Merge pull request #1650 from RainbowMango/pr_fossa_sec

Disable fossa on forked repository

.github/workflows/fossa.yml

@@ -1,12 +1,13 @@
 name: FOSSA
 on:
-  # Run this workflow every time a new commit pushed to upstream/fork repository.
-  # Run workflow on fork repository will help contributors find and resolve issues before sending a PR.
   push:
-  pull_request:
 jobs:
   fossa:
     name: FOSSA
+    # prevent job running from forked repository, otherwise
+    # 1. running on the forked repository would fail as missing necessary secret.
+    # 2. running on the forked repository would use unnecessary GitHub Action time.
+    if: ${{ github.repository == 'karmada-io/karmada' }}
     runs-on: ubuntu-18.04
     steps:
       - name: checkout code
@@ -14,4 +15,4 @@ jobs:
       - name: Run FOSSA scan and upload build data
         uses: fossas/fossa-action@v1
         with:
-          api-key: 7ac0174603e25cb0a4b3ebd2e131a89f
+          api-key: ${{secrets.FOSSA_API_KEY}}