Skip to content

Commit 71283d1

Browse files
per1234per1234
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent d8468df commit 71283d1

File tree

6 files changed

+221
-2
lines changed

6 files changed

+221
-2
lines changed

‎.codespellrc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ ignore-words-list = ,
66
builtin = clear,informal,en-GB_to_en-US
77
check-filenames =
88
check-hidden =
9-
skip = ./.git,./go.mod,./go.sum,./package-lock.json,./poetry.lock,./yarn.lock
9+
skip = ./.git,./.licenses,./go.mod,./go.sum,./package-lock.json,./poetry.lock,./yarn.lock

‎.github/workflows/check-go-dependencies-task.yml

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v2#readme
6+
GO_VERSION: "1.16"
7+
8+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
9+
on:
10+
push:
11+
paths:
12+
- ".github/workflows/check-go-dependencies-task.ya?ml"
13+
- ".licenses/**"
14+
- ".licensed.json"
15+
- ".licensed.ya?ml"
16+
- "Taskfile.ya?ml"
17+
- "**/.gitmodules"
18+
- "**/go.mod"
19+
- "**/go.sum"
20+
pull_request:
21+
paths:
22+
- ".github/workflows/check-go-dependencies-task.ya?ml"
23+
- ".licenses/**"
24+
- ".licensed.json"
25+
- ".licensed.ya?ml"
26+
- "Taskfile.ya?ml"
27+
- "**/.gitmodules"
28+
- "**/go.mod"
29+
- "**/go.sum"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
check-cache:
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
with:
41+
submodules: recursive
42+
43+
- name: Install licensed
44+
uses: jonabc/setup-licensed@v1
45+
with:
46+
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 3.x
48+
49+
- name: Install Go
50+
uses: actions/setup-go@v2
51+
with:
52+
go-version: ${{ env.GO_VERSION }}
53+
54+
- name: Install Task
55+
uses: arduino/setup-task@v1
56+
with:
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
version: 3.x
59+
60+
- name: Update dependencies license metadata cache
61+
run: task --silent general:cache-dep-licenses
62+
63+
- name: Check for outdated cache
64+
id: diff
65+
run: |
66+
git add --intent-to-add .
67+
if ! git diff --color --exit-code; then
68+
echo
69+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
70+
exit 1
71+
fi
72+
73+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
74+
- name: Upload cache to workflow artifact
75+
if: failure() && steps.diff.outcome == 'failure'
76+
uses: actions/upload-artifact@v2
77+
with:
78+
if-no-files-found: error
79+
name: dep-licenses-cache
80+
path: .licenses/
81+
82+
check-deps:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v2
88+
with:
89+
submodules: recursive
90+
91+
- name: Install licensed
92+
uses: jonabc/setup-licensed@v1
93+
with:
94+
github_token: ${{ secrets.GITHUB_TOKEN }}
95+
version: 3.x
96+
97+
- name: Install Go
98+
uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Install Task
103+
uses: arduino/setup-task@v1
104+
with:
105+
repo-token: ${{ secrets.GITHUB_TOKEN }}
106+
version: 3.x
107+
108+
- name: Check for dependencies with unapproved licenses
109+
run: task --silent general:check-dep-licenses

‎.gitignore

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# Build artifacts
2-
serial-monitor
2+
/serial-monitor
3+
!/serial-monitor/
34
serial-monitor.exe
45
__pycache__/
56

‎.licensed.yml

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
apps:
6+
- source_path: ./
7+
8+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-3.0/.licensed.yml
9+
allowed:
10+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
11+
- gpl-1.0-or-later
12+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
13+
- gpl-2.0-or-later
14+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
15+
- gpl-3.0-only
16+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
17+
- gpl-3.0-or-later
18+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
19+
- lgpl-2.0-or-later
20+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
21+
- lgpl-2.1-only
22+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
23+
- lgpl-2.1-or-later
24+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
25+
- lgpl-3.0-only
26+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
27+
- lgpl-3.0-or-later
28+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
29+
- fsfap
30+
- apache-2.0
31+
- artistic-2.0
32+
- clartistic
33+
- sleepycat
34+
- bsl-1.0
35+
- bsd-3-clause
36+
- cecill-2.0
37+
- bsd-3-clause-clear
38+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
39+
- ecos-2.0
40+
- ecl-2.0
41+
- efl-2.0
42+
- eudatagrid
43+
- mit
44+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
45+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
46+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
47+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
48+
- ftl
49+
- hpnd
50+
- imatix
51+
- imlib2
52+
- ijg
53+
# "Informal license" - this is a general class of license
54+
- intel
55+
- isc
56+
- mpl-2.0
57+
- ncsa
58+
# "License of Netscape JavaScript" - no SPDX ID
59+
- oldap-2.7
60+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
61+
- cc0-1.0
62+
- cc-pddc
63+
- psf-2.0
64+
- ruby
65+
- sgi-b-2.0
66+
- smlnj
67+
- standardml-nj # Deprecated ID for `smlnj`
68+
- unicode-dfs-2015
69+
- upl-1.0
70+
- unlicense
71+
- vim
72+
- w3c
73+
- wtfpl
74+
- lgpl-2.0-or-later with wxwindows-exception-3.1
75+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
76+
- x11
77+
- xfree86-1.1
78+
- zlib
79+
- zpl-2.0
80+
- zpl-2.1
81+
# The following are based on individual license text
82+
- eupl-1.2
83+
- liliq-r-1.1
84+
- liliq-rplus-1.1

‎.prettierignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/.licenses/

‎Taskfile.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,30 @@ tasks:
184184
cmds:
185185
- poetry run yamllint --format {{default "colored" .YAMLLINT_FORMAT}} .
186186

187+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
188+
general:cache-dep-licenses:
189+
desc: Cache dependency license metadata
190+
cmds:
191+
- |
192+
if ! which licensed &>/dev/null; then
193+
if [[ "{{OS}}" == "windows" ]]; then
194+
echo "Licensed does not have Windows support."
195+
echo "Please use Linux/macOS or download the dependencies cache from the GitHub Actions workflow artifact."
196+
else
197+
echo "licensed not found or not in PATH. Please install: https://github.com/github/licensed#as-an-executable"
198+
fi
199+
exit 1
200+
fi
201+
- licensed cache
202+
203+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
204+
general:check-dep-licenses:
205+
desc: Check for unapproved dependency licenses
206+
deps:
207+
- task: general:cache-dep-licenses
208+
cmds:
209+
- licensed status
210+
187211
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/spell-check-task/Taskfile.yml
188212
general:check-spelling:
189213
desc: Check for commonly misspelled words

0 commit comments

Comments
 (0)