Skip to content

Commit 3150919

Browse files
per1234per1234
authored
Merge pull request #135 from per1234/check-dependencies
Add CI workflow to check for unapproved Go dependency licenses
2 parents af4668b + 8479017 commit 3150919

File tree

169 files changed

+33138
-1
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

169 files changed

+33138
-1
lines changed

Diff for: ‎.github/workflows/check-go-dependencies-task.yml

+140
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/main#supported-version-syntax
6+
GO_VERSION: "1.18.3"
7+
8+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
9+
on:
10+
create:
11+
push:
12+
paths:
13+
- ".github/workflows/check-go-dependencies-task.ya?ml"
14+
- ".licenses/**"
15+
- ".licensed.json"
16+
- ".licensed.ya?ml"
17+
- "Taskfile.ya?ml"
18+
- "**/.gitmodules"
19+
- "**/go.mod"
20+
- "**/go.sum"
21+
pull_request:
22+
paths:
23+
- ".github/workflows/check-go-dependencies-task.ya?ml"
24+
- ".licenses/**"
25+
- ".licensed.json"
26+
- ".licensed.ya?ml"
27+
- "Taskfile.ya?ml"
28+
- "**/.gitmodules"
29+
- "**/go.mod"
30+
- "**/go.sum"
31+
schedule:
32+
# Run periodically to catch breakage caused by external changes.
33+
- cron: "0 8 * * WED"
34+
workflow_dispatch:
35+
repository_dispatch:
36+
37+
jobs:
38+
run-determination:
39+
runs-on: ubuntu-latest
40+
outputs:
41+
result: ${{ steps.determination.outputs.result }}
42+
steps:
43+
- name: Determine if the rest of the workflow should run
44+
id: determination
45+
run: |
46+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
47+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
48+
if [[
49+
"${{ github.event_name }}" != "create" ||
50+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
51+
]]; then
52+
# Run the other jobs.
53+
RESULT="true"
54+
else
55+
# There is no need to run the other jobs.
56+
RESULT="false"
57+
fi
58+
59+
echo "::set-output name=result::$RESULT"
60+
61+
check-cache:
62+
needs: run-determination
63+
if: needs.run-determination.outputs.result == 'true'
64+
runs-on: ubuntu-latest
65+
66+
steps:
67+
- name: Checkout repository
68+
uses: actions/checkout@v3
69+
with:
70+
submodules: recursive
71+
72+
- name: Install licensed
73+
uses: jonabc/setup-licensed@v1
74+
with:
75+
github_token: ${{ secrets.GITHUB_TOKEN }}
76+
version: 3.x
77+
78+
- name: Install Go
79+
uses: actions/setup-go@v3
80+
with:
81+
go-version: ${{ env.GO_VERSION }}
82+
83+
- name: Install Task
84+
uses: arduino/setup-task@v1
85+
with:
86+
repo-token: ${{ secrets.GITHUB_TOKEN }}
87+
version: 3.x
88+
89+
- name: Update dependencies license metadata cache
90+
run: task --silent general:cache-dep-licenses
91+
92+
- name: Check for outdated cache
93+
id: diff
94+
run: |
95+
git add .
96+
if ! git diff --cached --color --exit-code; then
97+
echo
98+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
99+
exit 1
100+
fi
101+
102+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
103+
- name: Upload cache to workflow artifact
104+
if: failure() && steps.diff.outcome == 'failure'
105+
uses: actions/upload-artifact@v3
106+
with:
107+
if-no-files-found: error
108+
name: dep-licenses-cache
109+
path: .licenses/
110+
111+
check-deps:
112+
needs: run-determination
113+
if: needs.run-determination.outputs.result == 'true'
114+
runs-on: ubuntu-latest
115+
116+
steps:
117+
- name: Checkout repository
118+
uses: actions/checkout@v3
119+
with:
120+
submodules: recursive
121+
122+
- name: Install licensed
123+
uses: jonabc/setup-licensed@v1
124+
with:
125+
github_token: ${{ secrets.GITHUB_TOKEN }}
126+
version: 3.x
127+
128+
- name: Install Go
129+
uses: actions/setup-go@v3
130+
with:
131+
go-version: ${{ env.GO_VERSION }}
132+
133+
- name: Install Task
134+
uses: arduino/setup-task@v1
135+
with:
136+
repo-token: ${{ secrets.GITHUB_TOKEN }}
137+
version: 3.x
138+
139+
- name: Check for dependencies with unapproved licenses
140+
run: task --silent general:check-dep-licenses

Diff for: ‎.gitignore

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
.old
22
build.sh
3-
arduino-language-server*
3+
/arduino-language-server*
4+
!/arduino-language-server*/
45
/node_modules/

Diff for: ‎.licensed.yml

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
apps:
6+
- source_path: ./
7+
8+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/Apache-2.0/.licensed.yml
9+
allowed:
10+
# Based on https://www.apache.org/legal/resolved.html#category-a
11+
- apache-2.0
12+
- apache-1.1
13+
- php-3.01
14+
# "MX4J License" - no SPDX ID
15+
- bsd-2-clause
16+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
17+
- bsd-2-clause-views
18+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
19+
- bsd-3-clause
20+
- bsd-3-clause-clear
21+
# "DOM4J License" - no SPDX ID
22+
- postgresql
23+
# "Eclipse Distribution License 1.0" - no SPDX ID
24+
- mit
25+
- x11
26+
- isc
27+
- smlnj
28+
- standardml-nj # Deprecated ID for `smlnj`
29+
# "Cup Parser Generator" - no SPDX ID
30+
- icu
31+
- ncsa
32+
- w3c
33+
# "W3C Community Contributor License Agreement" - no SPDX ID
34+
- xnet
35+
- zlib
36+
# "FSF autoconf license" - no SPDX ID
37+
- afl-3.0
38+
# "Service+Component+Architecture+Specifications" - no SPDX ID
39+
# "OOXML XSD ECMA License"
40+
- ms-pl
41+
- cc-pddc
42+
- psf-2.0
43+
# "Python Imaging Library Software License"
44+
- apafml
45+
- bsl-1.0
46+
- ogl-uk-3.0
47+
- wtfpl
48+
- unicode-tou
49+
- zpl-2.0
50+
# "ACE license" - no SPDX ID
51+
- upl-1.0
52+
# "Open Grid Forum License" - no SPDX ID
53+
# 'Google "Additional IP Rights Grant (Patents)" file' - no SPDX ID
54+
- unlicense
55+
- hpnd
56+
- mulanpsl-2.0
57+
- cc0-1.0
58+
# Based on individual license text
59+
- lgpl-2.0-or-later
60+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
61+
- lgpl-2.1-only
62+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
63+
- lgpl-2.1-or-later
64+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
65+
- lgpl-3.0-only
66+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
67+
- lgpl-3.0-or-later
68+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`

0 commit comments

Comments
 (0)