Skip to content

Commit 900894a

Browse files
per1234per1234
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent b8c5ece commit 900894a

File tree

5 files changed

+256
-1
lines changed

5 files changed

+256
-1
lines changed

Diff for: ‎.github/workflows/check-go-dependencies-task.yml

+143
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v3#readme
6+
GO_VERSION: "1.14"
7+
8+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
9+
on:
10+
create:
11+
push:
12+
paths:
13+
- ".github/workflows/check-go-dependencies-task.ya?ml"
14+
- ".licenses/**"
15+
- ".licensed.json"
16+
- ".licensed.ya?ml"
17+
- "Taskfile.ya?ml"
18+
- "**/.gitmodules"
19+
- "**/go.mod"
20+
- "**/go.sum"
21+
pull_request:
22+
paths:
23+
- ".github/workflows/check-go-dependencies-task.ya?ml"
24+
- ".licenses/**"
25+
- ".licensed.json"
26+
- ".licensed.ya?ml"
27+
- "Taskfile.ya?ml"
28+
- "**/.gitmodules"
29+
- "**/go.mod"
30+
- "**/go.sum"
31+
schedule:
32+
# Run periodically to catch breakage caused by external changes.
33+
- cron: "0 8 * * WED"
34+
workflow_dispatch:
35+
repository_dispatch:
36+
37+
jobs:
38+
run-determination:
39+
runs-on: ubuntu-latest
40+
outputs:
41+
result: ${{ steps.determination.outputs.result }}
42+
steps:
43+
- name: Determine if the rest of the workflow should run
44+
id: determination
45+
run: |
46+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
47+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
48+
if [[
49+
"${{ github.event_name }}" != "create" ||
50+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
51+
]]; then
52+
# Run the other jobs.
53+
RESULT="true"
54+
else
55+
# There is no need to run the other jobs.
56+
RESULT="false"
57+
fi
58+
59+
echo "::set-output name=result::$RESULT"
60+
61+
check-cache:
62+
needs: run-determination
63+
if: needs.run-determination.outputs.result == 'true'
64+
runs-on: ubuntu-latest
65+
66+
env:
67+
CACHE_PATH: .licenses/
68+
69+
steps:
70+
- name: Checkout repository
71+
uses: actions/checkout@v3
72+
with:
73+
submodules: recursive
74+
75+
- name: Install licensed
76+
uses: jonabc/setup-licensed@v1
77+
with:
78+
github_token: ${{ secrets.GITHUB_TOKEN }}
79+
version: 3.x
80+
81+
- name: Install Go
82+
uses: actions/setup-go@v3
83+
with:
84+
go-version: ${{ env.GO_VERSION }}
85+
86+
- name: Install Task
87+
uses: arduino/setup-task@v1
88+
with:
89+
repo-token: ${{ secrets.GITHUB_TOKEN }}
90+
version: 3.x
91+
92+
- name: Update dependencies license metadata cache
93+
run: task --silent general:cache-dep-licenses
94+
95+
- name: Check for outdated cache
96+
id: diff
97+
run: |
98+
git add .
99+
if ! git diff --cached --color --exit-code "${{ env.CACHE_PATH }}"; then
100+
echo
101+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
102+
exit 1
103+
fi
104+
105+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
106+
- name: Upload cache to workflow artifact
107+
if: failure() && steps.diff.outcome == 'failure'
108+
uses: actions/upload-artifact@v3
109+
with:
110+
if-no-files-found: error
111+
name: dep-licenses-cache
112+
path: ${{ env.CACHE_PATH }}
113+
114+
check-deps:
115+
needs: run-determination
116+
if: needs.run-determination.outputs.result == 'true'
117+
runs-on: ubuntu-latest
118+
119+
steps:
120+
- name: Checkout repository
121+
uses: actions/checkout@v3
122+
with:
123+
submodules: recursive
124+
125+
- name: Install licensed
126+
uses: jonabc/setup-licensed@v1
127+
with:
128+
github_token: ${{ secrets.GITHUB_TOKEN }}
129+
version: 3.x
130+
131+
- name: Install Go
132+
uses: actions/setup-go@v3
133+
with:
134+
go-version: ${{ env.GO_VERSION }}
135+
136+
- name: Install Task
137+
uses: arduino/setup-task@v1
138+
with:
139+
repo-token: ${{ secrets.GITHUB_TOKEN }}
140+
version: 3.x
141+
142+
- name: Check for dependencies with unapproved licenses
143+
run: task --silent general:check-dep-licenses

Diff for: ‎.gitignore

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11

22
bufferflow_tinyg_old.md
33

4-
arduino-create-agent*
4+
/arduino-create-agent*
5+
!/arduino-create-agent*/
56
rsrc.syso
67

78
snapshot/*

Diff for: ‎.licensed.yml

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
apps:
6+
- source_path: ./
7+
8+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/AGPL-3.0/.licensed.yml
9+
allowed:
10+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
11+
- gpl-1.0-or-later
12+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
13+
- gpl-2.0-or-later
14+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
15+
- gpl-3.0-only
16+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
17+
- gpl-3.0-or-later
18+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
19+
- lgpl-2.0-or-later
20+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
21+
- lgpl-2.1-only
22+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
23+
- lgpl-2.1-or-later
24+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
25+
- lgpl-3.0-only
26+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
27+
- lgpl-3.0-or-later
28+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
29+
- agpl-1.0-or-later
30+
- agpl-3.0-only
31+
- agpl-3.0 # Deprecated ID for `agpl-3.0-only`
32+
- agpl-3.0-or-later
33+
- fsfap
34+
- apache-2.0
35+
- artistic-2.0
36+
- clartistic
37+
- sleepycat
38+
- bsl-1.0
39+
- bsd-3-clause
40+
- cecill-2.0
41+
- bsd-3-clause-clear
42+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
43+
- ecos-2.0
44+
- ecl-2.0
45+
- efl-2.0
46+
- eudatagrid
47+
- mit
48+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
49+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
50+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
51+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
52+
- ftl
53+
- hpnd
54+
- imatix
55+
- imlib2
56+
- ijg
57+
# "Informal license" - this is a general class of license
58+
- intel
59+
- isc
60+
- mpl-2.0
61+
- ncsa
62+
# "License of Netscape JavaScript" - no SPDX ID
63+
- oldap-2.7
64+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
65+
- cc0-1.0
66+
- cc-pddc
67+
- psf-2.0
68+
- ruby
69+
- sgi-b-2.0
70+
- smlnj
71+
- standardml-nj # Deprecated ID for `smlnj`
72+
- unicode-dfs-2015
73+
- upl-1.0
74+
- unlicense
75+
- vim
76+
- w3c
77+
- wtfpl
78+
- lgpl-2.0-or-later with wxwindows-exception-3.1
79+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
80+
- x11
81+
- xfree86-1.1
82+
- zlib
83+
- zpl-2.0
84+
- zpl-2.1
85+
# The following are based on individual license text
86+
- eupl-1.2

Diff for: ‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
[![Codecov](https://codecov.io/gh/arduino/arduino-create-agent/branch/main/graph/badge.svg)](https://codecov.io/gh/arduino/arduino-create-agent)
44
[![Test Integration status](https://github.com/arduino/arduino-create-agent/actions/workflows/test-go-integration-task.yml/badge.svg)](https://github.com/arduino/arduino-create-agent/actions/workflows/test-go-integration-task.yml)
55
[![Check License status](https://github.com/arduino/arduino-create-agent/actions/workflows/check-license.yml/badge.svg)](https://github.com/arduino/arduino-create-agent/actions/workflows/check-license.yml)
6+
[![Check Go Dependencies status](https://github.com/arduino/arduino-create-agent/actions/workflows/check-go-dependencies-task.yml/badge.svg)](https://github.com/arduino/arduino-create-agent/actions/workflows/check-go-dependencies-task.yml)
67

78
arduino-create-agent
89
====================

Diff for: ‎Taskfile.yml

+24
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,30 @@
11
version: '3'
22

33
tasks:
4+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
5+
general:cache-dep-licenses:
6+
desc: Cache dependency license metadata
7+
cmds:
8+
- |
9+
if ! which licensed &>/dev/null; then
10+
if [[ {{OS}} == "windows" ]]; then
11+
echo "Licensed does not have Windows support."
12+
echo "Please use Linux/macOS or download the dependencies cache from the GitHub Actions workflow artifact."
13+
else
14+
echo "licensed not found or not in PATH. Please install: https://github.com/github/licensed#as-an-executable"
15+
fi
16+
exit 1
17+
fi
18+
- licensed cache
19+
20+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
21+
general:check-dep-licenses:
22+
desc: Check for unapproved dependency licenses
23+
deps:
24+
- task: general:cache-dep-licenses
25+
cmds:
26+
- licensed status
27+
428
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/go-task/Taskfile.yml
529
go:build:
630
desc: Build the project, to use a specific version use `task build TAG_VERSION=x.x.x`

0 commit comments

Comments
 (0)