Been working with FOSSA for dependency scanning across a few projects, and while the JSON output is comprehensive, it's a bit much to sift through when you just need to track license types or high-risk components across multiple repos.
I wrote a lightweight Python script to flatten the key data into a CSV. It pulls out the project name, each dependency's name and version, its license type, and any policy violations flagged. This makes it way easier to sort, filter, and get a quick overview in a spreadsheet.
Here's what the script extracts:
- Project identifier (from the FOSSA project metadata)
- Dependency name and version
- Declared license (prioritizes the concluded license if available)
- Whether a policy violation was triggered
- A simple severity flag (based on "high risk" license categories I defined)
I run it as part of our CI pipeline after a FOSSA scan, then load the CSV into a shared Google Sheet. This gives our team a live, sortable view without everyone needing to navigate the FOSSA UI or parse JSON.
If you're manually reviewing scans for multiple projects, this might save you some time. You can adjust the fields it pulls—I found focusing on licenses and violations was the 80/20 for our compliance checks.