Skip to content

Commit 6cb728c

Browse files
MatteoPologrutoMatteoPologruto
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent f189a03 commit 6cb728c

File tree

10 files changed

+1011
-0
lines changed

10 files changed

+1011
-0
lines changed

‎.github/workflows/check-go-dependencies-task.yml

+157
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/main#supported-version-syntax
6+
GO_VERSION: "1.20"
7+
8+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
9+
on:
10+
create:
11+
push:
12+
paths:
13+
- ".github/workflows/check-go-dependencies-task.ya?ml"
14+
- ".licenses/**"
15+
- ".licensed.json"
16+
- ".licensed.ya?ml"
17+
- "Taskfile.ya?ml"
18+
- "**/.gitmodules"
19+
- "**/go.mod"
20+
- "**/go.sum"
21+
pull_request:
22+
paths:
23+
- ".github/workflows/check-go-dependencies-task.ya?ml"
24+
- ".licenses/**"
25+
- ".licensed.json"
26+
- ".licensed.ya?ml"
27+
- "Taskfile.ya?ml"
28+
- "**/.gitmodules"
29+
- "**/go.mod"
30+
- "**/go.sum"
31+
schedule:
32+
# Run periodically to catch breakage caused by external changes.
33+
- cron: "0 8 * * WED"
34+
workflow_dispatch:
35+
repository_dispatch:
36+
37+
jobs:
38+
run-determination:
39+
runs-on: ubuntu-latest
40+
permissions: {}
41+
outputs:
42+
result: ${{ steps.determination.outputs.result }}
43+
steps:
44+
- name: Determine if the rest of the workflow should run
45+
id: determination
46+
run: |
47+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
48+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
49+
if [[
50+
"${{ github.event_name }}" != "create" ||
51+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
52+
]]; then
53+
# Run the other jobs.
54+
RESULT="true"
55+
else
56+
# There is no need to run the other jobs.
57+
RESULT="false"
58+
fi
59+
60+
echo "result=$RESULT" >> $GITHUB_OUTPUT
61+
62+
check-cache:
63+
needs: run-determination
64+
if: needs.run-determination.outputs.result == 'true'
65+
runs-on: ubuntu-latest
66+
permissions:
67+
contents: read
68+
69+
steps:
70+
- name: Checkout repository
71+
uses: actions/checkout@v3
72+
with:
73+
submodules: recursive
74+
75+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
76+
- name: Install Ruby
77+
uses: ruby/setup-ruby@v1
78+
with:
79+
ruby-version: ruby # Install latest version
80+
81+
- name: Install licensed
82+
uses: jonabc/setup-licensed@v1
83+
with:
84+
github_token: ${{ secrets.GITHUB_TOKEN }}
85+
version: 3.x
86+
87+
- name: Install Go
88+
uses: actions/setup-go@v4
89+
with:
90+
go-version: ${{ env.GO_VERSION }}
91+
92+
- name: Install Task
93+
uses: arduino/setup-task@v1
94+
with:
95+
repo-token: ${{ secrets.GITHUB_TOKEN }}
96+
version: 3.x
97+
98+
- name: Update dependencies license metadata cache
99+
run: task --silent general:cache-dep-licenses
100+
101+
- name: Check for outdated cache
102+
id: diff
103+
run: |
104+
git add .
105+
if ! git diff --cached --color --exit-code; then
106+
echo
107+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
108+
exit 1
109+
fi
110+
111+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
112+
- name: Upload cache to workflow artifact
113+
if: failure() && steps.diff.outcome == 'failure'
114+
uses: actions/upload-artifact@v3
115+
with:
116+
if-no-files-found: error
117+
name: dep-licenses-cache
118+
path: .licenses/
119+
120+
check-deps:
121+
needs: run-determination
122+
if: needs.run-determination.outputs.result == 'true'
123+
runs-on: ubuntu-latest
124+
permissions:
125+
contents: read
126+
127+
steps:
128+
- name: Checkout repository
129+
uses: actions/checkout@v3
130+
with:
131+
submodules: recursive
132+
133+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
134+
- name: Install Ruby
135+
uses: ruby/setup-ruby@v1
136+
with:
137+
ruby-version: ruby # Install latest version
138+
139+
- name: Install licensed
140+
uses: jonabc/setup-licensed@v1
141+
with:
142+
github_token: ${{ secrets.GITHUB_TOKEN }}
143+
version: 3.x
144+
145+
- name: Install Go
146+
uses: actions/setup-go@v4
147+
with:
148+
go-version: ${{ env.GO_VERSION }}
149+
150+
- name: Install Task
151+
uses: arduino/setup-task@v1
152+
with:
153+
repo-token: ${{ secrets.GITHUB_TOKEN }}
154+
version: 3.x
155+
156+
- name: Check for dependencies with unapproved licenses
157+
run: task --silent general:check-dep-licenses

‎.licensed.yml

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/AGPL-3.0/.licensed.yml
6+
allowed:
7+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
8+
- gpl-1.0-or-later
9+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
10+
- gpl-2.0-or-later
11+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
12+
- gpl-3.0-only
13+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
14+
- gpl-3.0-or-later
15+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
16+
- lgpl-2.0-or-later
17+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
18+
- lgpl-2.1-only
19+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
20+
- lgpl-2.1-or-later
21+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
22+
- lgpl-3.0-only
23+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
24+
- lgpl-3.0-or-later
25+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
26+
- agpl-1.0-or-later
27+
- agpl-3.0-only
28+
- agpl-3.0 # Deprecated ID for `agpl-3.0-only`
29+
- agpl-3.0-or-later
30+
- fsfap
31+
- apache-2.0
32+
- artistic-2.0
33+
- clartistic
34+
- sleepycat
35+
- bsl-1.0
36+
- bsd-3-clause
37+
- cecill-2.0
38+
- bsd-3-clause-clear
39+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
40+
- ecos-2.0
41+
- ecl-2.0
42+
- efl-2.0
43+
- eudatagrid
44+
- mit
45+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
46+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
47+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
48+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
49+
- ftl
50+
- hpnd
51+
- imatix
52+
- imlib2
53+
- ijg
54+
# "Informal license" - this is a general class of license
55+
- intel
56+
- isc
57+
- mpl-2.0
58+
- ncsa
59+
# "License of Netscape JavaScript" - no SPDX ID
60+
- oldap-2.7
61+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
62+
- cc0-1.0
63+
- cc-pddc
64+
- psf-2.0
65+
- ruby
66+
- sgi-b-2.0
67+
- smlnj
68+
- standardml-nj # Deprecated ID for `smlnj`
69+
- unicode-dfs-2015
70+
- upl-1.0
71+
- unlicense
72+
- vim
73+
- w3c
74+
- wtfpl
75+
- lgpl-2.0-or-later with wxwindows-exception-3.1
76+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
77+
- x11
78+
- xfree86-1.1
79+
- zlib
80+
- zpl-2.0
81+
- zpl-2.1
82+
# The following are based on individual license text
83+
- eupl-1.2

0 commit comments

Comments
 (0)