Skip to content

Commit 37cd9ef

Browse files
per1234per1234
authored
[skip changelog] Add CI workflow to check for unapproved Go dependency licenses (#1525)
* Add CI workflow to check for unapproved Go dependency licenses A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency * Make initial commit of dependency license metadata The folder contains a cache of license metadata for all the project's Go dependencies. This serves two purposes: - Allow the Licensed dependency license checker tool to only check licenses when a dependency is added or updated - Allow the maintainer to manually define license metadata when the licensee tool is unable to automatically detect it * Manually define dependency license metadata that was not detected The "Licensed" dependency license checker tool uses the licensee tool to automatically determine the license type based on metadata provided by the dependency author. This must be in a standardized format without any modifications. In cases where that wasn't done, it is necessary to determine the license type and update the dependency license metadata cache in the `.licenses` folder manually. The Licensed tool will check this data whenever the dependency version is updated to make sure the license hasn't changed.
1 parent e0d983a commit 37cd9ef

File tree

254 files changed

+34343
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

254 files changed

+34343
-0
lines changed

‎.github/workflows/check-go-dependencies-task.yml

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v2#readme
6+
GO_VERSION: "1.16"
7+
8+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
9+
on:
10+
push:
11+
paths:
12+
- ".github/workflows/check-go-dependencies-task.ya?ml"
13+
- ".licenses/**"
14+
- ".licensed.json"
15+
- ".licensed.ya?ml"
16+
- "Taskfile.ya?ml"
17+
- "**/.gitmodules"
18+
- "**/go.mod"
19+
- "**/go.sum"
20+
pull_request:
21+
paths:
22+
- ".github/workflows/check-go-dependencies-task.ya?ml"
23+
- ".licenses/**"
24+
- ".licensed.json"
25+
- ".licensed.ya?ml"
26+
- "Taskfile.ya?ml"
27+
- "**/.gitmodules"
28+
- "**/go.mod"
29+
- "**/go.sum"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
check-cache:
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
with:
41+
submodules: recursive
42+
43+
- name: Install licensed
44+
uses: jonabc/setup-licensed@v1
45+
with:
46+
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 3.x
48+
49+
- name: Install Go
50+
uses: actions/setup-go@v2
51+
with:
52+
go-version: ${{ env.GO_VERSION }}
53+
54+
- name: Install Task
55+
uses: arduino/setup-task@v1
56+
with:
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
version: 3.x
59+
60+
- name: Update dependencies license metadata cache
61+
run: task --silent general:cache-dep-licenses
62+
63+
- name: Check for outdated cache
64+
id: diff
65+
run: |
66+
git add --intent-to-add .
67+
if ! git diff --color --exit-code; then
68+
echo
69+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
70+
exit 1
71+
fi
72+
73+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
74+
- name: Upload cache to workflow artifact
75+
if: failure() && steps.diff.outcome == 'failure'
76+
uses: actions/upload-artifact@v2
77+
with:
78+
if-no-files-found: error
79+
name: dep-licenses-cache
80+
path: .licenses/
81+
82+
check-deps:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v2
88+
with:
89+
submodules: recursive
90+
91+
- name: Install licensed
92+
uses: jonabc/setup-licensed@v1
93+
with:
94+
github_token: ${{ secrets.GITHUB_TOKEN }}
95+
version: 3.x
96+
97+
- name: Install Go
98+
uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Install Task
103+
uses: arduino/setup-task@v1
104+
with:
105+
repo-token: ${{ secrets.GITHUB_TOKEN }}
106+
version: 3.x
107+
108+
- name: Check for dependencies with unapproved licenses
109+
run: task --silent general:check-dep-licenses

‎.licensed.yml

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
shared_cache: true
6+
cache_path: .licenses/
7+
8+
apps:
9+
- source_path: ./
10+
- source_path: arduino/discovery/discovery_client/
11+
- source_path: client_example/
12+
- source_path: commands/daemon/term_example/
13+
- source_path: docsgen/
14+
15+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-3.0/.licensed.yml
16+
allowed:
17+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
18+
- gpl-1.0-or-later
19+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
20+
- gpl-2.0-or-later
21+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
22+
- gpl-3.0-only
23+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
24+
- gpl-3.0-or-later
25+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
26+
- lgpl-2.0-or-later
27+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
28+
- lgpl-2.1-only
29+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
30+
- lgpl-2.1-or-later
31+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
32+
- lgpl-3.0-only
33+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
34+
- lgpl-3.0-or-later
35+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
36+
- fsfap
37+
- apache-2.0
38+
- artistic-2.0
39+
- clartistic
40+
- sleepycat
41+
- bsl-1.0
42+
- bsd-3-clause
43+
- cecill-2.0
44+
- bsd-3-clause-clear
45+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
46+
- ecos-2.0
47+
- ecl-2.0
48+
- efl-2.0
49+
- eudatagrid
50+
- mit
51+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
52+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
53+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
54+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
55+
- ftl
56+
- hpnd
57+
- imatix
58+
- imlib2
59+
- ijg
60+
# "Informal license" - this is a general class of license
61+
- intel
62+
- isc
63+
- mpl-2.0
64+
- ncsa
65+
# "License of Netscape JavaScript" - no SPDX ID
66+
- oldap-2.7
67+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
68+
- cc0-1.0
69+
- cc-pddc
70+
- psf-2.0
71+
- ruby
72+
- sgi-b-2.0
73+
- smlnj
74+
- standardml-nj # Deprecated ID for `smlnj`
75+
- unicode-dfs-2015
76+
- upl-1.0
77+
- unlicense
78+
- vim
79+
- w3c
80+
- wtfpl
81+
- lgpl-2.0-or-later with wxwindows-exception-3.1
82+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
83+
- x11
84+
- xfree86-1.1
85+
- zlib
86+
- zpl-2.0
87+
- zpl-2.1
88+
# The following are based on individual license text
89+
- eupl-1.2
90+
- liliq-r-1.1
91+
- liliq-rplus-1.1

0 commit comments

Comments
 (0)