Skip to content

Commit 8d8b46e

Browse files
per1234per1234
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent 2f7a0d0 commit 8d8b46e

File tree

4 files changed

+246
-0
lines changed

4 files changed

+246
-0
lines changed

Diff for: ‎.github/workflows/check-go-dependencies-task.yml

+140
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/main#supported-version-syntax
6+
GO_VERSION: "1.17"
7+
8+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
9+
on:
10+
create:
11+
push:
12+
paths:
13+
- ".github/workflows/check-go-dependencies-task.ya?ml"
14+
- ".licenses/**"
15+
- ".licensed.json"
16+
- ".licensed.ya?ml"
17+
- "Taskfile.ya?ml"
18+
- "**/.gitmodules"
19+
- "**/go.mod"
20+
- "**/go.sum"
21+
pull_request:
22+
paths:
23+
- ".github/workflows/check-go-dependencies-task.ya?ml"
24+
- ".licenses/**"
25+
- ".licensed.json"
26+
- ".licensed.ya?ml"
27+
- "Taskfile.ya?ml"
28+
- "**/.gitmodules"
29+
- "**/go.mod"
30+
- "**/go.sum"
31+
schedule:
32+
# Run periodically to catch breakage caused by external changes.
33+
- cron: "0 8 * * WED"
34+
workflow_dispatch:
35+
repository_dispatch:
36+
37+
jobs:
38+
run-determination:
39+
runs-on: ubuntu-latest
40+
outputs:
41+
result: ${{ steps.determination.outputs.result }}
42+
steps:
43+
- name: Determine if the rest of the workflow should run
44+
id: determination
45+
run: |
46+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
47+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
48+
if [[
49+
"${{ github.event_name }}" != "create" ||
50+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
51+
]]; then
52+
# Run the other jobs.
53+
RESULT="true"
54+
else
55+
# There is no need to run the other jobs.
56+
RESULT="false"
57+
fi
58+
59+
echo "::set-output name=result::$RESULT"
60+
61+
check-cache:
62+
needs: run-determination
63+
if: needs.run-determination.outputs.result == 'true'
64+
runs-on: ubuntu-latest
65+
66+
steps:
67+
- name: Checkout repository
68+
uses: actions/checkout@v3
69+
with:
70+
submodules: recursive
71+
72+
- name: Install licensed
73+
uses: jonabc/setup-licensed@v1
74+
with:
75+
github_token: ${{ secrets.GITHUB_TOKEN }}
76+
version: 3.x
77+
78+
- name: Install Go
79+
uses: actions/setup-go@v3
80+
with:
81+
go-version: ${{ env.GO_VERSION }}
82+
83+
- name: Install Task
84+
uses: arduino/setup-task@v1
85+
with:
86+
repo-token: ${{ secrets.GITHUB_TOKEN }}
87+
version: 3.x
88+
89+
- name: Update dependencies license metadata cache
90+
run: task --silent general:cache-dep-licenses
91+
92+
- name: Check for outdated cache
93+
id: diff
94+
run: |
95+
git add .
96+
if ! git diff --cached --color --exit-code; then
97+
echo
98+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
99+
exit 1
100+
fi
101+
102+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
103+
- name: Upload cache to workflow artifact
104+
if: failure() && steps.diff.outcome == 'failure'
105+
uses: actions/upload-artifact@v3
106+
with:
107+
if-no-files-found: error
108+
name: dep-licenses-cache
109+
path: .licenses/
110+
111+
check-deps:
112+
needs: run-determination
113+
if: needs.run-determination.outputs.result == 'true'
114+
runs-on: ubuntu-latest
115+
116+
steps:
117+
- name: Checkout repository
118+
uses: actions/checkout@v3
119+
with:
120+
submodules: recursive
121+
122+
- name: Install licensed
123+
uses: jonabc/setup-licensed@v1
124+
with:
125+
github_token: ${{ secrets.GITHUB_TOKEN }}
126+
version: 3.x
127+
128+
- name: Install Go
129+
uses: actions/setup-go@v3
130+
with:
131+
go-version: ${{ env.GO_VERSION }}
132+
133+
- name: Install Task
134+
uses: arduino/setup-task@v1
135+
with:
136+
repo-token: ${{ secrets.GITHUB_TOKEN }}
137+
version: 3.x
138+
139+
- name: Check for dependencies with unapproved licenses
140+
run: task --silent general:check-dep-licenses

Diff for: ‎.licensed.yml

+81
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-3.0/.licensed.yml
6+
allowed:
7+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
8+
- gpl-1.0-or-later
9+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
10+
- gpl-2.0-or-later
11+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
12+
- gpl-3.0-only
13+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
14+
- gpl-3.0-or-later
15+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
16+
- lgpl-2.0-or-later
17+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
18+
- lgpl-2.1-only
19+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
20+
- lgpl-2.1-or-later
21+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
22+
- lgpl-3.0-only
23+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
24+
- lgpl-3.0-or-later
25+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
26+
- fsfap
27+
- apache-2.0
28+
- artistic-2.0
29+
- clartistic
30+
- sleepycat
31+
- bsl-1.0
32+
- bsd-3-clause
33+
- cecill-2.0
34+
- bsd-3-clause-clear
35+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
36+
- ecos-2.0
37+
- ecl-2.0
38+
- efl-2.0
39+
- eudatagrid
40+
- mit
41+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
42+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
43+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
44+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
45+
- ftl
46+
- hpnd
47+
- imatix
48+
- imlib2
49+
- ijg
50+
# "Informal license" - this is a general class of license
51+
- intel
52+
- isc
53+
- mpl-2.0
54+
- ncsa
55+
# "License of Netscape JavaScript" - no SPDX ID
56+
- oldap-2.7
57+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
58+
- cc0-1.0
59+
- cc-pddc
60+
- psf-2.0
61+
- ruby
62+
- sgi-b-2.0
63+
- smlnj
64+
- standardml-nj # Deprecated ID for `smlnj`
65+
- unicode-dfs-2015
66+
- upl-1.0
67+
- unlicense
68+
- vim
69+
- w3c
70+
- wtfpl
71+
- lgpl-2.0-or-later with wxwindows-exception-3.1
72+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
73+
- x11
74+
- xfree86-1.1
75+
- zlib
76+
- zpl-2.0
77+
- zpl-2.1
78+
# The following are based on individual license text
79+
- eupl-1.2
80+
- liliq-r-1.1
81+
- liliq-rplus-1.1

Diff for: ‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# arduinoOTA
22

33
[![Check General Formatting status](https://github.com/arduino/arduinoOTA/actions/workflows/check-general-formatting-task.yml/badge.svg)](https://github.com/arduino/arduinoOTA/actions/workflows/check-general-formatting-task.yml)
4+
[![Check Go Dependencies status](https://github.com/arduino/arduinoOTA/actions/workflows/check-go-dependencies-task.yml/badge.svg)](https://github.com/arduino/arduinoOTA/actions/workflows/check-go-dependencies-task.yml)
45
[![Check Go status](https://github.com/arduino/arduinoOTA/actions/workflows/check-go-task.yml/badge.svg)](https://github.com/arduino/arduinoOTA/actions/workflows/check-go-task.yml)
56
[![Check npm status](https://github.com/arduino/arduinoOTA/actions/workflows/check-npm-task.yml/badge.svg)](https://github.com/arduino/arduinoOTA/actions/workflows/check-npm-task.yml)
67
[![Check Prettier Formatting status](https://github.com/arduino/arduinoOTA/actions/workflows/check-prettier-formatting-task.yml/badge.svg)](https://github.com/arduino/arduinoOTA/actions/workflows/check-prettier-formatting-task.yml)

Diff for: ‎Taskfile.yml

+24
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,30 @@ tasks:
6363
cmds:
6464
- npx prettier --write .
6565

66+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
67+
general:cache-dep-licenses:
68+
desc: Cache dependency license metadata
69+
cmds:
70+
- |
71+
if ! which licensed &>/dev/null; then
72+
if [[ {{OS}} == "windows" ]]; then
73+
echo "Licensed does not have Windows support."
74+
echo "Please use Linux/macOS or download the dependencies cache from the GitHub Actions workflow artifact."
75+
else
76+
echo "licensed not found or not in PATH. Please install: https://github.com/github/licensed#as-an-executable"
77+
fi
78+
exit 1
79+
fi
80+
- licensed cache
81+
82+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
83+
general:check-dep-licenses:
84+
desc: Check for unapproved dependency licenses
85+
deps:
86+
- task: general:cache-dep-licenses
87+
cmds:
88+
- licensed status
89+
6690
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/spell-check-task/Taskfile.yml
6791
general:check-spelling:
6892
desc: Check for commonly misspelled words

0 commit comments

Comments
 (0)