Skip to content

Commit ee635a5

Browse files
lucarin91lucarin91
committed
chore: add license check
1 parent 6cc1a0c commit ee635a5

File tree

5 files changed

+473
-0
lines changed

5 files changed

+473
-0
lines changed

‎.github/workflows/check-go-dependencies-task.yml‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
# See: https://docs.github.com/actions/reference/workflows-and-actions/events-that-trigger-workflows
5+
on:
6+
create:
7+
push:
8+
paths:
9+
- ".github/workflows/check-go-dependencies-task.ya?ml"
10+
- ".licenses/**"
11+
- ".licensed.json"
12+
- ".licensed.ya?ml"
13+
- "Taskfile.ya?ml"
14+
- "**/.gitmodules"
15+
- "**/go.mod"
16+
- "**/go.sum"
17+
pull_request:
18+
paths:
19+
- ".github/workflows/check-go-dependencies-task.ya?ml"
20+
- ".licenses/**"
21+
- ".licensed.json"
22+
- ".licensed.ya?ml"
23+
- "Taskfile.ya?ml"
24+
- "**/.gitmodules"
25+
- "**/go.mod"
26+
- "**/go.sum"
27+
schedule:
28+
# Run periodically to catch breakage caused by external changes.
29+
- cron: "0 8 * * WED"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
run-determination:
35+
runs-on: ubuntu-latest
36+
permissions: {}
37+
outputs:
38+
result: ${{ steps.determination.outputs.result }}
39+
steps:
40+
- name: Determine if the rest of the workflow should run
41+
id: determination
42+
run: |
43+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
44+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
45+
if [[
46+
"${{ github.event_name }}" != "create" ||
47+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
48+
]]; then
49+
# Run the other jobs.
50+
RESULT="true"
51+
else
52+
# There is no need to run the other jobs.
53+
RESULT="false"
54+
fi
55+
56+
echo "result=$RESULT" >>$GITHUB_OUTPUT
57+
58+
check-cache:
59+
needs: run-determination
60+
if: needs.run-determination.outputs.result == 'true'
61+
runs-on: ubuntu-latest
62+
permissions:
63+
contents: read
64+
65+
steps:
66+
- name: Checkout repository
67+
uses: actions/checkout@v5
68+
with:
69+
submodules: recursive
70+
71+
# This is required to allow licensee/setup-licensed to install Licensed via Ruby gem.
72+
- name: Install Ruby
73+
uses: ruby/setup-ruby@v1
74+
with:
75+
ruby-version: ruby # Install latest version
76+
77+
- name: Install licensed
78+
uses: licensee/[email protected]
79+
with:
80+
github_token: ${{ secrets.GITHUB_TOKEN }}
81+
version: 5.x
82+
83+
- name: Install Go
84+
uses: actions/setup-go@v6
85+
with:
86+
go-version-file: go.mod
87+
88+
- name: Update dependencies license metadata cache
89+
run: |
90+
go tool \
91+
github.com/go-task/task/v3/cmd/task \
92+
--silent \
93+
general:cache-dep-licenses
94+
95+
- name: Check for outdated cache
96+
id: diff
97+
run: |
98+
git add .
99+
if
100+
! git diff \
101+
--cached \
102+
--color \
103+
--exit-code
104+
then
105+
echo
106+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
107+
exit 1
108+
fi
109+
110+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
111+
- name: Upload cache to workflow artifact
112+
if: failure() && steps.diff.outcome == 'failure'
113+
uses: actions/upload-artifact@v4
114+
with:
115+
if-no-files-found: error
116+
include-hidden-files: true
117+
name: dep-licenses-cache
118+
path: .licenses/
119+
120+
check-deps:
121+
needs: run-determination
122+
if: needs.run-determination.outputs.result == 'true'
123+
runs-on: ubuntu-latest
124+
permissions:
125+
contents: read
126+
127+
steps:
128+
- name: Checkout repository
129+
uses: actions/checkout@v5
130+
with:
131+
submodules: recursive
132+
133+
# This is required to allow licensee/setup-licensed to install Licensed via Ruby gem.
134+
- name: Install Ruby
135+
uses: ruby/setup-ruby@v1
136+
with:
137+
ruby-version: ruby # Install latest version
138+
139+
- name: Install licensed
140+
uses: licensee/[email protected]
141+
with:
142+
github_token: ${{ secrets.GITHUB_TOKEN }}
143+
version: 5.x
144+
145+
- name: Install Go
146+
uses: actions/setup-go@v6
147+
with:
148+
go-version-file: go.mod
149+
150+
- name: Check for dependencies with unapproved licenses
151+
run: |
152+
go tool \
153+
github.com/go-task/task/v3/cmd/task \
154+
--silent \
155+
general:check-dep-licenses

‎.licensed.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
sources:
2+
go: true
3+
4+
cache_path: .licenses
5+
6+
apps:
7+
- source_path: .
8+
9+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-3.0/.licensed.yml
10+
allowed:
11+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
12+
- gpl-1.0-or-later
13+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
14+
- gpl-2.0-or-later
15+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
16+
- gpl-3.0-only
17+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
18+
- gpl-3.0-or-later
19+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
20+
- lgpl-2.0-or-later
21+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
22+
- lgpl-2.1-only
23+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
24+
- lgpl-2.1-or-later
25+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
26+
- lgpl-3.0-only
27+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
28+
- lgpl-3.0-or-later
29+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
30+
- fsfap
31+
- apache-2.0
32+
- artistic-2.0
33+
- clartistic
34+
- sleepycat
35+
- bsl-1.0
36+
- bsd-3-clause
37+
- cecill-2.0
38+
- bsd-3-clause-clear
39+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
40+
- ecos-2.0
41+
- ecl-2.0
42+
- efl-2.0
43+
- eudatagrid
44+
- mit
45+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
46+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
47+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
48+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
49+
- ftl
50+
- hpnd
51+
- imatix
52+
- imlib2
53+
- ijg
54+
# "Informal license" - this is a general class of license
55+
- intel
56+
- isc
57+
- mpl-2.0
58+
- ncsa
59+
# "License of Netscape JavaScript" - no SPDX ID
60+
- oldap-2.7
61+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
62+
- cc0-1.0
63+
- cc-pddc
64+
- psf-2.0
65+
- ruby
66+
- sgi-b-2.0
67+
- smlnj
68+
- standardml-nj # Deprecated ID for `smlnj`
69+
- unicode-dfs-2015
70+
- upl-1.0
71+
- unlicense
72+
- vim
73+
- w3c
74+
- wtfpl
75+
- lgpl-2.0-or-later with wxwindows-exception-3.1
76+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
77+
- x11
78+
- xfree86-1.1
79+
- zlib
80+
- zpl-2.0
81+
- zpl-2.1
82+
# The following are based on individual license text
83+
- eupl-1.2
84+
- liliq-r-1.1
85+
- liliq-rplus-1.1

‎Taskfile.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,38 @@ tasks:
66
cmds:
77
- go install github.com/google/[email protected]
88
- addlicense -c "ARDUINO SA (http://www.arduino.cc/)" -f ./license_header.tpl $(find . -name "*.go" -type f -print0 | xargs -0)
9+
10+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
11+
general:cache-dep-licenses:
12+
desc: Cache dependency license metadata
13+
deps:
14+
- task: general:prepare-deps
15+
cmds:
16+
- |
17+
if
18+
! which licensed \
19+
&>/dev/null
20+
then
21+
if [[ {{OS}} == "windows" ]]; then
22+
echo "Licensed does not have Windows support."
23+
echo "Please use Linux/macOS or download the dependencies cache from the GitHub Actions workflow artifact."
24+
else
25+
echo "licensed not found or not in PATH."
26+
echo "Please install: https://github.com/licensee/licensed#installation"
27+
fi
28+
exit 1
29+
fi
30+
- licensed cache
31+
32+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies-task/Taskfile.yml
33+
general:check-dep-licenses:
34+
desc: Check for unapproved dependency licenses
35+
deps:
36+
- task: general:cache-dep-licenses
37+
cmds:
38+
- licensed status
39+
40+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-go-dependencies-task/Taskfile.yml
41+
general:prepare-deps:
42+
desc: Prepare project dependencies for license check
43+
# No preparation is needed for Go module-based projects.

‎go.mod‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,56 @@ require (
1010
)
1111

1212
require (
13+
dario.cat/mergo v1.0.0 // indirect
14+
github.com/Ladicle/tabwriter v1.0.0 // indirect
15+
github.com/Masterminds/semver/v3 v3.4.0 // indirect
16+
github.com/Microsoft/go-winio v0.6.2 // indirect
17+
github.com/ProtonMail/go-crypto v1.1.6 // indirect
18+
github.com/alecthomas/chroma/v2 v2.19.0 // indirect
19+
github.com/chainguard-dev/git-urls v1.0.2 // indirect
20+
github.com/cloudflare/circl v1.6.1 // indirect
21+
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
1322
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
23+
github.com/dlclark/regexp2 v1.11.5 // indirect
24+
github.com/dominikbraun/graph v0.23.0 // indirect
25+
github.com/elliotchance/orderedmap/v3 v3.1.0 // indirect
26+
github.com/emirpasic/gods v1.18.1 // indirect
27+
github.com/fatih/color v1.18.0 // indirect
28+
github.com/fsnotify/fsnotify v1.9.0 // indirect
29+
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
30+
github.com/go-git/go-billy/v5 v5.6.2 // indirect
31+
github.com/go-git/go-git/v5 v5.16.2 // indirect
32+
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
33+
github.com/go-task/task/v3 v3.44.1 // indirect
34+
github.com/go-task/template v0.2.0 // indirect
35+
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
36+
github.com/google/uuid v1.6.0 // indirect
1437
github.com/inconshreveable/mousetrap v1.1.0 // indirect
38+
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
39+
github.com/joho/godotenv v1.5.1 // indirect
40+
github.com/kevinburke/ssh_config v1.2.0 // indirect
41+
github.com/klauspost/cpuid/v2 v2.2.7 // indirect
42+
github.com/mattn/go-colorable v0.1.13 // indirect
43+
github.com/mattn/go-isatty v0.0.20 // indirect
44+
github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
45+
github.com/pjbgf/sha1cd v0.3.2 // indirect
1546
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
47+
github.com/puzpuzpuz/xsync/v3 v3.5.1 // indirect
48+
github.com/sajari/fuzzy v1.0.0 // indirect
49+
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
50+
github.com/skeema/knownhosts v1.3.1 // indirect
1651
github.com/spf13/pflag v1.0.7 // indirect
52+
github.com/stretchr/objx v0.5.2 // indirect
1753
github.com/stretchr/testify v1.11.0 // indirect
54+
github.com/xanzy/ssh-agent v0.3.3 // indirect
55+
github.com/zeebo/xxh3 v1.0.2 // indirect
56+
golang.org/x/net v0.43.0 // indirect
57+
golang.org/x/sync v0.16.0 // indirect
1858
golang.org/x/sys v0.36.0 // indirect
59+
golang.org/x/term v0.35.0 // indirect
60+
gopkg.in/warnings.v0 v0.1.2 // indirect
61+
gopkg.in/yaml.v3 v3.0.1 // indirect
62+
mvdan.cc/sh/v3 v3.12.0 // indirect
1963
)
64+
65+
tool github.com/go-task/task/v3/cmd/task

0 commit comments

Comments
 (0)