+
 win-bundle-build:
   stage: win-bundle-build
   needs: []