Skip to content

Commit aa03204

Browse files
MatteoPologrutoMatteoPologruto
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent c234831 commit aa03204

File tree

8 files changed

+1709
-0
lines changed

8 files changed

+1709
-0
lines changed

‎.github/workflows/check-go-dependencies-task.yml

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/main#supported-version-syntax
6+
GO_VERSION: "1.19"
7+
8+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
9+
on:
10+
create:
11+
push:
12+
paths:
13+
- ".github/workflows/check-go-dependencies-task.ya?ml"
14+
- ".licenses/**"
15+
- ".licensed.json"
16+
- ".licensed.ya?ml"
17+
- "Taskfile.ya?ml"
18+
- "**/.gitmodules"
19+
- "**/go.mod"
20+
- "**/go.sum"
21+
pull_request:
22+
paths:
23+
- ".github/workflows/check-go-dependencies-task.ya?ml"
24+
- ".licenses/**"
25+
- ".licensed.json"
26+
- ".licensed.ya?ml"
27+
- "Taskfile.ya?ml"
28+
- "**/.gitmodules"
29+
- "**/go.mod"
30+
- "**/go.sum"
31+
schedule:
32+
# Run periodically to catch breakage caused by external changes.
33+
- cron: "0 8 * * WED"
34+
workflow_dispatch:
35+
repository_dispatch:
36+
37+
jobs:
38+
run-determination:
39+
runs-on: ubuntu-latest
40+
outputs:
41+
result: ${{ steps.determination.outputs.result }}
42+
steps:
43+
- name: Determine if the rest of the workflow should run
44+
id: determination
45+
run: |
46+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
47+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
48+
if [[
49+
"${{ github.event_name }}" != "create" ||
50+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
51+
]]; then
52+
# Run the other jobs.
53+
RESULT="true"
54+
else
55+
# There is no need to run the other jobs.
56+
RESULT="false"
57+
fi
58+
59+
echo "result=$RESULT" >> $GITHUB_OUTPUT
60+
61+
check-cache:
62+
needs: run-determination
63+
if: needs.run-determination.outputs.result == 'true'
64+
runs-on: ubuntu-latest
65+
66+
steps:
67+
- name: Checkout repository
68+
uses: actions/checkout@v3
69+
with:
70+
submodules: recursive
71+
72+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
73+
- name: Install Ruby
74+
uses: ruby/setup-ruby@v1
75+
with:
76+
ruby-version: ruby # Install latest version
77+
78+
- name: Install licensed
79+
uses: jonabc/setup-licensed@v1
80+
with:
81+
github_token: ${{ secrets.GITHUB_TOKEN }}
82+
version: 3.x
83+
84+
- name: Install Go
85+
uses: actions/setup-go@v3
86+
with:
87+
go-version: ${{ env.GO_VERSION }}
88+
89+
- name: Install Task
90+
uses: arduino/setup-task@v1
91+
with:
92+
repo-token: ${{ secrets.GITHUB_TOKEN }}
93+
version: 3.x
94+
95+
- name: Update dependencies license metadata cache
96+
run: task --silent general:cache-dep-licenses
97+
98+
- name: Check for outdated cache
99+
id: diff
100+
run: |
101+
git add .
102+
if ! git diff --cached --color --exit-code; then
103+
echo
104+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
105+
exit 1
106+
fi
107+
108+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
109+
- name: Upload cache to workflow artifact
110+
if: failure() && steps.diff.outcome == 'failure'
111+
uses: actions/upload-artifact@v3
112+
with:
113+
if-no-files-found: error
114+
name: dep-licenses-cache
115+
path: .licenses/
116+
117+
check-deps:
118+
needs: run-determination
119+
if: needs.run-determination.outputs.result == 'true'
120+
runs-on: ubuntu-latest
121+
122+
steps:
123+
- name: Checkout repository
124+
uses: actions/checkout@v3
125+
with:
126+
submodules: recursive
127+
128+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
129+
- name: Install Ruby
130+
uses: ruby/setup-ruby@v1
131+
with:
132+
ruby-version: ruby # Install latest version
133+
134+
- name: Install licensed
135+
uses: jonabc/setup-licensed@v1
136+
with:
137+
github_token: ${{ secrets.GITHUB_TOKEN }}
138+
version: 3.x
139+
140+
- name: Install Go
141+
uses: actions/setup-go@v3
142+
with:
143+
go-version: ${{ env.GO_VERSION }}
144+
145+
- name: Install Task
146+
uses: arduino/setup-task@v1
147+
with:
148+
repo-token: ${{ secrets.GITHUB_TOKEN }}
149+
version: 3.x
150+
151+
- name: Check for dependencies with unapproved licenses
152+
run: task --silent general:check-dep-licenses

‎.licensed.yml

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
3+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-3.0/.licensed.yml
4+
allowed:
5+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
6+
- gpl-1.0-or-later
7+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
8+
- gpl-2.0-or-later
9+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
10+
- gpl-3.0-only
11+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
12+
- gpl-3.0-or-later
13+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
14+
- lgpl-2.0-or-later
15+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
16+
- lgpl-2.1-only
17+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
18+
- lgpl-2.1-or-later
19+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
20+
- lgpl-3.0-only
21+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
22+
- lgpl-3.0-or-later
23+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
24+
- fsfap
25+
- apache-2.0
26+
- artistic-2.0
27+
- clartistic
28+
- sleepycat
29+
- bsl-1.0
30+
- bsd-3-clause
31+
- cecill-2.0
32+
- bsd-3-clause-clear
33+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
34+
- ecos-2.0
35+
- ecl-2.0
36+
- efl-2.0
37+
- eudatagrid
38+
- mit
39+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
40+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
41+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
42+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
43+
- ftl
44+
- hpnd
45+
- imatix
46+
- imlib2
47+
- ijg
48+
# "Informal license" - this is a general class of license
49+
- intel
50+
- isc
51+
- mpl-2.0
52+
- ncsa
53+
# "License of Netscape JavaScript" - no SPDX ID
54+
- oldap-2.7
55+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
56+
- cc0-1.0
57+
- cc-pddc
58+
- psf-2.0
59+
- ruby
60+
- sgi-b-2.0
61+
- smlnj
62+
- standardml-nj # Deprecated ID for `smlnj`
63+
- unicode-dfs-2015
64+
- upl-1.0
65+
- unlicense
66+
- vim
67+
- w3c
68+
- wtfpl
69+
- lgpl-2.0-or-later with wxwindows-exception-3.1
70+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
71+
- x11
72+
- xfree86-1.1
73+
- zlib
74+
- zpl-2.0
75+
- zpl-2.1
76+
# The following are based on individual license text
77+
- eupl-1.2
78+
- liliq-r-1.1
79+
- liliq-rplus-1.1

0 commit comments

Comments
 (0)