Skip to content

Commit 74be199

Browse files
per1234per1234
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent ee88001 commit 74be199

File tree

5 files changed

+220
-2
lines changed

5 files changed

+220
-2
lines changed

‎.codespellrc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ ignore-words-list = ,
66
builtin = clear,informal,en-GB_to_en-US
77
check-filenames =
88
check-hidden =
9-
skip = ./.git,./go.mod,./go.sum,./package-lock.json,./poetry.lock,./yarn.lock
9+
skip = ./.git,./.licenses,./go.mod,./go.sum,./package-lock.json,./poetry.lock,./yarn.lock

‎.ecrc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
{
22
"Exclude": [
33
"LICENSE.txt",
4-
"poetry.lock"
4+
"poetry.lock",
5+
"^\\.licenses/"
56
]
67
}

‎.github/workflows/check-go-dependencies-task.yml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v2#readme
6+
GO_VERSION: "1.16"
7+
8+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
9+
on:
10+
push:
11+
paths:
12+
- ".github/workflows/check-go-dependencies-task.ya?ml"
13+
- ".licenses/**"
14+
- ".licensed.json"
15+
- ".licensed.ya?ml"
16+
- "Taskfile.ya?ml"
17+
- "**/.gitmodules"
18+
- "**/go.mod"
19+
- "**/go.sum"
20+
pull_request:
21+
paths:
22+
- ".github/workflows/check-go-dependencies-task.ya?ml"
23+
- ".licenses/**"
24+
- ".licensed.json"
25+
- ".licensed.ya?ml"
26+
- "Taskfile.ya?ml"
27+
- "**/.gitmodules"
28+
- "**/go.mod"
29+
- "**/go.sum"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
check-cache:
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
with:
41+
submodules: recursive
42+
43+
- name: Install licensed
44+
uses: jonabc/setup-licensed@v1
45+
with:
46+
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 3.x
48+
49+
- name: Install Go
50+
uses: actions/setup-go@v2
51+
with:
52+
go-version: ${{ env.GO_VERSION }}
53+
54+
- name: Install Task
55+
uses: arduino/setup-task@v1
56+
with:
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
version: 3.x
59+
60+
- name: Update dependencies license metadata cache
61+
run: task --silent general:cache-dep-licenses
62+
63+
- name: Check for outdated cache
64+
id: diff
65+
run: |
66+
git add --intent-to-add .
67+
if ! git diff --color --exit-code; then
68+
echo
69+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
70+
exit 1
71+
fi
72+
73+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
74+
- name: Upload cache to workflow artifact
75+
if: failure() && steps.diff.outcome == 'failure'
76+
uses: actions/upload-artifact@v2
77+
with:
78+
if-no-files-found: error
79+
name: dep-licenses-cache
80+
path: .licenses/
81+
82+
check-deps:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v2
88+
with:
89+
submodules: recursive
90+
91+
- name: Install licensed
92+
uses: jonabc/setup-licensed@v1
93+
with:
94+
github_token: ${{ secrets.GITHUB_TOKEN }}
95+
version: 3.x
96+
97+
- name: Install Go
98+
uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Install Task
103+
uses: arduino/setup-task@v1
104+
with:
105+
repo-token: ${{ secrets.GITHUB_TOKEN }}
106+
version: 3.x
107+
108+
- name: Check for dependencies with unapproved licenses
109+
run: task --silent general:check-dep-licenses

‎.licensed.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
apps:
6+
- source_path: ./
7+
8+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-3.0/.licensed.yml
9+
allowed:
10+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
11+
- gpl-1.0-or-later
12+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
13+
- gpl-2.0-or-later
14+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
15+
- gpl-3.0-only
16+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
17+
- gpl-3.0-or-later
18+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
19+
- lgpl-2.0-or-later
20+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
21+
- lgpl-2.1-only
22+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
23+
- lgpl-2.1-or-later
24+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
25+
- lgpl-3.0-only
26+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
27+
- lgpl-3.0-or-later
28+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
29+
- fsfap
30+
- apache-2.0
31+
- artistic-2.0
32+
- clartistic
33+
- sleepycat
34+
- bsl-1.0
35+
- bsd-3-clause
36+
- cecill-2.0
37+
- bsd-3-clause-clear
38+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
39+
- ecos-2.0
40+
- ecl-2.0
41+
- efl-2.0
42+
- eudatagrid
43+
- mit
44+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
45+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
46+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
47+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
48+
- ftl
49+
- hpnd
50+
- imatix
51+
- imlib2
52+
- ijg
53+
# "Informal license" - this is a general class of license
54+
- intel
55+
- isc
56+
- mpl-2.0
57+
- ncsa
58+
# "License of Netscape JavaScript" - no SPDX ID
59+
- oldap-2.7
60+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
61+
- cc0-1.0
62+
- cc-pddc
63+
- psf-2.0
64+
- ruby
65+
- sgi-b-2.0
66+
- smlnj
67+
- standardml-nj # Deprecated ID for `smlnj`
68+
- unicode-dfs-2015
69+
- upl-1.0
70+
- unlicense
71+
- vim
72+
- w3c
73+
- wtfpl
74+
- lgpl-2.0-or-later with wxwindows-exception-3.1
75+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
76+
- x11
77+
- xfree86-1.1
78+
- zlib
79+
- zpl-2.0
80+
- zpl-2.1
81+
# The following are based on individual license text
82+
- eupl-1.2
83+
- liliq-r-1.1
84+
- liliq-rplus-1.1

‎Taskfile.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,30 @@ tasks:
4646
-s "{{.WORKFLOW_SCHEMA_PATH}}" \
4747
-d "{{.WORKFLOWS_DATA_PATH}}"
4848
49+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
50+
general:cache-dep-licenses:
51+
desc: Cache dependency license metadata
52+
cmds:
53+
- |
54+
if ! which licensed &>/dev/null; then
55+
if [[ "{{OS}}" == "windows" ]]; then
56+
echo "Licensed does not have Windows support."
57+
echo "Please use Linux/macOS or download the dependencies cache from the GitHub Actions workflow artifact."
58+
else
59+
echo "licensed not found or not in PATH. Please install: https://github.com/github/licensed#as-an-executable"
60+
fi
61+
exit 1
62+
fi
63+
- licensed cache
64+
65+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
66+
general:check-dep-licenses:
67+
desc: Check for unapproved dependency licenses
68+
deps:
69+
- task: general:cache-dep-licenses
70+
cmds:
71+
- licensed status
72+
4973
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-general-formatting-task/Taskfile.yml
5074
general:check-formatting:
5175
desc: Check basic formatting style of all files

0 commit comments

Comments
 (0)