Skip to content

Commit 6e00471

Browse files
MatteoPologrutoMatteoPologruto
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent e5a4945 commit 6e00471

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+8406
-10
lines changed

‎.github/workflows/check-go-dependencies-task.yml

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/main#supported-version-syntax
6+
GO_VERSION: "1.20"
7+
8+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
9+
on:
10+
create:
11+
push:
12+
paths:
13+
- ".github/workflows/check-go-dependencies-task.ya?ml"
14+
- ".licenses/**"
15+
- ".licensed.json"
16+
- ".licensed.ya?ml"
17+
- "Taskfile.ya?ml"
18+
- "**/.gitmodules"
19+
- "**/go.mod"
20+
- "**/go.sum"
21+
pull_request:
22+
paths:
23+
- ".github/workflows/check-go-dependencies-task.ya?ml"
24+
- ".licenses/**"
25+
- ".licensed.json"
26+
- ".licensed.ya?ml"
27+
- "Taskfile.ya?ml"
28+
- "**/.gitmodules"
29+
- "**/go.mod"
30+
- "**/go.sum"
31+
schedule:
32+
# Run periodically to catch breakage caused by external changes.
33+
- cron: "0 8 * * WED"
34+
workflow_dispatch:
35+
repository_dispatch:
36+
37+
jobs:
38+
run-determination:
39+
runs-on: ubuntu-latest
40+
permissions: {}
41+
outputs:
42+
result: ${{ steps.determination.outputs.result }}
43+
steps:
44+
- name: Determine if the rest of the workflow should run
45+
id: determination
46+
run: |
47+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
48+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
49+
if [[
50+
"${{ github.event_name }}" != "create" ||
51+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
52+
]]; then
53+
# Run the other jobs.
54+
RESULT="true"
55+
else
56+
# There is no need to run the other jobs.
57+
RESULT="false"
58+
fi
59+
60+
echo "result=$RESULT" >> $GITHUB_OUTPUT
61+
62+
check-cache:
63+
needs: run-determination
64+
if: needs.run-determination.outputs.result == 'true'
65+
runs-on: ubuntu-latest
66+
permissions:
67+
contents: read
68+
69+
steps:
70+
- name: Checkout repository
71+
uses: actions/checkout@v3
72+
with:
73+
submodules: recursive
74+
75+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
76+
- name: Install Ruby
77+
uses: ruby/setup-ruby@v1
78+
with:
79+
ruby-version: ruby # Install latest version
80+
81+
- name: Install licensed
82+
uses: jonabc/setup-licensed@v1
83+
with:
84+
github_token: ${{ secrets.GITHUB_TOKEN }}
85+
version: 3.x
86+
87+
- name: Install Go
88+
uses: actions/setup-go@v4
89+
with:
90+
go-version: ${{ env.GO_VERSION }}
91+
92+
- name: Install Task
93+
uses: arduino/setup-task@v1
94+
with:
95+
repo-token: ${{ secrets.GITHUB_TOKEN }}
96+
version: 3.x
97+
98+
- name: Update dependencies license metadata cache
99+
run: task --silent general:cache-dep-licenses
100+
101+
- name: Check for outdated cache
102+
id: diff
103+
run: |
104+
git add .
105+
if ! git diff --cached --color --exit-code; then
106+
echo
107+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
108+
exit 1
109+
fi
110+
111+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
112+
- name: Upload cache to workflow artifact
113+
if: failure() && steps.diff.outcome == 'failure'
114+
uses: actions/upload-artifact@v3
115+
with:
116+
if-no-files-found: error
117+
name: dep-licenses-cache
118+
path: .licenses/
119+
120+
check-deps:
121+
needs: run-determination
122+
if: needs.run-determination.outputs.result == 'true'
123+
runs-on: ubuntu-latest
124+
permissions:
125+
contents: read
126+
127+
steps:
128+
- name: Checkout repository
129+
uses: actions/checkout@v3
130+
with:
131+
submodules: recursive
132+
133+
# This is required to allow jonabc/setup-licensed to install licensed via Ruby gem.
134+
- name: Install Ruby
135+
uses: ruby/setup-ruby@v1
136+
with:
137+
ruby-version: ruby # Install latest version
138+
139+
- name: Install licensed
140+
uses: jonabc/setup-licensed@v1
141+
with:
142+
github_token: ${{ secrets.GITHUB_TOKEN }}
143+
version: 3.x
144+
145+
- name: Install Go
146+
uses: actions/setup-go@v4
147+
with:
148+
go-version: ${{ env.GO_VERSION }}
149+
150+
- name: Install Task
151+
uses: arduino/setup-task@v1
152+
with:
153+
repo-token: ${{ secrets.GITHUB_TOKEN }}
154+
version: 3.x
155+
156+
- name: Check for dependencies with unapproved licenses
157+
run: task --silent general:check-dep-licenses

‎.licensed.yml

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,6 @@
22
sources:
33
go: true
44

5-
apps:
6-
- source_path: ./
7-
8-
reviewed:
9-
go:
10-
- typed-rest-client
11-
- "@actions/http-client"
12-
13-
145
reviewed:
156
go:
167
- github.com/arduino/go-paths-helper
@@ -25,7 +16,6 @@ reviewed:
2516
- golang.org/x/text/internal/tag
2617
- golang.org/x/text/language
2718

28-
2919
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/AGPL-3.0/.licensed.yml
3020
allowed:
3121
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses

0 commit comments

Comments
 (0)