Skip to content

Add CI workflow to check for unapproved Go dependency licenses #288

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 19, 2021
Merged

Add CI workflow to check for unapproved Go dependency licenses #288

merged 3 commits into from
Oct 19, 2021

Conversation

per1234
Copy link
Contributor

@per1234 per1234 commented Oct 13, 2021

A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies.

On every push and pull request that affects relevant files, the CI workflow will use Licensed to check:

  • If the dependency licenses cache is up to date
  • If any of the project's dependencies have an unapproved license type.

Approval can be based on:

A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies.

On every push and pull request that affects relevant files, the CI workflow will check:

- If the dependency licenses cache is up to date
- If any of the project's dependencies have an unapproved license type.

Approval can be based on:

- Universally allowed license type
- Individual dependency
The `.licenses` folder contains a cache of license metadata for all the project's Go dependencies. This serves two purposes:

- Allow the Licensed dependency license checker tool to only check licenses when a dependency is added or updated
- Allow the maintainer to manually define license metadata when the licensee tool is unable to automatically detect it
The "Licensed" dependency license checker tool uses the licensee tool to automatically determine the license type based
on metadata provided by the dependency author. This must be in a standardized format without any modifications. In cases
where that wasn't done, it is necessary to determine the license type and update the dependency license metadata cache in
the `.licenses` folder manually.

The Licensed tool will check this data whenever the dependency version is updated to make sure the license hasn't changed.
@per1234 per1234 added type: enhancement Proposed improvement topic: infrastructure Related to project infrastructure labels Oct 13, 2021
@codecov-commenter
Copy link

codecov-commenter commented Oct 13, 2021

Codecov Report

Merging #288 (1a036a6) into main (4e6c832) will increase coverage by 0.12%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##             main     #288      +/-   ##
==========================================
+ Coverage   89.67%   89.79%   +0.12%     
==========================================
  Files          44       44              
  Lines        6496     6626     +130     
==========================================
+ Hits         5825     5950     +125     
- Misses        549      553       +4     
- Partials      122      123       +1     
Flag Coverage Δ
unit 89.79% <ø> (+0.12%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
internal/rule/rulefunction/platform.go 96.52% <0.00%> (-0.14%) ⬇️
main.go 25.00% <0.00%> (ø)
internal/cli/cli.go 0.00% <0.00%> (ø)
ruledocsgen/main.go 83.95% <0.00%> (ø)
internal/rule/rule.go 59.52% <0.00%> (ø)
internal/result/result.go 91.44% <0.00%> (ø)
internal/util/test/test.go 100.00% <0.00%> (ø)
internal/command/command.go 0.00% <0.00%> (ø)
internal/project/project.go 94.42% <0.00%> (ø)
internal/rule/schema/schema.go 88.88% <0.00%> (ø)
... and 27 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0b40408...1a036a6. Read the comment docs.

@per1234 per1234 merged commit 1ffea34 into arduino:main Oct 19, 2021
@per1234 per1234 deleted the check-dependencies branch October 19, 2021 08:24
@per1234 per1234 self-assigned this Nov 20, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
topic: infrastructure Related to project infrastructure type: enhancement Proposed improvement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants