Skip to content

Commit 2813273

Browse files
per1234per1234
authored
Merge pull request #10 from per1234/check-dependencies
Add CI workflow to check for unapproved Go dependency licenses
2 parents 1b3dc14 + a5d3172 commit 2813273

File tree

4 files changed

+562
-0
lines changed

4 files changed

+562
-0
lines changed

‎.github/workflows/check-go-dependencies-task.yml

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v2#readme
6+
GO_VERSION: "1.13"
7+
8+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
9+
on:
10+
push:
11+
paths:
12+
- ".github/workflows/check-go-dependencies-task.ya?ml"
13+
- ".licenses/**"
14+
- ".licensed.json"
15+
- ".licensed.ya?ml"
16+
- "Taskfile.ya?ml"
17+
- "**/.gitmodules"
18+
- "**/go.mod"
19+
- "**/go.sum"
20+
pull_request:
21+
paths:
22+
- ".github/workflows/check-go-dependencies-task.ya?ml"
23+
- ".licenses/**"
24+
- ".licensed.json"
25+
- ".licensed.ya?ml"
26+
- "Taskfile.ya?ml"
27+
- "**/.gitmodules"
28+
- "**/go.mod"
29+
- "**/go.sum"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
check-cache:
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
with:
41+
submodules: recursive
42+
43+
- name: Install licensed
44+
uses: jonabc/setup-licensed@v1
45+
with:
46+
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 3.x
48+
49+
- name: Install Go
50+
uses: actions/setup-go@v2
51+
with:
52+
go-version: ${{ env.GO_VERSION }}
53+
54+
- name: Install Task
55+
uses: arduino/setup-task@v1
56+
with:
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
version: 3.x
59+
60+
- name: Update dependencies license metadata cache
61+
run: task --silent general:cache-dep-licenses
62+
63+
- name: Check for outdated cache
64+
id: diff
65+
run: |
66+
git add --intent-to-add .
67+
if ! git diff --color --exit-code; then
68+
echo
69+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
70+
exit 1
71+
fi
72+
73+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
74+
- name: Upload cache to workflow artifact
75+
if: failure() && steps.diff.outcome == 'failure'
76+
uses: actions/upload-artifact@v2
77+
with:
78+
if-no-files-found: error
79+
name: dep-licenses-cache
80+
path: .licenses/
81+
82+
check-deps:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v2
88+
with:
89+
submodules: recursive
90+
91+
- name: Install licensed
92+
uses: jonabc/setup-licensed@v1
93+
with:
94+
github_token: ${{ secrets.GITHUB_TOKEN }}
95+
version: 3.x
96+
97+
- name: Install Go
98+
uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Install Task
103+
uses: arduino/setup-task@v1
104+
with:
105+
repo-token: ${{ secrets.GITHUB_TOKEN }}
106+
version: 3.x
107+
108+
- name: Check for dependencies with unapproved licenses
109+
run: task --silent general:check-dep-licenses

‎.licensed.yml

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
apps:
6+
- source_path: ./
7+
8+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-2.0/.licensed.yml
9+
allowed:
10+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
11+
- gpl-1.0-or-later
12+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
13+
- gpl-2.0-only
14+
- gpl-2.0 # Deprecated ID for `gpl-2.0-only`
15+
- gpl-2.0-or-later
16+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
17+
- lgpl-2.0-or-later
18+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
19+
- lgpl-2.1-only
20+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
21+
- lgpl-2.1-or-later
22+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
23+
- fsfap
24+
- artistic-2.0
25+
- clartistic
26+
- sleepycat
27+
- bsl-1.0
28+
- bsd-3-clause
29+
- cecill-2.0
30+
- bsd-3-clause-clear
31+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
32+
- ecos-2.0
33+
- efl-2.0
34+
- eudatagrid
35+
- mit
36+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
37+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
38+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
39+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
40+
- hpnd
41+
- imatix
42+
- imlib2
43+
- ijg
44+
# "Informal license" - this is a general class of license
45+
- intel
46+
- isc
47+
- mpl-2.0
48+
- ncsa
49+
# "License of Netscape JavaScript" - no SPDX ID
50+
- oldap-2.7
51+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
52+
- cc0-1.0
53+
- cc-pddc
54+
- psf-2.0
55+
- ruby
56+
- sgi-b-2.0
57+
- smlnj
58+
- standardml-nj # Deprecated ID for `smlnj`
59+
- unicode-dfs-2015
60+
- upl-1.0
61+
- unlicense
62+
- vim
63+
- w3c
64+
- wtfpl
65+
- lgpl-2.0-or-later with wxwindows-exception-3.1
66+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
67+
- x11
68+
- zlib
69+
- zpl-2.0
70+
- zpl-2.1
71+
# The following are based on individual license text
72+
- eupl-1.0
73+
- eupl-1.1
74+
- eupl-1.2
75+
- liliq-r-1.1
76+
- liliq-rplus-1.1

0 commit comments

Comments
 (0)