Skip to content

Commit a5339c9

Browse files
per1234per1234
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent 0b40408 commit a5339c9

File tree

8 files changed

+246
-1
lines changed

8 files changed

+246
-1
lines changed

‎.codespellrc

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
[codespell]
44
# In the event of a false positive, add the problematic word, in all lowercase, to a comma-separated list here:
55
ignore-words-list = ot,propert
6-
skip = ./.git,**/go.mod,**/go.sum,./package-lock.json,./poetry.lock,./yarn.lock,./arduino-lint,./arduino-lint.exe,./internal/rule/rulefunction/testdata/libraries/MisspelledSentenceParagraphValue/library.properties,./site
6+
skip = ./.git,./.licenses,**/go.mod,**/go.sum,./package-lock.json,./poetry.lock,./yarn.lock,./arduino-lint,./arduino-lint.exe,./internal/rule/rulefunction/testdata/libraries/MisspelledSentenceParagraphValue/library.properties,./site
77
builtin = clear,informal,en-GB_to_en-US
88
check-filenames =
99
check-hidden =

‎.ecrc

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
"Exclude": [
33
"^LICENSE\\.txt$",
44
"^poetry\\.lock$",
5+
"^\\.licenses/",
56
"^internal/rule/schema/schemadata/bindata.go$",
67
"^internal/rule/schema/testdata/bindata.go$"
78
]

‎.github/workflows/check-go-dependencies-task.yml

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v2#readme
6+
GO_VERSION: "1.16"
7+
8+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
9+
on:
10+
push:
11+
paths:
12+
- ".github/workflows/check-go-dependencies-task.ya?ml"
13+
- ".licenses/**"
14+
- ".licensed.json"
15+
- ".licensed.ya?ml"
16+
- "Taskfile.ya?ml"
17+
- "**/.gitmodules"
18+
- "**/go.mod"
19+
- "**/go.sum"
20+
pull_request:
21+
paths:
22+
- ".github/workflows/check-go-dependencies-task.ya?ml"
23+
- ".licenses/**"
24+
- ".licensed.json"
25+
- ".licensed.ya?ml"
26+
- "Taskfile.ya?ml"
27+
- "**/.gitmodules"
28+
- "**/go.mod"
29+
- "**/go.sum"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
check-cache:
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
with:
41+
submodules: recursive
42+
43+
- name: Install licensed
44+
uses: jonabc/setup-licensed@v1
45+
with:
46+
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 3.x
48+
49+
- name: Install Go
50+
uses: actions/setup-go@v2
51+
with:
52+
go-version: ${{ env.GO_VERSION }}
53+
54+
- name: Install Task
55+
uses: arduino/setup-task@v1
56+
with:
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
version: 3.x
59+
60+
- name: Update dependencies license metadata cache
61+
run: task --silent general:cache-dep-licenses
62+
63+
- name: Check for outdated cache
64+
id: diff
65+
run: |
66+
git add --intent-to-add .
67+
if ! git diff --color --exit-code; then
68+
echo
69+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
70+
exit 1
71+
fi
72+
73+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
74+
- name: Upload cache to workflow artifact
75+
if: failure() && steps.diff.outcome == 'failure'
76+
uses: actions/upload-artifact@v2
77+
with:
78+
if-no-files-found: error
79+
name: dep-licenses-cache
80+
path: .licenses/
81+
82+
check-deps:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v2
88+
with:
89+
submodules: recursive
90+
91+
- name: Install licensed
92+
uses: jonabc/setup-licensed@v1
93+
with:
94+
github_token: ${{ secrets.GITHUB_TOKEN }}
95+
version: 3.x
96+
97+
- name: Install Go
98+
uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Install Task
103+
uses: arduino/setup-task@v1
104+
with:
105+
repo-token: ${{ secrets.GITHUB_TOKEN }}
106+
version: 3.x
107+
108+
- name: Check for dependencies with unapproved licenses
109+
run: task --silent general:check-dep-licenses

‎.licensed.yml

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
shared_cache: true
6+
cache_path: .licenses/
7+
8+
apps:
9+
- source_path: ./
10+
- source_path: docsgen/
11+
- source_path: ruledocsgen/
12+
13+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-3.0/.licensed.yml
14+
allowed:
15+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
16+
- gpl-1.0-or-later
17+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
18+
- gpl-2.0-or-later
19+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
20+
- gpl-3.0-only
21+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
22+
- gpl-3.0-or-later
23+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
24+
- lgpl-2.0-or-later
25+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
26+
- lgpl-2.1-only
27+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
28+
- lgpl-2.1-or-later
29+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
30+
- lgpl-3.0-only
31+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
32+
- lgpl-3.0-or-later
33+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
34+
- fsfap
35+
- apache-2.0
36+
- artistic-2.0
37+
- clartistic
38+
- sleepycat
39+
- bsl-1.0
40+
- bsd-3-clause
41+
- cecill-2.0
42+
- bsd-3-clause-clear
43+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
44+
- ecos-2.0
45+
- ecl-2.0
46+
- efl-2.0
47+
- eudatagrid
48+
- mit
49+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
50+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
51+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
52+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
53+
- ftl
54+
- hpnd
55+
- imatix
56+
- imlib2
57+
- ijg
58+
# "Informal license" - this is a general class of license
59+
- intel
60+
- isc
61+
- mpl-2.0
62+
- ncsa
63+
# "License of Netscape JavaScript" - no SPDX ID
64+
- oldap-2.7
65+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
66+
- cc0-1.0
67+
- cc-pddc
68+
- psf-2.0
69+
- ruby
70+
- sgi-b-2.0
71+
- smlnj
72+
- standardml-nj # Deprecated ID for `smlnj`
73+
- unicode-dfs-2015
74+
- upl-1.0
75+
- unlicense
76+
- vim
77+
- w3c
78+
- wtfpl
79+
- lgpl-2.0-or-later with wxwindows-exception-3.1
80+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
81+
- x11
82+
- xfree86-1.1
83+
- zlib
84+
- zpl-2.0
85+
- zpl-2.1
86+
# The following are based on individual license text
87+
- eupl-1.2
88+
- liliq-r-1.1
89+
- liliq-rplus-1.1

‎.prettierignore

+3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@
44
.vs/
55
.ionide/
66

7+
# Generated files
8+
/.licenses/
9+
710
# Test files
811
/internal/rule/schema/testdata/input/invalid-schema.json
912
/internal/project/projectdata/testdata/packageindexes/invalid-JSON/package_foo_index.json

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
[![Test Integration status](https://github.com/arduino/arduino-lint/actions/workflows/test-go-integration-task.yml/badge.svg)](https://github.com/arduino/arduino-lint/actions/workflows/test-go-integration-task.yml)
55
[![Check Go status](https://github.com/arduino/arduino-lint/actions/workflows/check-go-task.yml/badge.svg)](https://github.com/arduino/arduino-lint/actions/workflows/check-go-task.yml)
66
[![Check Code Generation status](https://github.com/arduino/arduino-lint/actions/workflows/check-code-generation-task.yml/badge.svg)](https://github.com/arduino/arduino-lint/actions/workflows/check-code-generation-task.yml)
7+
[![Check Go Dependencies status](https://github.com/arduino/arduino-lint/actions/workflows/check-go-dependencies-task.yml/badge.svg)](https://github.com/arduino/arduino-lint/actions/workflows/check-go-dependencies-task.yml)
78
[![Publish Tester Build status](https://github.com/arduino/arduino-lint/actions/workflows/publish-go-tester-task.yml/badge.svg)](https://github.com/arduino/arduino-lint/actions/workflows/publish-go-tester-task.yml)
89
[![Publish Nightly Build status](https://github.com/arduino/arduino-lint/actions/workflows/publish-go-nightly-task.yml/badge.svg)](https://github.com/arduino/arduino-lint/actions/workflows/publish-go-nightly-task.yml)
910
[![Check Python status](https://github.com/arduino/arduino-lint/actions/workflows/check-python-task.yml/badge.svg)](https://github.com/arduino/arduino-lint/actions/workflows/check-python-task.yml)

‎Taskfile.yml

+24
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,30 @@ tasks:
113113
# Make the formatting consistent with the non-generated Markdown
114114
- task: general:format-prettier
115115

116+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
117+
general:cache-dep-licenses:
118+
desc: Cache dependency license metadata
119+
cmds:
120+
- |
121+
if ! which licensed &>/dev/null; then
122+
if [[ {{OS}} == "windows" ]]; then
123+
echo "Licensed does not have Windows support."
124+
echo "Please use Linux/macOS or download the dependencies cache from the GitHub Actions workflow artifact."
125+
else
126+
echo "licensed not found or not in PATH. Please install: https://github.com/github/licensed#as-an-executable"
127+
fi
128+
exit 1
129+
fi
130+
- licensed cache
131+
132+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
133+
general:check-dep-licenses:
134+
desc: Check for unapproved dependency licenses
135+
deps:
136+
- task: general:cache-dep-licenses
137+
cmds:
138+
- licensed status
139+
116140
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-general-formatting-task/Taskfile.yml
117141
general:check-formatting:
118142
desc: Check basic formatting style of all files

‎docs/CONTRIBUTING.md

+18
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,24 @@ pytest test_lib.py
167167
pytest test_lib.py::test_list
168168
```
169169

170+
### Dependency license metadata
171+
172+
Metadata about the license types of all dependencies is cached in the repository. To update this cache, run the
173+
following command from the repository root folder:
174+
175+
```
176+
task general:cache-dep-licenses
177+
```
178+
179+
The necessary **Licensed** tool can be installed by following
180+
[these instructions](https://github.com/github/licensed#as-an-executable).
181+
182+
Unfortunately, **Licensed** does not have Windows support.
183+
184+
An updated cache is also generated whenever the cache is found to be outdated by the by the "Check Go Dependencies" CI
185+
workflow and made available for download via the `dep-licenses-cache`
186+
[workflow artifact](https://docs.github.com/en/actions/managing-workflow-runs/downloading-workflow-artifacts).
187+
170188
<a id="linting-and-formatting"></a> <a id="configuration-files-formatting"></a> <a id="documentation-formatting"></a>
171189

172190
### Automated corrections

0 commit comments

Comments
 (0)