test(ci): add OSS Index compat integration test step

Exercises the --username/--token auth path against OSS Index, distinct
from the Guide bearer token path. Step is skipped when OSSI_USERNAME
secret is not configured.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Paul Horton <phorton@sonatype.com>

Author: madpah

.github/workflows/build.yaml

@@ -88,6 +88,16 @@ jobs:
                   go list -json -m all      > dist/deps.out && ./nancy sleuth --token "$SONATYPE_GUIDE_TOKEN" --exclude-vulnerability "$IT_EXCLUDED_VULNS" < dist/deps.out
                   go list -m all            > dist/deps.out && ./nancy sleuth --token "$SONATYPE_GUIDE_TOKEN" --exclude-vulnerability "$IT_EXCLUDED_VULNS" < dist/deps.out
 
+            - name: Run OSS Index compat integration tests
+              if: ${{ secrets.OSSI_USERNAME != '' }}
+              env:
+                  OSSI_USERNAME: ${{ secrets.OSSI_USERNAME }}
+                  OSSI_TOKEN: ${{ secrets.OSSI_TOKEN }}
+                  IT_EXCLUDED_VULNS: CVE-2021-3121,CVE-2022-21698,CVE-2022-29153,sonatype-2021-1401,CVE-2023-32731,CVE-2023-45142,CVE-2024-10086,CVE-2023-29407,CVE-2023-29408,CVE-2022-41727
+              run: |
+                  go list -json -deps ./... | ./nancy sleuth --username "$OSSI_USERNAME" --token "$OSSI_TOKEN"
+                  go list -json -m all      | ./nancy sleuth --username "$OSSI_USERNAME" --token "$OSSI_TOKEN" --exclude-vulnerability "$IT_EXCLUDED_VULNS"
+
             - name: Upload test results
               uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               if: always()