Skip to content

Commit 6861f49

Browse files
per1234per1234
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent 13653fc commit 6861f49

File tree

6 files changed

+228
-0
lines changed

6 files changed

+228
-0
lines changed

‎.ecrc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
"^indexes/testdata/package_index\\.json$",
77
"^LICENSE\\.txt$",
88
"^poetry\\.lock$",
9+
"^\\.licenses/",
910
".+\\.cer$",
1011
".+\\.elf$",
1112
".+\\.key$",

‎.github/workflows/check-go-dependencies-task.yml

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v2#readme
6+
GO_VERSION: "1.16"
7+
8+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
9+
on:
10+
push:
11+
paths:
12+
- ".github/workflows/check-go-dependencies-task.ya?ml"
13+
- ".licenses/**"
14+
- ".licensed.json"
15+
- ".licensed.ya?ml"
16+
- "Taskfile.ya?ml"
17+
- "**/.gitmodules"
18+
- "**/go.mod"
19+
- "**/go.sum"
20+
pull_request:
21+
paths:
22+
- ".github/workflows/check-go-dependencies-task.ya?ml"
23+
- ".licenses/**"
24+
- ".licensed.json"
25+
- ".licensed.ya?ml"
26+
- "Taskfile.ya?ml"
27+
- "**/.gitmodules"
28+
- "**/go.mod"
29+
- "**/go.sum"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
check-cache:
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
with:
41+
submodules: recursive
42+
43+
- name: Install licensed
44+
uses: jonabc/setup-licensed@v1
45+
with:
46+
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 3.x
48+
49+
- name: Install Go
50+
uses: actions/setup-go@v2
51+
with:
52+
go-version: ${{ env.GO_VERSION }}
53+
54+
- name: Install Task
55+
uses: arduino/setup-task@v1
56+
with:
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
version: 3.x
59+
60+
- name: Update dependencies license metadata cache
61+
run: task --silent general:cache-dep-licenses
62+
63+
- name: Check for outdated cache
64+
id: diff
65+
run: |
66+
git add --intent-to-add .
67+
if ! git diff --color --exit-code; then
68+
echo
69+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
70+
exit 1
71+
fi
72+
73+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
74+
- name: Upload cache to workflow artifact
75+
if: failure() && steps.diff.outcome == 'failure'
76+
uses: actions/upload-artifact@v2
77+
with:
78+
if-no-files-found: error
79+
name: dep-licenses-cache
80+
path: .licenses/
81+
82+
check-deps:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v2
88+
with:
89+
submodules: recursive
90+
91+
- name: Install licensed
92+
uses: jonabc/setup-licensed@v1
93+
with:
94+
github_token: ${{ secrets.GITHUB_TOKEN }}
95+
version: 3.x
96+
97+
- name: Install Go
98+
uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Install Task
103+
uses: arduino/setup-task@v1
104+
with:
105+
repo-token: ${{ secrets.GITHUB_TOKEN }}
106+
version: 3.x
107+
108+
- name: Check for dependencies with unapproved licenses
109+
run: task --silent general:check-dep-licenses

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
/debug
22
/arduino-fwuploader*
3+
!/arduino-fwuploader*/
34
/.vscode/
45
.idea
56
coverage_*.txt

‎.licensed.yml

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
shared_cache: true
6+
cache_path: .licenses/
7+
8+
apps:
9+
- source_path: ./
10+
- source_path: docsgen/
11+
12+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/AGPL-3.0/.licensed.yml
13+
allowed:
14+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
15+
- gpl-1.0-or-later
16+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
17+
- gpl-2.0-or-later
18+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
19+
- gpl-3.0-only
20+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
21+
- gpl-3.0-or-later
22+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
23+
- lgpl-2.0-or-later
24+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
25+
- lgpl-2.1-only
26+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
27+
- lgpl-2.1-or-later
28+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
29+
- lgpl-3.0-only
30+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
31+
- lgpl-3.0-or-later
32+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
33+
- agpl-1.0-or-later
34+
- agpl-3.0-only
35+
- agpl-3.0 # Deprecated ID for `agpl-3.0-only`
36+
- agpl-3.0-or-later
37+
- fsfap
38+
- apache-2.0
39+
- artistic-2.0
40+
- clartistic
41+
- sleepycat
42+
- bsl-1.0
43+
- bsd-3-clause
44+
- cecill-2.0
45+
- bsd-3-clause-clear
46+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
47+
- ecos-2.0
48+
- ecl-2.0
49+
- efl-2.0
50+
- eudatagrid
51+
- mit
52+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
53+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
54+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
55+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
56+
- ftl
57+
- hpnd
58+
- imatix
59+
- imlib2
60+
- ijg
61+
# "Informal license" - this is a general class of license
62+
- intel
63+
- isc
64+
- mpl-2.0
65+
- ncsa
66+
# "License of Netscape JavaScript" - no SPDX ID
67+
- oldap-2.7
68+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
69+
- cc0-1.0
70+
- cc-pddc
71+
- psf-2.0
72+
- ruby
73+
- sgi-b-2.0
74+
- smlnj
75+
- standardml-nj # Deprecated ID for `smlnj`
76+
- unicode-dfs-2015
77+
- upl-1.0
78+
- unlicense
79+
- vim
80+
- w3c
81+
- wtfpl
82+
- lgpl-2.0-or-later with wxwindows-exception-3.1
83+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
84+
- x11
85+
- xfree86-1.1
86+
- zlib
87+
- zpl-2.0
88+
- zpl-2.1
89+
# The following are based on individual license text
90+
- eupl-1.2

‎.prettierignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,6 @@ indexes/download/testdata/module_firmware_index.json
88
indexes/download/testdata/package_index.json
99
indexes/firmwareindex/testdata/module_firmware_index.json
1010
indexes/testdata/package_index.json
11+
12+
# Generated files
13+
/.licenses/

‎Taskfile.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,30 @@ tasks:
2929
cmds:
3030
- npx {{ .PRETTIER }} --write "**/*.md"
3131

32+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
33+
general:cache-dep-licenses:
34+
desc: Cache dependency license metadata
35+
cmds:
36+
- |
37+
if ! which licensed &>/dev/null; then
38+
if [[ {{OS}} == "windows" ]]; then
39+
echo "Licensed does not have Windows support."
40+
echo "Please use Linux/macOS or download the dependencies cache from the GitHub Actions workflow artifact."
41+
else
42+
echo "licensed not found or not in PATH. Please install: https://github.com/github/licensed#as-an-executable"
43+
fi
44+
exit 1
45+
fi
46+
- licensed cache
47+
48+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
49+
general:check-dep-licenses:
50+
desc: Check for unapproved dependency licenses
51+
deps:
52+
- task: general:cache-dep-licenses
53+
cmds:
54+
- licensed status
55+
3256
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-prettier-formatting-task/Taskfile.yml
3357
general:format-prettier:
3458
desc: Format all supported files with Prettier

0 commit comments

Comments
 (0)