Update fossa action to v1.1.0

[r-hang]

Update fossa action to v1.1.0

The FOSSA check has been failing for a while with
fossa-actions@v1 Error: Input required and not supplied: api-key

This has caused the dependabot queue to backup, we also can't merge them
manually in sally because this check is required.

Updating the version seems to cause the check to run successfully again.

Other repositories have run into the same issue
ref: getsentry/self-hosted#1351

[codecov]

Codecov Report

Merging #118 (e7e6599) into master (b1dc33f) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #118   +/-   ##
=======================================
  Coverage   74.03%   74.03%           
=======================================
  Files           3        3           
  Lines         104      104           
=======================================
  Hits           77       77           
  Misses         23       23           
  Partials        4        4           

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[abhinav]

This has caused the dependabot queue to backup, we also can't merge them manually in sally because this check is required.

This is because dependabot PRs don't run with the standard repository secrets by default -- because that's a supply chain attack vector (e.g., ship a malicious update to a small dependency you happen to maintain, let dependabot create PRs on all repositories that use it, steal credentials).

The reason your upgrade PR works is because the author of the PR is a maintainer, not dependabot, so it runs with regular secrets. You can verify this: go to any dependabot PR, do a commit --allow-empty and push a new commit onto that PR. Now that there's a maintainer involved in the PR, it'll run with proper secrets again.

To fix this, you need to separately set Dependabot secrets: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#accessing-secrets. If you're able to do it successfully on this repository, it may be worth setting up Org-level dependabot secrets for fossa.

[r-hang]

Thanks @abhinav, i'll follow up.