Skip to content

Commit 2d6a710

Browse files
per1234per1234
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent 49dc48b commit 2d6a710

File tree

7 files changed

+228
-5
lines changed

7 files changed

+228
-5
lines changed

‎.codespellrc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
[codespell]
44
# In the event of a false positive, add the problematic word, in all lowercase, to a comma-separated list here:
55
ignore-words-list = easly,pullrequest
6-
skip = ./.git,./go.mod,./go.sum,./package-lock.json,./poetry.lock,./yarn.lock
6+
skip = ./.git,./.licenses,./go.mod,./go.sum,./package-lock.json,./poetry.lock,./yarn.lock
77
builtin = clear,informal,en-GB_to_en-US
88
check-filenames =
99
check-hidden =

‎.github/workflows/check-go-dependencies-task.yml

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v2#readme
6+
GO_VERSION: "1.16"
7+
8+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
9+
on:
10+
push:
11+
paths:
12+
- ".github/workflows/check-go-dependencies-task.ya?ml"
13+
- ".licenses/**"
14+
- ".licensed.json"
15+
- ".licensed.ya?ml"
16+
- "Taskfile.ya?ml"
17+
- "**/.gitmodules"
18+
- "**/go.mod"
19+
- "**/go.sum"
20+
pull_request:
21+
paths:
22+
- ".github/workflows/check-go-dependencies-task.ya?ml"
23+
- ".licenses/**"
24+
- ".licensed.json"
25+
- ".licensed.ya?ml"
26+
- "Taskfile.ya?ml"
27+
- "**/.gitmodules"
28+
- "**/go.mod"
29+
- "**/go.sum"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
check-cache:
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
with:
41+
submodules: recursive
42+
43+
- name: Install licensed
44+
uses: jonabc/setup-licensed@v1
45+
with:
46+
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 3.x
48+
49+
- name: Install Go
50+
uses: actions/setup-go@v2
51+
with:
52+
go-version: ${{ env.GO_VERSION }}
53+
54+
- name: Install Task
55+
uses: arduino/setup-task@v1
56+
with:
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
version: 3.x
59+
60+
- name: Update dependencies license metadata cache
61+
run: task --silent general:cache-dep-licenses
62+
63+
- name: Check for outdated cache
64+
id: diff
65+
run: |
66+
git add --intent-to-add .
67+
if ! git diff --color --exit-code; then
68+
echo
69+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
70+
exit 1
71+
fi
72+
73+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
74+
- name: Upload cache to workflow artifact
75+
if: failure() && steps.diff.outcome == 'failure'
76+
uses: actions/upload-artifact@v2
77+
with:
78+
if-no-files-found: error
79+
name: dep-licenses-cache
80+
path: .licenses/
81+
82+
check-deps:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v2
88+
with:
89+
submodules: recursive
90+
91+
- name: Install licensed
92+
uses: jonabc/setup-licensed@v1
93+
with:
94+
github_token: ${{ secrets.GITHUB_TOKEN }}
95+
version: 3.x
96+
97+
- name: Install Go
98+
uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Install Task
103+
uses: arduino/setup-task@v1
104+
with:
105+
repo-token: ${{ secrets.GITHUB_TOKEN }}
106+
version: 3.x
107+
108+
- name: Check for dependencies with unapproved licenses
109+
run: task --silent general:check-dep-licenses

‎.gitignore

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
token
22

33
coverage_*.txt
4-
libraries-repository-engine
5-
libraries-repository-engine.exe
6-
repository
7-
repository.exe
4+
/libraries-repository-engine
5+
!/libraries-repository-engine/
6+
/libraries-repository-engine.exe
7+
/repository
8+
!/repository/
9+
/repository.exe
810
tests/arduino/cc/repository/libraries/testdata/test_db.json
911
/config.json
1012
/repos.txt

‎.licensed.yml

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
apps:
6+
- source_path: ./
7+
8+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/AGPL-3.0/.licensed.yml
9+
allowed:
10+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
11+
- gpl-1.0-or-later
12+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
13+
- gpl-2.0-or-later
14+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
15+
- gpl-3.0-only
16+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
17+
- gpl-3.0-or-later
18+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
19+
- lgpl-2.0-or-later
20+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
21+
- lgpl-2.1-only
22+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
23+
- lgpl-2.1-or-later
24+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
25+
- lgpl-3.0-only
26+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
27+
- lgpl-3.0-or-later
28+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
29+
- agpl-1.0-or-later
30+
- agpl-3.0-only
31+
- agpl-3.0 # Deprecated ID for `agpl-3.0-only`
32+
- agpl-3.0-or-later
33+
- fsfap
34+
- apache-2.0
35+
- artistic-2.0
36+
- clartistic
37+
- sleepycat
38+
- bsl-1.0
39+
- bsd-3-clause
40+
- cecill-2.0
41+
- bsd-3-clause-clear
42+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
43+
- ecos-2.0
44+
- ecl-2.0
45+
- efl-2.0
46+
- eudatagrid
47+
- mit
48+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
49+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
50+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
51+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
52+
- ftl
53+
- hpnd
54+
- imatix
55+
- imlib2
56+
- ijg
57+
# "Informal license" - this is a general class of license
58+
- intel
59+
- isc
60+
- mpl-2.0
61+
- ncsa
62+
# "License of Netscape JavaScript" - no SPDX ID
63+
- oldap-2.7
64+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
65+
- cc0-1.0
66+
- cc-pddc
67+
- psf-2.0
68+
- ruby
69+
- sgi-b-2.0
70+
- smlnj
71+
- standardml-nj # Deprecated ID for `smlnj`
72+
- unicode-dfs-2015
73+
- upl-1.0
74+
- unlicense
75+
- vim
76+
- w3c
77+
- wtfpl
78+
- lgpl-2.0-or-later with wxwindows-exception-3.1
79+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
80+
- x11
81+
- xfree86-1.1
82+
- zlib
83+
- zpl-2.0
84+
- zpl-2.1
85+
# The following are based on individual license text
86+
- eupl-1.2

‎.prettierignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
# See: https://prettier.io/docs/en/ignore.html#ignoring-files-prettierignore
22

3+
/.licenses/
34
/tests/testdata/test_sync/golden/logs/

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
[![Check Taskfiles status](https://github.com/arduino/libraries-repository-engine/actions/workflows/check-taskfiles.yml/badge.svg)](https://github.com/arduino/libraries-repository-engine/actions/workflows/check-taskfiles.yml)
99
[![Spell Check status](https://github.com/arduino/libraries-repository-engine/actions/workflows/spell-check-task.yml/badge.svg)](https://github.com/arduino/libraries-repository-engine/actions/workflows/spell-check-task.yml)
1010
[![Check License status](https://github.com/arduino/libraries-repository-engine/actions/workflows/check-license.yml/badge.svg)](https://github.com/arduino/libraries-repository-engine/actions/workflows/check-license.yml)
11+
[![Check Go Dependencies status](https://github.com/arduino/libraries-repository-engine/actions/workflows/check-go-dependencies-task.yml/badge.svg)](https://github.com/arduino/libraries-repository-engine/actions/workflows/check-go-dependencies-task.yml)
1112

1213
This is the tool that generates [the Arduino Library Manager index](http://downloads.arduino.cc/libraries/library_index.json).
1314

‎Taskfile.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,30 @@ tasks:
132132
cmds:
133133
- npx prettier --write .
134134

135+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
136+
general:cache-dep-licenses:
137+
desc: Cache dependency license metadata
138+
cmds:
139+
- |
140+
if ! which licensed &>/dev/null; then
141+
if [[ {{OS}} == "windows" ]]; then
142+
echo "Licensed does not have Windows support."
143+
echo "Please use Linux/macOS or download the dependencies cache from the GitHub Actions workflow artifact."
144+
else
145+
echo "licensed not found or not in PATH. Please install: https://github.com/github/licensed#as-an-executable"
146+
fi
147+
exit 1
148+
fi
149+
- licensed cache
150+
151+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
152+
general:check-dep-licenses:
153+
desc: Check for unapproved dependency licenses
154+
deps:
155+
- task: general:cache-dep-licenses
156+
cmds:
157+
- licensed status
158+
135159
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/spell-check-task/Taskfile.yml
136160
general:check-spelling:
137161
desc: Check for commonly misspelled words

0 commit comments

Comments
 (0)