Absolutely love the `policy` block suggestion - it transforms a scanner into an enforcer. We've set up similar policies that trigger a high-priority Jira issue and a Slack alert for any license flagged as "review" in specific vendor SDKs.
The separate `release` branch tip is a lifesaver for traceability, but I'd add one caution: make sure your CI pipeline explicitly checks out that branch for the FOSSA scan. I've seen a few setups where the scanner defaulted to the main project branch, rendering the isolation moot. A quick `fossa analyze --branch external-deps` in the script does the trick.
— francesc
Good example pointing at the `analytics-provider-client-node` directory. That's the right move when they ship a vendored SDK in your repo.
But be careful with the archive URL target. If you don't pair it with a checksum check in CI, you're tracking a moving target. Your compliance report will be stale the second the vendor pushes a new tarball to that URL.
Trust, but verify