Skip to content

Commit 94aacc9

Browse files
per1234per1234
authored
Merge pull request #14 from per1234/check-dependencies
Add CI workflow to check for unapproved Go dependency licenses
2 parents 3bf2901 + 8a9269e commit 94aacc9

File tree

7 files changed

+920
-2
lines changed

7 files changed

+920
-2
lines changed

‎.codespellrc

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ ignore-words-list = ,
66
builtin = clear,informal,en-GB_to_en-US
77
check-filenames =
88
check-hidden =
9-
skip = ./.git,./go.mod,./go.sum,./package-lock.json,./poetry.lock,./yarn.lock
9+
skip = ./.git,./.licenses,./go.mod,./go.sum,./package-lock.json,./poetry.lock,./yarn.lock

‎.ecrc

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
{
22
"Exclude": [
33
"LICENSE.txt",
4-
"poetry.lock"
4+
"poetry.lock",
5+
"^\\.licenses/"
56
]
67
}

‎.github/workflows/check-go-dependencies-task.yml

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v2#readme
6+
GO_VERSION: "1.16"
7+
8+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
9+
on:
10+
push:
11+
paths:
12+
- ".github/workflows/check-go-dependencies-task.ya?ml"
13+
- ".licenses/**"
14+
- ".licensed.json"
15+
- ".licensed.ya?ml"
16+
- "Taskfile.ya?ml"
17+
- "**/.gitmodules"
18+
- "**/go.mod"
19+
- "**/go.sum"
20+
pull_request:
21+
paths:
22+
- ".github/workflows/check-go-dependencies-task.ya?ml"
23+
- ".licenses/**"
24+
- ".licensed.json"
25+
- ".licensed.ya?ml"
26+
- "Taskfile.ya?ml"
27+
- "**/.gitmodules"
28+
- "**/go.mod"
29+
- "**/go.sum"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
check-cache:
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
with:
41+
submodules: recursive
42+
43+
- name: Install licensed
44+
uses: jonabc/setup-licensed@v1
45+
with:
46+
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 3.x
48+
49+
- name: Install Go
50+
uses: actions/setup-go@v2
51+
with:
52+
go-version: ${{ env.GO_VERSION }}
53+
54+
- name: Install Task
55+
uses: arduino/setup-task@v1
56+
with:
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
version: 3.x
59+
60+
- name: Update dependencies license metadata cache
61+
run: task --silent general:cache-dep-licenses
62+
63+
- name: Check for outdated cache
64+
id: diff
65+
run: |
66+
git add --intent-to-add .
67+
if ! git diff --color --exit-code; then
68+
echo
69+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
70+
exit 1
71+
fi
72+
73+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
74+
- name: Upload cache to workflow artifact
75+
if: failure() && steps.diff.outcome == 'failure'
76+
uses: actions/upload-artifact@v2
77+
with:
78+
if-no-files-found: error
79+
name: dep-licenses-cache
80+
path: .licenses/
81+
82+
check-deps:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v2
88+
with:
89+
submodules: recursive
90+
91+
- name: Install licensed
92+
uses: jonabc/setup-licensed@v1
93+
with:
94+
github_token: ${{ secrets.GITHUB_TOKEN }}
95+
version: 3.x
96+
97+
- name: Install Go
98+
uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Install Task
103+
uses: arduino/setup-task@v1
104+
with:
105+
repo-token: ${{ secrets.GITHUB_TOKEN }}
106+
version: 3.x
107+
108+
- name: Check for dependencies with unapproved licenses
109+
run: task --silent general:check-dep-licenses

‎.licensed.yml

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
apps:
6+
- source_path: ./
7+
8+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-3.0/.licensed.yml
9+
allowed:
10+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
11+
- gpl-1.0-or-later
12+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
13+
- gpl-2.0-or-later
14+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
15+
- gpl-3.0-only
16+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
17+
- gpl-3.0-or-later
18+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
19+
- lgpl-2.0-or-later
20+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
21+
- lgpl-2.1-only
22+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
23+
- lgpl-2.1-or-later
24+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
25+
- lgpl-3.0-only
26+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
27+
- lgpl-3.0-or-later
28+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
29+
- fsfap
30+
- apache-2.0
31+
- artistic-2.0
32+
- clartistic
33+
- sleepycat
34+
- bsl-1.0
35+
- bsd-3-clause
36+
- cecill-2.0
37+
- bsd-3-clause-clear
38+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
39+
- ecos-2.0
40+
- ecl-2.0
41+
- efl-2.0
42+
- eudatagrid
43+
- mit
44+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
45+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
46+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
47+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
48+
- ftl
49+
- hpnd
50+
- imatix
51+
- imlib2
52+
- ijg
53+
# "Informal license" - this is a general class of license
54+
- intel
55+
- isc
56+
- mpl-2.0
57+
- ncsa
58+
# "License of Netscape JavaScript" - no SPDX ID
59+
- oldap-2.7
60+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
61+
- cc0-1.0
62+
- cc-pddc
63+
- psf-2.0
64+
- ruby
65+
- sgi-b-2.0
66+
- smlnj
67+
- standardml-nj # Deprecated ID for `smlnj`
68+
- unicode-dfs-2015
69+
- upl-1.0
70+
- unlicense
71+
- vim
72+
- w3c
73+
- wtfpl
74+
- lgpl-2.0-or-later with wxwindows-exception-3.1
75+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
76+
- x11
77+
- xfree86-1.1
78+
- zlib
79+
- zpl-2.0
80+
- zpl-2.1
81+
# The following are based on individual license text
82+
- eupl-1.2
83+
- liliq-r-1.1
84+
- liliq-rplus-1.1

0 commit comments

Comments
 (0)