Skip to content

Commit bcc6d50

Browse files
MatteoPologrutoMatteoPologruto
authored
Merge pull request #12 from MatteoPologruto/add-check-go-dependencies
Add CI workflow to check for unapproved Go dependency licenses
2 parents 992502c + fa852ac commit bcc6d50

File tree

4 files changed

+197
-0
lines changed

4 files changed

+197
-0
lines changed

Diff for: ‎.github/workflows/check-go-dependencies-task.yml

+152
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/main#supported-version-syntax
6+
GO_VERSION: "1.19"
7+
8+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
9+
on:
10+
create:
11+
push:
12+
paths:
13+
- ".github/workflows/check-go-dependencies-task.ya?ml"
14+
- ".licenses/**"
15+
- ".licensed.json"
16+
- ".licensed.ya?ml"
17+
- "Taskfile.ya?ml"
18+
- "**/.gitmodules"
19+
- "**/go.mod"
20+
- "**/go.sum"
21+
pull_request:
22+
paths:
23+
- ".github/workflows/check-go-dependencies-task.ya?ml"
24+
- ".licenses/**"
25+
- ".licensed.json"
26+
- ".licensed.ya?ml"
27+
- "Taskfile.ya?ml"
28+
- "**/.gitmodules"
29+
- "**/go.mod"
30+
- "**/go.sum"
31+
schedule:
32+
# Run periodically to catch breakage caused by external changes.
33+
- cron: "0 8 * * WED"
34+
workflow_dispatch:
35+
repository_dispatch:
36+
37+
jobs:
38+
run-determination:
39+
runs-on: ubuntu-latest
40+
outputs:
41+
result: ${{ steps.determination.outputs.result }}
42+
steps:
43+
- name: Determine if the rest of the workflow should run
44+
id: determination
45+
run: |
46+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
47+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
48+
if [[
49+
"${{ github.event_name }}" != "create" ||
50+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
51+
]]; then
52+
# Run the other jobs.
53+
RESULT="true"
54+
else
55+
# There is no need to run the other jobs.
56+
RESULT="false"
57+
fi
58+
59+
echo "result=$RESULT" >> $GITHUB_OUTPUT
60+
61+
check-cache:
62+
needs: run-determination
63+
if: needs.run-determination.outputs.result == 'true'
64+
runs-on: ubuntu-latest
65+
66+
steps:
67+
- name: Checkout repository
68+
uses: actions/checkout@v3
69+
with:
70+
submodules: recursive
71+
72+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
73+
- name: Install Ruby
74+
uses: ruby/setup-ruby@v1
75+
with:
76+
ruby-version: ruby # Install latest version
77+
78+
- name: Install licensed
79+
uses: jonabc/setup-licensed@v1
80+
with:
81+
github_token: ${{ secrets.GITHUB_TOKEN }}
82+
version: 3.x
83+
84+
- name: Install Go
85+
uses: actions/setup-go@v4
86+
with:
87+
go-version: ${{ env.GO_VERSION }}
88+
89+
- name: Install Task
90+
uses: arduino/setup-task@v1
91+
with:
92+
repo-token: ${{ secrets.GITHUB_TOKEN }}
93+
version: 3.x
94+
95+
- name: Update dependencies license metadata cache
96+
run: task --silent general:cache-dep-licenses
97+
98+
- name: Check for outdated cache
99+
id: diff
100+
run: |
101+
git add .
102+
if ! git diff --cached --color --exit-code; then
103+
echo
104+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
105+
exit 1
106+
fi
107+
108+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
109+
- name: Upload cache to workflow artifact
110+
if: failure() && steps.diff.outcome == 'failure'
111+
uses: actions/upload-artifact@v3
112+
with:
113+
if-no-files-found: error
114+
name: dep-licenses-cache
115+
path: .licenses/
116+
117+
check-deps:
118+
needs: run-determination
119+
if: needs.run-determination.outputs.result == 'true'
120+
runs-on: ubuntu-latest
121+
122+
steps:
123+
- name: Checkout repository
124+
uses: actions/checkout@v3
125+
with:
126+
submodules: recursive
127+
128+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
129+
- name: Install Ruby
130+
uses: ruby/setup-ruby@v1
131+
with:
132+
ruby-version: ruby # Install latest version
133+
134+
- name: Install licensed
135+
uses: jonabc/setup-licensed@v1
136+
with:
137+
github_token: ${{ secrets.GITHUB_TOKEN }}
138+
version: 3.x
139+
140+
- name: Install Go
141+
uses: actions/setup-go@v4
142+
with:
143+
go-version: ${{ env.GO_VERSION }}
144+
145+
- name: Install Task
146+
uses: arduino/setup-task@v1
147+
with:
148+
repo-token: ${{ secrets.GITHUB_TOKEN }}
149+
version: 3.x
150+
151+
- name: Check for dependencies with unapproved licenses
152+
run: task --silent general:check-dep-licenses

Diff for: ‎.licensed.yml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
# This list is incomplete. It must be updated when new dependencies are needed for the project
6+
allowed:
7+
- bsd-3-clause
8+
- bsd-3-clause-clear
9+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
10+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
11+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
12+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`

Diff for: ‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
[![Codecov](https://codecov.io/gh/arduino/go-win32-utils/branch/main/graph/badge.svg)](https://codecov.io/gh/arduino/go-win32-utils)
77
[![Check Go status](https://github.com/arduino/go-win32-utils/actions/workflows/check-go-task.yml/badge.svg)](https://github.com/arduino/go-win32-utils/actions/workflows/check-go-task.yml)
88
[![Check License status](https://github.com/arduino/go-win32-utils/actions/workflows/check-license.yml/badge.svg)](https://github.com/arduino/go-win32-utils/actions/workflows/check-license.yml)
9+
[![Check Go Dependencies status](https://github.com/arduino/go-win32-utils/actions/workflows/check-go-dependencies-task.yml/badge.svg)](https://github.com/arduino/go-win32-utils/actions/workflows/check-go-dependencies-task.yml)
910

1011
This library contains some useful calls to win32 API that are not available on the standard golang library.
1112

Diff for: ‎Taskfile.yml

+32
Original file line numberDiff line numberDiff line change
@@ -160,3 +160,35 @@ tasks:
160160
dir: "{{.DEFAULT_GO_MODULE_PATH}}"
161161
cmds:
162162
- go build -v {{.LDFLAGS}}
163+
164+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
165+
general:cache-dep-licenses:
166+
desc: Cache dependency license metadata
167+
deps:
168+
- task: general:prepare-deps
169+
cmds:
170+
- |
171+
if ! which licensed &>/dev/null; then
172+
if [[ {{OS}} == "windows" ]]; then
173+
echo "Licensed does not have Windows support."
174+
echo "Please use Linux/macOS or download the dependencies cache from the GitHub Actions workflow artifact."
175+
else
176+
echo "licensed not found or not in PATH."
177+
echo "Please install: https://github.com/github/licensed#as-an-executable"
178+
fi
179+
exit 1
180+
fi
181+
- licensed cache
182+
183+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
184+
general:check-dep-licenses:
185+
desc: Check for unapproved dependency licenses
186+
deps:
187+
- task: general:cache-dep-licenses
188+
cmds:
189+
- licensed status
190+
191+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-go-dependencies-task/Taskfile.yml
192+
general:prepare-deps:
193+
desc: Prepare project dependencies for license check
194+
# No preparation is needed for Go module-based projects.

0 commit comments

Comments
 (0)