Skip to content

Commit 435d59b

Browse files
per1234per1234
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent af4668b commit 435d59b

File tree

4 files changed

+211
-1
lines changed

4 files changed

+211
-1
lines changed

Diff for: ‎.github/workflows/check-go-dependencies-task.yml

+140
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/main#supported-version-syntax
6+
GO_VERSION: "1.18.3"
7+
8+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
9+
on:
10+
create:
11+
push:
12+
paths:
13+
- ".github/workflows/check-go-dependencies-task.ya?ml"
14+
- ".licenses/**"
15+
- ".licensed.json"
16+
- ".licensed.ya?ml"
17+
- "Taskfile.ya?ml"
18+
- "**/.gitmodules"
19+
- "**/go.mod"
20+
- "**/go.sum"
21+
pull_request:
22+
paths:
23+
- ".github/workflows/check-go-dependencies-task.ya?ml"
24+
- ".licenses/**"
25+
- ".licensed.json"
26+
- ".licensed.ya?ml"
27+
- "Taskfile.ya?ml"
28+
- "**/.gitmodules"
29+
- "**/go.mod"
30+
- "**/go.sum"
31+
schedule:
32+
# Run periodically to catch breakage caused by external changes.
33+
- cron: "0 8 * * WED"
34+
workflow_dispatch:
35+
repository_dispatch:
36+
37+
jobs:
38+
run-determination:
39+
runs-on: ubuntu-latest
40+
outputs:
41+
result: ${{ steps.determination.outputs.result }}
42+
steps:
43+
- name: Determine if the rest of the workflow should run
44+
id: determination
45+
run: |
46+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
47+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
48+
if [[
49+
"${{ github.event_name }}" != "create" ||
50+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
51+
]]; then
52+
# Run the other jobs.
53+
RESULT="true"
54+
else
55+
# There is no need to run the other jobs.
56+
RESULT="false"
57+
fi
58+
59+
echo "::set-output name=result::$RESULT"
60+
61+
check-cache:
62+
needs: run-determination
63+
if: needs.run-determination.outputs.result == 'true'
64+
runs-on: ubuntu-latest
65+
66+
steps:
67+
- name: Checkout repository
68+
uses: actions/checkout@v3
69+
with:
70+
submodules: recursive
71+
72+
- name: Install licensed
73+
uses: jonabc/setup-licensed@v1
74+
with:
75+
github_token: ${{ secrets.GITHUB_TOKEN }}
76+
version: 3.x
77+
78+
- name: Install Go
79+
uses: actions/setup-go@v3
80+
with:
81+
go-version: ${{ env.GO_VERSION }}
82+
83+
- name: Install Task
84+
uses: arduino/setup-task@v1
85+
with:
86+
repo-token: ${{ secrets.GITHUB_TOKEN }}
87+
version: 3.x
88+
89+
- name: Update dependencies license metadata cache
90+
run: task --silent general:cache-dep-licenses
91+
92+
- name: Check for outdated cache
93+
id: diff
94+
run: |
95+
git add .
96+
if ! git diff --cached --color --exit-code; then
97+
echo
98+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
99+
exit 1
100+
fi
101+
102+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
103+
- name: Upload cache to workflow artifact
104+
if: failure() && steps.diff.outcome == 'failure'
105+
uses: actions/upload-artifact@v3
106+
with:
107+
if-no-files-found: error
108+
name: dep-licenses-cache
109+
path: .licenses/
110+
111+
check-deps:
112+
needs: run-determination
113+
if: needs.run-determination.outputs.result == 'true'
114+
runs-on: ubuntu-latest
115+
116+
steps:
117+
- name: Checkout repository
118+
uses: actions/checkout@v3
119+
with:
120+
submodules: recursive
121+
122+
- name: Install licensed
123+
uses: jonabc/setup-licensed@v1
124+
with:
125+
github_token: ${{ secrets.GITHUB_TOKEN }}
126+
version: 3.x
127+
128+
- name: Install Go
129+
uses: actions/setup-go@v3
130+
with:
131+
go-version: ${{ env.GO_VERSION }}
132+
133+
- name: Install Task
134+
uses: arduino/setup-task@v1
135+
with:
136+
repo-token: ${{ secrets.GITHUB_TOKEN }}
137+
version: 3.x
138+
139+
- name: Check for dependencies with unapproved licenses
140+
run: task --silent general:check-dep-licenses

Diff for: ‎.gitignore

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
.old
22
build.sh
3-
arduino-language-server*
3+
/arduino-language-server*
4+
!/arduino-language-server*/
45
/node_modules/

Diff for: ‎.licensed.yml

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
apps:
6+
- source_path: ./
7+
8+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/Apache-2.0/.licensed.yml
9+
allowed:
10+
# Based on https://www.apache.org/legal/resolved.html#category-a
11+
- apache-2.0
12+
- apache-1.1
13+
- php-3.01
14+
# "MX4J License" - no SPDX ID
15+
- bsd-2-clause
16+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
17+
- bsd-2-clause-views
18+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
19+
- bsd-3-clause
20+
- bsd-3-clause-clear
21+
# "DOM4J License" - no SPDX ID
22+
- postgresql
23+
# "Eclipse Distribution License 1.0" - no SPDX ID
24+
- mit
25+
- x11
26+
- isc
27+
- smlnj
28+
- standardml-nj # Deprecated ID for `smlnj`
29+
# "Cup Parser Generator" - no SPDX ID
30+
- icu
31+
- ncsa
32+
- w3c
33+
# "W3C Community Contributor License Agreement" - no SPDX ID
34+
- xnet
35+
- zlib
36+
# "FSF autoconf license" - no SPDX ID
37+
- afl-3.0
38+
# "Service+Component+Architecture+Specifications" - no SPDX ID
39+
# "OOXML XSD ECMA License"
40+
- ms-pl
41+
- cc-pddc
42+
- psf-2.0
43+
# "Python Imaging Library Software License"
44+
- apafml
45+
- bsl-1.0
46+
- ogl-uk-3.0
47+
- wtfpl
48+
- unicode-tou
49+
- zpl-2.0
50+
# "ACE license" - no SPDX ID
51+
- upl-1.0
52+
# "Open Grid Forum License" - no SPDX ID
53+
# 'Google "Additional IP Rights Grant (Patents)" file' - no SPDX ID
54+
- unlicense
55+
- hpnd
56+
- mulanpsl-2.0
57+
- cc0-1.0
58+
# Based on individual license text
59+
- lgpl-2.0-or-later
60+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
61+
- lgpl-2.1-only
62+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
63+
- lgpl-2.1-or-later
64+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
65+
- lgpl-3.0-only
66+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
67+
- lgpl-3.0-or-later
68+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`

Diff for: ‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
[![Check Go status](https://github.com/arduino/arduino-language-server/actions/workflows/check-go-task.yml/badge.svg)](https://github.com/arduino/arduino-language-server/actions/workflows/check-go-task.yml)
77
[![Check Markdown status](https://github.com/arduino/arduino-language-server/actions/workflows/check-markdown-task.yml/badge.svg)](https://github.com/arduino/arduino-language-server/actions/workflows/check-markdown-task.yml)
88
[![Check License status](https://github.com/arduino/arduino-language-server/actions/workflows/check-license.yml/badge.svg)](https://github.com/arduino/arduino-language-server/actions/workflows/check-license.yml)
9+
[![Check Go Dependencies status](https://github.com/arduino/arduino-language-server/actions/workflows/check-go-dependencies-task.yml/badge.svg)](https://github.com/arduino/arduino-language-server/actions/workflows/check-go-dependencies-task.yml)
910

1011
The **Arduino Language Server** is the tool that powers the autocompletion of the new [Arduino IDE 2][arduino-ide-repo]. It implements the standard [Language Server Protocol](https://microsoft.github.io/language-server-protocol/) so it can be used with other IDEs as well.
1112

0 commit comments

Comments
 (0)