Skip to content

Commit cd05e7c

Browse files
per1234per1234
authored
Merge pull request #35 from per1234/check-dependencies
Add CI workflow to check for unapproved npm dependency licenses
2 parents 5fab484 + bb5f885 commit cd05e7c

14 files changed

+535
-1
lines changed

‎.github/workflows/check-npm-dependencies-task.yml

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-npm-dependencies-task.md
2+
name: Check npm Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-node/#readme
6+
NODE_VERSION: 10.x
7+
8+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
9+
on:
10+
create:
11+
push:
12+
paths:
13+
- ".github/workflows/check-npm-dependencies-task.ya?ml"
14+
- ".licenses/**"
15+
- ".licensed.json"
16+
- ".licensed.ya?ml"
17+
- "Taskfile.ya?ml"
18+
- "**/.gitmodules"
19+
- "**/package.json"
20+
- "**/package-lock.json"
21+
pull_request:
22+
paths:
23+
- ".github/workflows/check-npm-dependencies-task.ya?ml"
24+
- ".licenses/**"
25+
- ".licensed.json"
26+
- ".licensed.ya?ml"
27+
- "Taskfile.ya?ml"
28+
- "**/.gitmodules"
29+
- "**/package.json"
30+
- "**/package-lock.json"
31+
schedule:
32+
# Run periodically to catch breakage caused by external changes.
33+
- cron: "0 8 * * WED"
34+
workflow_dispatch:
35+
repository_dispatch:
36+
37+
jobs:
38+
run-determination:
39+
runs-on: ubuntu-latest
40+
outputs:
41+
result: ${{ steps.determination.outputs.result }}
42+
steps:
43+
- name: Determine if the rest of the workflow should run
44+
id: determination
45+
run: |
46+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
47+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
48+
if [[
49+
"${{ github.event_name }}" != "create" ||
50+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
51+
]]; then
52+
# Run the other jobs.
53+
RESULT="true"
54+
else
55+
# There is no need to run the other jobs.
56+
RESULT="false"
57+
fi
58+
59+
echo "::set-output name=result::$RESULT"
60+
61+
check-cache:
62+
needs: run-determination
63+
if: needs.run-determination.outputs.result == 'true'
64+
runs-on: ubuntu-latest
65+
66+
steps:
67+
- name: Checkout repository
68+
uses: actions/checkout@v3
69+
with:
70+
submodules: recursive
71+
72+
- name: Install licensed
73+
uses: jonabc/setup-licensed@v1
74+
with:
75+
github_token: ${{ secrets.GITHUB_TOKEN }}
76+
version: 3.x
77+
78+
- name: Setup Node.js
79+
uses: actions/setup-node@v3
80+
with:
81+
node-version: ${{ env.NODE_VERSION }}
82+
83+
- name: Install Task
84+
uses: arduino/setup-task@v1
85+
with:
86+
repo-token: ${{ secrets.GITHUB_TOKEN }}
87+
version: 3.x
88+
89+
- name: Update dependencies license metadata cache
90+
run: task --silent general:cache-dep-licenses
91+
92+
- name: Check for outdated cache
93+
id: diff
94+
run: |
95+
git add .
96+
if ! git diff --cached --color --exit-code; then
97+
echo
98+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
99+
exit 1
100+
fi
101+
102+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
103+
- name: Upload cache to workflow artifact
104+
if: failure() && steps.diff.outcome == 'failure'
105+
uses: actions/upload-artifact@v3
106+
with:
107+
if-no-files-found: error
108+
name: dep-licenses-cache
109+
path: .licenses/
110+
111+
check-deps:
112+
needs: run-determination
113+
if: needs.run-determination.outputs.result == 'true'
114+
runs-on: ubuntu-latest
115+
116+
steps:
117+
- name: Checkout repository
118+
uses: actions/checkout@v3
119+
with:
120+
submodules: recursive
121+
122+
- name: Install licensed
123+
uses: jonabc/setup-licensed@v1
124+
with:
125+
github_token: ${{ secrets.GITHUB_TOKEN }}
126+
version: 3.x
127+
128+
- name: Setup Node.js
129+
uses: actions/setup-node@v3
130+
with:
131+
node-version: ${{ env.NODE_VERSION }}
132+
133+
- name: Install Task
134+
uses: arduino/setup-task@v1
135+
with:
136+
repo-token: ${{ secrets.GITHUB_TOKEN }}
137+
version: 3.x
138+
139+
- name: Check for dependencies with unapproved licenses
140+
run: task --silent general:check-dep-licenses

‎.licensed.yml

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
3+
sources:
4+
npm: true
5+
6+
shared_cache: true
7+
cache_path: .licenses/
8+
9+
apps:
10+
- source_path: ./
11+
12+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-3.0/.licensed.yml
13+
allowed:
14+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
15+
- gpl-1.0-or-later
16+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
17+
- gpl-2.0-or-later
18+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
19+
- gpl-3.0-only
20+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
21+
- gpl-3.0-or-later
22+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
23+
- lgpl-2.0-or-later
24+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
25+
- lgpl-2.1-only
26+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
27+
- lgpl-2.1-or-later
28+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
29+
- lgpl-3.0-only
30+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
31+
- lgpl-3.0-or-later
32+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
33+
- fsfap
34+
- apache-2.0
35+
- artistic-2.0
36+
- clartistic
37+
- sleepycat
38+
- bsl-1.0
39+
- bsd-3-clause
40+
- cecill-2.0
41+
- bsd-3-clause-clear
42+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
43+
- ecos-2.0
44+
- ecl-2.0
45+
- efl-2.0
46+
- eudatagrid
47+
- mit
48+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
49+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
50+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
51+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
52+
- ftl
53+
- hpnd
54+
- imatix
55+
- imlib2
56+
- ijg
57+
# "Informal license" - this is a general class of license
58+
- intel
59+
- isc
60+
- mpl-2.0
61+
- ncsa
62+
# "License of Netscape JavaScript" - no SPDX ID
63+
- oldap-2.7
64+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
65+
- cc0-1.0
66+
- cc-pddc
67+
- psf-2.0
68+
- ruby
69+
- sgi-b-2.0
70+
- smlnj
71+
- standardml-nj # Deprecated ID for `smlnj`
72+
- unicode-dfs-2015
73+
- upl-1.0
74+
- unlicense
75+
- vim
76+
- w3c
77+
- wtfpl
78+
- lgpl-2.0-or-later with wxwindows-exception-3.1
79+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
80+
- x11
81+
- xfree86-1.1
82+
- zlib
83+
- zpl-2.0
84+
- zpl-2.1
85+
# The following are based on individual license text
86+
- eupl-1.2
87+
- liliq-r-1.1
88+
- liliq-rplus-1.1

‎.licenses/npm/@actions/core.dep.yml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: "@actions/core"
3+
version: 1.2.6
4+
type: npm
5+
summary: Actions core lib
6+
homepage: https://github.com/actions/toolkit/tree/main/packages/core
7+
license: mit
8+
licenses:
9+
- sources: LICENSE.md
10+
text: |-
11+
The MIT License (MIT)
12+
13+
Copyright 2019 GitHub
14+
15+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
16+
17+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
18+
19+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
20+
notices: []

‎.licenses/npm/@actions/exec.dep.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
name: "@actions/exec"
3+
version: 1.0.0
4+
type: npm
5+
summary: Actions exec lib
6+
homepage: https://github.com/actions/toolkit/tree/master/packages/exec
7+
license: mit
8+
licenses:
9+
- sources: LICENSE.md
10+
text: |-
11+
Copyright 2019 GitHub
12+
13+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
14+
15+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
16+
17+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
18+
notices: []

‎.licenses/npm/@actions/io.dep.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
name: "@actions/io"
3+
version: 1.0.0
4+
type: npm
5+
summary: Actions io lib
6+
homepage: https://github.com/actions/toolkit/tree/master/packages/io
7+
license: mit
8+
licenses:
9+
- sources: LICENSE.md
10+
text: |-
11+
Copyright 2019 GitHub
12+
13+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
14+
15+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
16+
17+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
18+
notices: []

‎.licenses/npm/@actions/tool-cache.dep.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
name: "@actions/tool-cache"
3+
version: 1.1.0
4+
type: npm
5+
summary: Actions tool-cache lib
6+
homepage: https://github.com/actions/toolkit/tree/master/packages/exec
7+
license: mit
8+
licenses:
9+
- sources: Auto-generated MIT license text
10+
text: |
11+
MIT License
12+
13+
Permission is hereby granted, free of charge, to any person obtaining a copy
14+
of this software and associated documentation files (the "Software"), to deal
15+
in the Software without restriction, including without limitation the rights
16+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
17+
copies of the Software, and to permit persons to whom the Software is
18+
furnished to do so, subject to the following conditions:
19+
20+
The above copyright notice and this permission notice shall be included in all
21+
copies or substantial portions of the Software.
22+
23+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
24+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
25+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
26+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
27+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
28+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
29+
SOFTWARE.
30+
notices: []

‎.licenses/npm/semver.dep.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
name: semver
3+
version: 6.3.0
4+
type: npm
5+
summary: The semantic version parser used by npm.
6+
homepage: https://github.com/npm/node-semver#readme
7+
license: isc
8+
licenses:
9+
- sources: LICENSE
10+
text: |
11+
The ISC License
12+
13+
Copyright (c) Isaac Z. Schlueter and Contributors
14+
15+
Permission to use, copy, modify, and/or distribute this software for any
16+
purpose with or without fee is hereby granted, provided that the above
17+
copyright notice and this permission notice appear in all copies.
18+
19+
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
20+
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
21+
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
22+
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
23+
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
24+
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
25+
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
26+
notices: []

‎.licenses/npm/tunnel.dep.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
name: tunnel
3+
version: 0.0.4
4+
type: npm
5+
summary: Node HTTP/HTTPS Agents for tunneling proxies
6+
homepage: https://github.com/koichik/node-tunnel/
7+
license: mit
8+
licenses:
9+
- sources: LICENSE
10+
text: |
11+
The MIT License (MIT)
12+
13+
Copyright (c) 2012 Koichi Kobayashi
14+
15+
Permission is hereby granted, free of charge, to any person obtaining a copy
16+
of this software and associated documentation files (the "Software"), to deal
17+
in the Software without restriction, including without limitation the rights
18+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
19+
copies of the Software, and to permit persons to whom the Software is
20+
furnished to do so, subject to the following conditions:
21+
22+
The above copyright notice and this permission notice shall be included in
23+
all copies or substantial portions of the Software.
24+
25+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
26+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
27+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
28+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
29+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
30+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
31+
THE SOFTWARE.
32+
- sources: README.md
33+
text: Licensed under the [MIT](https://github.com/koichik/node-tunnel/blob/master/LICENSE)
34+
license.
35+
notices: []

0 commit comments

Comments
 (0)