Add fossa to travis config

Note that we can't keep the FOSSA_API_TOKEN secret (e.g. via
Travis encrypted or repository setting environment variables),
because those are not available for PRs from forked repository.
Therefor we use a non-confidential push only API token.

For details see https://docs.fossa.com/docs/travisci and
https://docs.fossa.com/docs/api-reference#section-push-only-api-token

Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>

.travis.yml

@@ -2,6 +2,12 @@ dist: xenial
 language: python
 cache: pip
 
+
+env:
+  global:
+    # NOTE: Public push only token (can't be used to read or edit project info)
+    - FOSSA_API_KEY=cbc317812661645ea400ab9ee6c7616a
+
 matrix:
   include:
     - python: "2.7"
@@ -16,8 +22,12 @@ matrix:
 install:
   - pip install tox coveralls
 
+before_script:
+  - "curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | sudo bash"
+
 script:
   - tox
+  - fossa
 
 after_success:
   # Workaround to get coverage reports with relative paths.