Skip to content

Commit fa852ac

Browse files
MatteoPologrutoMatteoPologruto
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent 992502c commit fa852ac

File tree

4 files changed

+197
-0
lines changed

4 files changed

+197
-0
lines changed

Diff for: ‎.github/workflows/check-go-dependencies-task.yml

+152
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/main#supported-version-syntax
6+
GO_VERSION: "1.19"
7+
8+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
9+
on:
10+
create:
11+
push:
12+
paths:
13+
- ".github/workflows/check-go-dependencies-task.ya?ml"
14+
- ".licenses/**"
15+
- ".licensed.json"
16+
- ".licensed.ya?ml"
17+
- "Taskfile.ya?ml"
18+
- "**/.gitmodules"
19+
- "**/go.mod"
20+
- "**/go.sum"
21+
pull_request:
22+
paths:
23+
- ".github/workflows/check-go-dependencies-task.ya?ml"
24+
- ".licenses/**"
25+
- ".licensed.json"
26+
- ".licensed.ya?ml"
27+
- "Taskfile.ya?ml"
28+
- "**/.gitmodules"
29+
- "**/go.mod"
30+
- "**/go.sum"
31+
schedule:
32+
# Run periodically to catch breakage caused by external changes.
33+
- cron: "0 8 * * WED"
34+
workflow_dispatch:
35+
repository_dispatch:
36+
37+
jobs:
38+
run-determination:
39+
runs-on: ubuntu-latest
40+
outputs:
41+
result: ${{ steps.determination.outputs.result }}
42+
steps:
43+
- name: Determine if the rest of the workflow should run
44+
id: determination
45+
run: |
46+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
47+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
48+
if [[
49+
"${{ github.event_name }}" != "create" ||
50+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
51+
]]; then
52+
# Run the other jobs.
53+
RESULT="true"
54+
else
55+
# There is no need to run the other jobs.
56+
RESULT="false"
57+
fi
58+
59+
echo "result=$RESULT" >> $GITHUB_OUTPUT
60+
61+
check-cache:
62+
needs: run-determination
63+
if: needs.run-determination.outputs.result == 'true'
64+
runs-on: ubuntu-latest
65+
66+
steps:
67+
- name: Checkout repository
68+
uses: actions/checkout@v3
69+
with:
70+
submodules: recursive
71+
72+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
73+
- name: Install Ruby
74+
uses: ruby/setup-ruby@v1
75+
with:
76+
ruby-version: ruby # Install latest version
77+
78+
- name: Install licensed
79+
uses: jonabc/setup-licensed@v1
80+
with:
81+
github_token: ${{ secrets.GITHUB_TOKEN }}
82+
version: 3.x
83+
84+
- name: Install Go
85+
uses: actions/setup-go@v4
86+
with:
87+
go-version: ${{ env.GO_VERSION }}
88+
89+
- name: Install Task
90+
uses: arduino/setup-task@v1
91+
with:
92+
repo-token: ${{ secrets.GITHUB_TOKEN }}
93+
version: 3.x
94+
95+
- name: Update dependencies license metadata cache
96+
run: task --silent general:cache-dep-licenses
97+
98+
- name: Check for outdated cache
99+
id: diff
100+
run: |
101+
git add .
102+
if ! git diff --cached --color --exit-code; then
103+
echo
104+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
105+
exit 1
106+
fi
107+
108+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
109+
- name: Upload cache to workflow artifact
110+
if: failure() && steps.diff.outcome == 'failure'
111+
uses: actions/upload-artifact@v3
112+
with:
113+
if-no-files-found: error
114+
name: dep-licenses-cache
115+
path: .licenses/
116+
117+
check-deps:
118+
needs: run-determination
119+
if: needs.run-determination.outputs.result == 'true'
120+
runs-on: ubuntu-latest
121+
122+
steps:
123+
- name: Checkout repository
124+
uses: actions/checkout@v3
125+
with:
126+
submodules: recursive
127+
128+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
129+
- name: Install Ruby
130+
uses: ruby/setup-ruby@v1
131+
with:
132+
ruby-version: ruby # Install latest version
133+
134+
- name: Install licensed
135+
uses: jonabc/setup-licensed@v1
136+
with:
137+
github_token: ${{ secrets.GITHUB_TOKEN }}
138+
version: 3.x
139+
140+
- name: Install Go
141+
uses: actions/setup-go@v4
142+
with:
143+
go-version: ${{ env.GO_VERSION }}
144+
145+
- name: Install Task
146+
uses: arduino/setup-task@v1
147+
with:
148+
repo-token: ${{ secrets.GITHUB_TOKEN }}
149+
version: 3.x
150+
151+
- name: Check for dependencies with unapproved licenses
152+
run: task --silent general:check-dep-licenses

Diff for: ‎.licensed.yml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
# This list is incomplete. It must be updated when new dependencies are needed for the project
6+
allowed:
7+
- bsd-3-clause
8+
- bsd-3-clause-clear
9+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
10+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
11+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
12+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`

Diff for: ‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
[![Codecov](https://codecov.io/gh/arduino/go-win32-utils/branch/main/graph/badge.svg)](https://codecov.io/gh/arduino/go-win32-utils)
77
[![Check Go status](https://github.com/arduino/go-win32-utils/actions/workflows/check-go-task.yml/badge.svg)](https://github.com/arduino/go-win32-utils/actions/workflows/check-go-task.yml)
88
[![Check License status](https://github.com/arduino/go-win32-utils/actions/workflows/check-license.yml/badge.svg)](https://github.com/arduino/go-win32-utils/actions/workflows/check-license.yml)
9+
[![Check Go Dependencies status](https://github.com/arduino/go-win32-utils/actions/workflows/check-go-dependencies-task.yml/badge.svg)](https://github.com/arduino/go-win32-utils/actions/workflows/check-go-dependencies-task.yml)
910

1011
This library contains some useful calls to win32 API that are not available on the standard golang library.
1112

Diff for: ‎Taskfile.yml

+32
Original file line numberDiff line numberDiff line change
@@ -160,3 +160,35 @@ tasks:
160160
dir: "{{.DEFAULT_GO_MODULE_PATH}}"
161161
cmds:
162162
- go build -v {{.LDFLAGS}}
163+
164+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
165+
general:cache-dep-licenses:
166+
desc: Cache dependency license metadata
167+
deps:
168+
- task: general:prepare-deps
169+
cmds:
170+
- |
171+
if ! which licensed &>/dev/null; then
172+
if [[ {{OS}} == "windows" ]]; then
173+
echo "Licensed does not have Windows support."
174+
echo "Please use Linux/macOS or download the dependencies cache from the GitHub Actions workflow artifact."
175+
else
176+
echo "licensed not found or not in PATH."
177+
echo "Please install: https://github.com/github/licensed#as-an-executable"
178+
fi
179+
exit 1
180+
fi
181+
- licensed cache
182+
183+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
184+
general:check-dep-licenses:
185+
desc: Check for unapproved dependency licenses
186+
deps:
187+
- task: general:cache-dep-licenses
188+
cmds:
189+
- licensed status
190+
191+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-go-dependencies-task/Taskfile.yml
192+
general:prepare-deps:
193+
desc: Prepare project dependencies for license check
194+
# No preparation is needed for Go module-based projects.

0 commit comments

Comments
 (0)