Skip to content

Commit 05a1e3f

Browse files
per1234per1234
committed
Add CI workflow to check for unapproved Go dependency licenses
A task and GitHub Actions workflow are provided here for checking the license types of Go project dependencies. On every push and pull request that affects relevant files, the CI workflow will check: - If the dependency licenses cache is up to date - If any of the project's dependencies have an unapproved license type. Approval can be based on: - Universally allowed license type - Individual dependency
1 parent 1b3dc14 commit 05a1e3f

File tree

3 files changed

+212
-0
lines changed

3 files changed

+212
-0
lines changed

‎.github/workflows/check-go-dependencies-task.yml

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v2#readme
6+
GO_VERSION: "1.13"
7+
8+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
9+
on:
10+
push:
11+
paths:
12+
- ".github/workflows/check-go-dependencies-task.ya?ml"
13+
- ".licenses/**"
14+
- ".licensed.json"
15+
- ".licensed.ya?ml"
16+
- "Taskfile.ya?ml"
17+
- "**/.gitmodules"
18+
- "**/go.mod"
19+
- "**/go.sum"
20+
pull_request:
21+
paths:
22+
- ".github/workflows/check-go-dependencies-task.ya?ml"
23+
- ".licenses/**"
24+
- ".licensed.json"
25+
- ".licensed.ya?ml"
26+
- "Taskfile.ya?ml"
27+
- "**/.gitmodules"
28+
- "**/go.mod"
29+
- "**/go.sum"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
check-cache:
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
with:
41+
submodules: recursive
42+
43+
- name: Install licensed
44+
uses: jonabc/setup-licensed@v1
45+
with:
46+
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 3.x
48+
49+
- name: Install Go
50+
uses: actions/setup-go@v2
51+
with:
52+
go-version: ${{ env.GO_VERSION }}
53+
54+
- name: Install Task
55+
uses: arduino/setup-task@v1
56+
with:
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
version: 3.x
59+
60+
- name: Update dependencies license metadata cache
61+
run: task --silent general:cache-dep-licenses
62+
63+
- name: Check for outdated cache
64+
id: diff
65+
run: |
66+
git add --intent-to-add .
67+
if ! git diff --color --exit-code; then
68+
echo
69+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
70+
exit 1
71+
fi
72+
73+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
74+
- name: Upload cache to workflow artifact
75+
if: failure() && steps.diff.outcome == 'failure'
76+
uses: actions/upload-artifact@v2
77+
with:
78+
if-no-files-found: error
79+
name: dep-licenses-cache
80+
path: .licenses/
81+
82+
check-deps:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v2
88+
with:
89+
submodules: recursive
90+
91+
- name: Install licensed
92+
uses: jonabc/setup-licensed@v1
93+
with:
94+
github_token: ${{ secrets.GITHUB_TOKEN }}
95+
version: 3.x
96+
97+
- name: Install Go
98+
uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Install Task
103+
uses: arduino/setup-task@v1
104+
with:
105+
repo-token: ${{ secrets.GITHUB_TOKEN }}
106+
version: 3.x
107+
108+
- name: Check for dependencies with unapproved licenses
109+
run: task --silent general:check-dep-licenses

‎.licensed.yml

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
apps:
6+
- source_path: ./
7+
8+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-2.0/.licensed.yml
9+
allowed:
10+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
11+
- gpl-1.0-or-later
12+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
13+
- gpl-2.0-only
14+
- gpl-2.0 # Deprecated ID for `gpl-2.0-only`
15+
- gpl-2.0-or-later
16+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
17+
- lgpl-2.0-or-later
18+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
19+
- lgpl-2.1-only
20+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
21+
- lgpl-2.1-or-later
22+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
23+
- fsfap
24+
- artistic-2.0
25+
- clartistic
26+
- sleepycat
27+
- bsl-1.0
28+
- bsd-3-clause
29+
- cecill-2.0
30+
- bsd-3-clause-clear
31+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
32+
- ecos-2.0
33+
- efl-2.0
34+
- eudatagrid
35+
- mit
36+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
37+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
38+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
39+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
40+
- hpnd
41+
- imatix
42+
- imlib2
43+
- ijg
44+
# "Informal license" - this is a general class of license
45+
- intel
46+
- isc
47+
- mpl-2.0
48+
- ncsa
49+
# "License of Netscape JavaScript" - no SPDX ID
50+
- oldap-2.7
51+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
52+
- cc0-1.0
53+
- cc-pddc
54+
- psf-2.0
55+
- ruby
56+
- sgi-b-2.0
57+
- smlnj
58+
- standardml-nj # Deprecated ID for `smlnj`
59+
- unicode-dfs-2015
60+
- upl-1.0
61+
- unlicense
62+
- vim
63+
- w3c
64+
- wtfpl
65+
- lgpl-2.0-or-later with wxwindows-exception-3.1
66+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
67+
- x11
68+
- zlib
69+
- zpl-2.0
70+
- zpl-2.1
71+
# The following are based on individual license text
72+
- eupl-1.0
73+
- eupl-1.1
74+
- eupl-1.2
75+
- liliq-r-1.1
76+
- liliq-rplus-1.1

‎Taskfile.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# See: https://taskfile.dev/#/usage
2+
version: "3"
3+
4+
tasks:
5+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
6+
general:cache-dep-licenses:
7+
desc: Cache dependency license metadata
8+
cmds:
9+
- |
10+
if ! which licensed &>/dev/null; then
11+
if [[ {{OS}} == "windows" ]]; then
12+
echo "Licensed does not have Windows support."
13+
echo "Please use Linux/macOS or download the dependencies cache from the GitHub Actions workflow artifact."
14+
else
15+
echo "licensed not found or not in PATH. Please install: https://github.com/github/licensed#as-an-executable"
16+
fi
17+
exit 1
18+
fi
19+
- licensed cache
20+
21+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
22+
general:check-dep-licenses:
23+
desc: Check for unapproved dependency licenses
24+
deps:
25+
- task: general:cache-dep-licenses
26+
cmds:
27+
- licensed status

0 commit comments

Comments
 (0)