Fossa validation (#275)

.github/workflows/fossa.yml

@@ -0,0 +1,33 @@
+name: Dependency License Scanning
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * 0' # At 00:00 on Sunday
+
+jobs:
+  fossa:
+    name: Fossa
+    runs-on: ubuntu-latest
+    if: github.repository == 'akka/akka-persistence-r2dbc'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          # we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
+          fetch-depth: 0
+
+      - name: Set up JDK 11
+        uses: olafurpg/setup-scala@v13
+        with:
+          java-version: adopt@1.11
+
+      - name: Cache Coursier cache
+        uses: coursier/cache-action@v6.2
+
+      - name: FOSSA policy check
+        run: |-
+          curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/spectrometer/master/install.sh | bash
+          fossa analyze && fossa test
+        env:
+          FOSSA_API_KEY: "${{secrets.FOSSA_API_KEY}}"