Skip to content

Commit d716344

Browse files
MatteoPologrutoMatteoPologruto
authored
Merge pull request #6 from arduino/check-go-dependencies
Add CI workflow to check for unapproved Go dependency licenses
2 parents f189a03 + 16fb810 commit d716344

File tree

10 files changed

+1015
-0
lines changed

10 files changed

+1015
-0
lines changed

‎.github/workflows/check-go-dependencies-task.yml

+157
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/main#supported-version-syntax
6+
GO_VERSION: "1.20"
7+
8+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
9+
on:
10+
create:
11+
push:
12+
paths:
13+
- ".github/workflows/check-go-dependencies-task.ya?ml"
14+
- ".licenses/**"
15+
- ".licensed.json"
16+
- ".licensed.ya?ml"
17+
- "Taskfile.ya?ml"
18+
- "**/.gitmodules"
19+
- "**/go.mod"
20+
- "**/go.sum"
21+
pull_request:
22+
paths:
23+
- ".github/workflows/check-go-dependencies-task.ya?ml"
24+
- ".licenses/**"
25+
- ".licensed.json"
26+
- ".licensed.ya?ml"
27+
- "Taskfile.ya?ml"
28+
- "**/.gitmodules"
29+
- "**/go.mod"
30+
- "**/go.sum"
31+
schedule:
32+
# Run periodically to catch breakage caused by external changes.
33+
- cron: "0 8 * * WED"
34+
workflow_dispatch:
35+
repository_dispatch:
36+
37+
jobs:
38+
run-determination:
39+
runs-on: ubuntu-latest
40+
permissions: {}
41+
outputs:
42+
result: ${{ steps.determination.outputs.result }}
43+
steps:
44+
- name: Determine if the rest of the workflow should run
45+
id: determination
46+
run: |
47+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
48+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
49+
if [[
50+
"${{ github.event_name }}" != "create" ||
51+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
52+
]]; then
53+
# Run the other jobs.
54+
RESULT="true"
55+
else
56+
# There is no need to run the other jobs.
57+
RESULT="false"
58+
fi
59+
60+
echo "result=$RESULT" >> $GITHUB_OUTPUT
61+
62+
check-cache:
63+
needs: run-determination
64+
if: needs.run-determination.outputs.result == 'true'
65+
runs-on: ubuntu-latest
66+
permissions:
67+
contents: read
68+
69+
steps:
70+
- name: Checkout repository
71+
uses: actions/checkout@v3
72+
with:
73+
submodules: recursive
74+
75+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
76+
- name: Install Ruby
77+
uses: ruby/setup-ruby@v1
78+
with:
79+
ruby-version: ruby # Install latest version
80+
81+
- name: Install licensed
82+
uses: jonabc/setup-licensed@v1
83+
with:
84+
github_token: ${{ secrets.GITHUB_TOKEN }}
85+
version: 3.x
86+
87+
- name: Install Go
88+
uses: actions/setup-go@v4
89+
with:
90+
go-version: ${{ env.GO_VERSION }}
91+
92+
- name: Install Task
93+
uses: arduino/setup-task@v1
94+
with:
95+
repo-token: ${{ secrets.GITHUB_TOKEN }}
96+
version: 3.x
97+
98+
- name: Update dependencies license metadata cache
99+
run: task --silent general:cache-dep-licenses
100+
101+
- name: Check for outdated cache
102+
id: diff
103+
run: |
104+
git add .
105+
if ! git diff --cached --color --exit-code; then
106+
echo
107+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
108+
exit 1
109+
fi
110+
111+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
112+
- name: Upload cache to workflow artifact
113+
if: failure() && steps.diff.outcome == 'failure'
114+
uses: actions/upload-artifact@v3
115+
with:
116+
if-no-files-found: error
117+
name: dep-licenses-cache
118+
path: .licenses/
119+
120+
check-deps:
121+
needs: run-determination
122+
if: needs.run-determination.outputs.result == 'true'
123+
runs-on: ubuntu-latest
124+
permissions:
125+
contents: read
126+
127+
steps:
128+
- name: Checkout repository
129+
uses: actions/checkout@v3
130+
with:
131+
submodules: recursive
132+
133+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
134+
- name: Install Ruby
135+
uses: ruby/setup-ruby@v1
136+
with:
137+
ruby-version: ruby # Install latest version
138+
139+
- name: Install licensed
140+
uses: jonabc/setup-licensed@v1
141+
with:
142+
github_token: ${{ secrets.GITHUB_TOKEN }}
143+
version: 3.x
144+
145+
- name: Install Go
146+
uses: actions/setup-go@v4
147+
with:
148+
go-version: ${{ env.GO_VERSION }}
149+
150+
- name: Install Task
151+
uses: arduino/setup-task@v1
152+
with:
153+
repo-token: ${{ secrets.GITHUB_TOKEN }}
154+
version: 3.x
155+
156+
- name: Check for dependencies with unapproved licenses
157+
run: task --silent general:check-dep-licenses

‎.licensed.yml

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
reviewed:
6+
go:
7+
- github.com/arduino/go-paths-helper
8+
9+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/AGPL-3.0/.licensed.yml
10+
allowed:
11+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
12+
- gpl-1.0-or-later
13+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
14+
- gpl-2.0-or-later
15+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
16+
- gpl-3.0-only
17+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
18+
- gpl-3.0-or-later
19+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
20+
- lgpl-2.0-or-later
21+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
22+
- lgpl-2.1-only
23+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
24+
- lgpl-2.1-or-later
25+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
26+
- lgpl-3.0-only
27+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
28+
- lgpl-3.0-or-later
29+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
30+
- agpl-1.0-or-later
31+
- agpl-3.0-only
32+
- agpl-3.0 # Deprecated ID for `agpl-3.0-only`
33+
- agpl-3.0-or-later
34+
- fsfap
35+
- apache-2.0
36+
- artistic-2.0
37+
- clartistic
38+
- sleepycat
39+
- bsl-1.0
40+
- bsd-3-clause
41+
- cecill-2.0
42+
- bsd-3-clause-clear
43+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
44+
- ecos-2.0
45+
- ecl-2.0
46+
- efl-2.0
47+
- eudatagrid
48+
- mit
49+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
50+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
51+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
52+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
53+
- ftl
54+
- hpnd
55+
- imatix
56+
- imlib2
57+
- ijg
58+
# "Informal license" - this is a general class of license
59+
- intel
60+
- isc
61+
- mpl-2.0
62+
- ncsa
63+
# "License of Netscape JavaScript" - no SPDX ID
64+
- oldap-2.7
65+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
66+
- cc0-1.0
67+
- cc-pddc
68+
- psf-2.0
69+
- ruby
70+
- sgi-b-2.0
71+
- smlnj
72+
- standardml-nj # Deprecated ID for `smlnj`
73+
- unicode-dfs-2015
74+
- upl-1.0
75+
- unlicense
76+
- vim
77+
- w3c
78+
- wtfpl
79+
- lgpl-2.0-or-later with wxwindows-exception-3.1
80+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
81+
- x11
82+
- xfree86-1.1
83+
- zlib
84+
- zpl-2.0
85+
- zpl-2.1
86+
# The following are based on individual license text
87+
- eupl-1.2

0 commit comments

Comments
 (0)