Analyze only a set of targets

Control which build targets the CLI discovers and how paths map to analyzers.

3 min readUpdated Jul 9, 2026

Overview

FOSSA CLI can be configured to discover and analyze, based on the target type (e.g. gradle, rebar3, etc.) and by its path. This can be useful when multiple targets exist in the directory, but we are only interested in a select few.

To do so, we will use the following:

fossa list-targets command
.fossa.yml configuration file

Example

For an example scenario, presume our source code is structured in the following manner (simplified for brevity):

Shell

.├── src│   ├── back-end│   │   └── pyproject.toml│   └── front-end│       ├── v1│       │   └── package.json│       └── v2│           └── package.json├── test-suite│   ├── browser│   │   ├── package.json│   │   └── yarn.lock│   └── integration│       └── build.gradle└── utils    ├── helpers    │   └── requirements.txt    ├── migration-tests    │   └── build.gradle    ├── requirements.txt    └── scripts        └── requirements.txt

And we are only interested in analyzing:

Any targets under src/back-end/ and src/front-end/v2/ directory
Any targets under utils/ directory,
- But excluding only setuptools targets found in utils/scripts directory.
- But excluding any targets under utils/migration-tests directory

To identify, target and its path discovered by fossa CLI, we can use: fossa list-targets command.

When command is executed, it would produce a list of target and their path:

Shell

[ INFO] Found project: yarn@test-suite/browser/[ INFO] Found target: yarn@test-suite/browser/[ INFO] Found project: setuptools@utils/helpers/[ INFO] Found target: setuptools@utils/helpers/[ INFO] Found project: setuptools@utils/scripts/[ INFO] Found target: setuptools@utils/scripts/[ INFO] Found project: setuptools@utils/[ INFO] Found target: setuptools@utils/[ INFO] Found project: poetry@src/back-end/[ INFO] Found target: poetry@src/back-end/[ INFO] Found project: npm@src/front-end/v1/[ INFO] Found target: npm@src/front-end/v1/[ INFO] Found project: npm@src/front-end/v2/[ INFO] Found target: npm@src/front-end/v2/[ INFO] Found project: gradle@utils/migration-tests/[ INFO] Found target: gradle@utils/migration-tests/:[ INFO] Found project: gradle@test-suite/integration/[ INFO] Found target: gradle@test-suite/integration/:

So,

Let's select any targets under src/back-end and src/front-end/v2/ directory using paths.only directive:

YAML

version: 3 paths:    only:        - src/back-end/        - src/front-end/v2/

We want to scan for targets in the utils directory. Let's add that to the paths to scan for targets.

YAML

version: 3 paths:    only:        - src/back-end/        - src/front-end/v2/        - utils/

We want to exclude any targets in utils/migration-tests/ directory, to do so, use paths.exclude directive. This will ensure cli does not scan utils/migration-tests/ directory for analysis.

YAML

version: 3 paths:    exclude:        - utils/migration-tests/    only:        - src/back-end/        - src/front-end/v2/        - utils/ targets:  exclude:    - type: setuptools      path: utils/scripts/

We want to exclude only setuptools targets in utils/scripts/ directory. Since there may be other type of targets in utils/scripts/ directory, use targets.exclude directive to explicitly ignore analysis of setuptools type in utils/scripts/ directory.

YAML

version: 3 paths:    exclude:        - utils/migration-tests/    only:        - src/back-end/        - src/front-end/v2/        - utils/ targets:  exclude:    - type: setuptools      path: utils/scripts/

Likewise, we can also use targets.only directive to explicitly indicate which targets we are interested. This will achieve the same behavior.

YAML

version: 3 targets:  only:    - type: npm      path: src/front-end/v2/    - type: poetry      path: src/back-end/    - type: setuptools      path: utils/    - type: setuptools      path: utils/helpers/    - type: setuptools      path: utils/helpers/

Target Filtering for Submodules

For some package managers, you may have submodules or sub-projects within a single project that you are analyzing and you may want to analyze only specifics sub project in some cases.

Here is an example with gradle:

Running fossa list-targets

Shell

[ INFO] Found project: gradle@./[ INFO] Found target: gradle@./::app[ INFO] Found target: gradle@./::list[ INFO] Found target: gradle@./::utilities

Note that, targets are denoted in following format type@path:target. For example gradle@./::utilities:

Note: gradle attaches leading colons to submodules, so the utilities submodule here is referenced by ":utilities"

gradle  @           ./      :         :utilities
------ ---          ---    ---        -----------
Type   Path         Path   Target      Target
       separator           separator

Now to analyze only utilities, use .fossa.yml file.

YAML

version: 3targets:  only:    - type: gradle      path: ./      target: ':utilities'

Running fossa analyze --output -c .fossa.yml, will only analyze utilities submodule.