The current sample code promotes using fossaApiKey in the YAML file which turns into the harder to mentally parse FOSSAAPIKEY in GitHub's UI--which auto upper cases the text.

A much more common pattern (and the one promoted by the GitHub UI) is all capital "snake case": FOSSA_API_KEY

It's not a huge deal maybe, but does mean it's one less annoying/weird thing that developers have to tweak if they want this to feel at home with most other environment variables.

Cheers!
🎩