Add License Conformity Check #417
Conversation
WalkthroughA new GitHub Actions workflow named Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant GitHub Actions
participant Golang Backend
participant NPM Frontend
User->>GitHub Actions: Trigger Pull Request
GitHub Actions->>Golang Backend: Run license-check-be
Golang Backend->>GitHub Actions: Return license check result
GitHub Actions->>NPM Frontend: Run license-check-fe
NPM Frontend->>GitHub Actions: Return license check result
GitHub Actions->>User: Provide license check results
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Outside diff range and nitpick comments (2)
Makefile (2)
1-3: Would it make sense to align the allowed licenses between frontend and backend?Have you considered:
- Why is
UNLICENSEDallowed for frontend but not for backend?- Could we document why different separators are needed?
- Should
MPL-2.0be added to frontend licenses as well?
35-43: Would you like to enhance the error reporting?Could we add informative error messages when the license checks fail? Perhaps something like:
license-check-be: ## runs golang license check - @(cd services/backend ; go-licenses check ./... --allowed_licenses=$(ALLOWED_LICENSES_COMMA) --ignore=$(IGNORE) --one_output); \ - STATUS=$$?; \ - exit $$STATUS + @(cd services/backend ; go-licenses check ./... --allowed_licenses=$(ALLOWED_LICENSES_COMMA) --ignore=$(IGNORE) --one_output) || \ + (echo "\033[31mBackend license check failed! Please ensure all dependencies use approved licenses.\033[0m" && exit 1) license-check-fe: ## runs npm license check - @(cd services/frontend ; license-checker --onlyAllow=$(ALLOWED_LICENSES_SEMICOLON)); \ - STATUS=$$?; \ - exit $$STATUS + @(cd services/frontend ; license-checker --onlyAllow=$(ALLOWED_LICENSES_SEMICOLON)) || \ + (echo "\033[31mFrontend license check failed! Please ensure all dependencies use approved licenses.\033[0m" && exit 1)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (2)
.github/workflows/license-checker.yaml(1 hunks)Makefile(2 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/license-checker.yaml
18-18: the runner of "actions/setup-go@v4" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
35-35: the runner of "actions/setup-node@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🔇 Additional comments (3)
.github/workflows/license-checker.yaml (3)
3-9: Would you agree that the workflow triggers are well configured?
The combination of PR events, manual dispatch, and daily schedule at 3 AM UTC provides good coverage for license checking.
20-20:
Have you verified the Go version specification?
The specified version 1.23.3 appears to be invalid. Would it be better to use the latest stable version (e.g., 1.21.5)?
35-38:
Would you consider updating both the Node.js version and action version?
A few suggestions:
- Could we update
actions/setup-nodeto v4 (latest)? - Should we use an LTS Node.js version (e.g.,
20.x) instead of23.3.0?
🧰 Tools
🪛 actionlint (1.7.4)
35-35: the runner of "actions/setup-node@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
| uses: actions/setup-go@v4 | ||
| with: |
There was a problem hiding this comment.
💡 Codebase verification
Would you consider upgrading the setup-go action to v5?
The latest version v5.1.0 is available, which could provide newer features and security improvements. Would you like to update from v4?
🔗 Analysis chain
Should we verify the latest setup-go action version?
Would you like to check if there's a newer version available than v4?
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Check latest setup-go action version
gh api \
-H "Accept: application/vnd.github+json" \
repos/actions/setup-go/releases/latest | \
jq -r '.tag_name'
Length of output: 113
🧰 Tools
🪛 actionlint (1.7.4)
18-18: the runner of "actions/setup-go@v4" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
There was a problem hiding this comment.
sounds good, but I'll make a new pr for this
There was a problem hiding this comment.
@uvulpos, would you like me to open a GitHub issue to track this upgrade? 🐰🎉
Summary by CodeRabbit
New Features
Bug Fixes
Documentation