Add agentic workflow for daily GPL dependency detection#902
Conversation
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a new gh-aw agentic workflow that performs daily GPL-family license detection across Go module dependencies and opens/updates GitHub issues to track remediation.
Changes:
- Introduces a new agentic workflow definition for scanning
go.mod/go.sumfor GPL/AGPL/LGPL dependencies and producing actionable remediation guidance. - Adds the compiled/locked GitHub Actions workflow generated from the agentic workflow source.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
.github/workflows/gpl-dependency-checker.md |
Defines the daily agent instructions, safe-outputs configuration, and network/tooling constraints for GPL dependency detection. |
.github/workflows/gpl-dependency-checker.lock.yml |
Compiled GitHub Actions workflow that runs the agent on schedule and processes safe outputs/cache memory. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} | ||
| GH_AW_WORKFLOW_NAME: "GPL Dependency Checker" | ||
| GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | ||
| GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} | ||
| GH_AW_NOOP_MESSAGE: ${{ steps.noop.outputs.noop_message }} | ||
| GH_AW_NOOP_REPORT_AS_ISSUE: "true" | ||
| with: |
There was a problem hiding this comment.
The workflow is configured to report noop messages as issues (GH_AW_NOOP_REPORT_AS_ISSUE is set to "true"), which conflicts with the workflow’s goal of “silent success” and will likely create recurring noise on clean daily runs. Consider disabling noop-to-issue reporting (or avoiding noop on success) so clean scans don’t open/track issues.
|
|
||
| network: | ||
| allowed: | ||
| - defaults | ||
| - proxy.golang.org |
There was a problem hiding this comment.
This workflow frontmatter omits an explicit engine declaration. Other agentic workflow .md files in this repo set engine: copilot; adding it here would avoid relying on defaults that could change and break compilation/behavior.
| 1. **Search for similar packages:** | ||
| - Use `go list` and web searches to find alternatives | ||
| - Look for packages with permissive licenses (MIT, Apache-2.0, BSD) | ||
|
|
There was a problem hiding this comment.
The instructions suggest doing “web searches” to find alternative packages, but the workflow’s network allowlist is limited (proxy.golang.org/sum.golang.org/pkg.go.dev/api.github.com + defaults). Update this guidance to use sources available within the allowlist (e.g., pkg.go.dev search, GitHub repo search via MCP) so the agent doesn’t attempt blocked outbound requests.
|
|
||
| 1. **Create a detailed GitHub issue** using safe-outputs create-issue: | ||
|
|
||
| **Title format:** `GPL-licensed dependency detected: <package-name>` |
There was a problem hiding this comment.
The issue title format in the instructions doesn’t mention the configured safe-outputs title-prefix: "[license] ", so the actual title will differ from what this section claims. Consider updating the documented title format to include the prefix (or explicitly note that the prefix is auto-applied).
| **Title format:** `GPL-licensed dependency detected: <package-name>` | |
| **Title format:** `[license] GPL-licensed dependency detected: <package-name>` |
Implements automated daily scanning of go.mod dependencies to detect GPL-licensed packages (GPL, AGPL, LGPL) that may conflict with project licensing requirements.
Workflow Capabilities
go mod whyto trace GPL packages through the dependency graphConfiguration
Detection Scope
Identifies all GPL-family licenses requiring review:
Issues include full dependency path, license type, removal strategies, and verification commands. Comments on existing issues when GPL packages are removed.
Files
.github/workflows/gpl-dependency-checker.md- Workflow definition (editable without recompilation).github/workflows/gpl-dependency-checker.lock.yml- Compiled GitHub Actions workflow✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.