Skip to content

Commit dc0221f

Browse files
fauresebastfauresebast
committed
Add license-finder check in github CI
1 parent 07e8524 commit dc0221f

File tree

5 files changed

+231
-3
lines changed

5 files changed

+231
-3
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,26 @@ on:
55
- pull_request
66

77
jobs:
8+
license_checks:
9+
name: License checks
10+
runs-on: ubuntu-latest
11+
env:
12+
RAILS_ENV: test
13+
steps:
14+
- uses: actions/checkout@v5
15+
- name: Set up Ruby
16+
uses: ruby/setup-ruby@v1
17+
with:
18+
ruby-version: 3.4.7
19+
bundler-cache: true # bundle installs and caches dependencies
20+
- name: Run license checks
21+
run: |
22+
bundle exec license_finder || (cat <<-END && exit 1)
23+
24+
You seem to be introducing a new license into our stack, please reach out to
25+
#licenses-tech-stack on slack to get guidance on the topic.
26+
END
27+
828
test:
929
runs-on: ubuntu-latest
1030
strategy:
@@ -14,7 +34,7 @@ jobs:
1434
env:
1535
RAILS_ENV: test
1636
steps:
17-
- uses: actions/checkout@v4
37+
- uses: actions/checkout@v5
1838
- name: Set up Ruby
1939
uses: ruby/setup-ruby@v1
2040
with:

‎.gitignore‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
.DS_Store
2-
doc
32
coverage
43
pkg
54
*~

‎.tool-versions‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ruby 3.4.7

‎Gemfile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
source 'https://rubygems.org'
22
gemspec
33

4-
4+
group :test, :development do
5+
gem 'license_finder', require: false
6+
end

‎doc/dependency_decisions.yml‎

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
---
2+
################################################################################
3+
#
4+
# IMPORTANT: This file includes some important legal decisions that were
5+
# made by the legal team so before making changes, reach out to the slack
6+
# channel #licenses-tech-stack to ask around and get more context.
7+
#
8+
# extracted from jeancaisse on 2025-10-10
9+
# jeancaisse commit hash: 8ca5b0109437932bc7171941d26f68a26832fe80
10+
#
11+
################################################################################
12+
13+
########################################
14+
#
15+
# LICENSES WE CAN USE WITHOUT CONCERN
16+
#
17+
########################################
18+
19+
- [permit, 2-clause BSDL]
20+
- [permit, Apache 2.0]
21+
- [permit, Apache License (2.0)]
22+
- [permit, BlueOak-1.0.0]
23+
- [permit, BSD Zero Clause License]
24+
- [permit, BSD]
25+
- [permit, Hippocratic-2.1]
26+
- [permit, ISC]
27+
- [permit, MIT or MPL-2.0]
28+
- [permit, MIT]
29+
- [permit, MIT-0]
30+
- [permit, New BSD]
31+
- [permit, Public Domain]
32+
- [permit, Python-2.0]
33+
- [permit, ruby]
34+
- [permit, Simplified BSD]
35+
- [permit, Unlicense]
36+
- [permit, WTFPL]
37+
- [permit, Zlib]
38+
- [permit, CC0 1.0 Universal]
39+
- - :approve
40+
- Pennylane
41+
- :why: Our own software
42+
- - :approve
43+
- pennylane
44+
- :why: Our own software
45+
- - :approve
46+
- '.'
47+
- :why: Our own software
48+
49+
########################################
50+
#
51+
# COMMERCIAL LICENSES SECTION
52+
#
53+
########################################
54+
55+
- - :approve
56+
- sidekiq
57+
- :why: We have purchased a commercial license
58+
- - :approve
59+
- sidekiq-pro
60+
- :why: We have purchased a commercial license
61+
- - :approve
62+
- hexapdf
63+
- :why: We have purchased a commercial license
64+
- - :approve
65+
- fintecture
66+
- :why: Covered by our commercial relationship
67+
68+
########################################
69+
#
70+
# NOT IDEAL BUT NON-BLOCKING
71+
# we want to manually review and approve software using those licenses on
72+
# a case-by-case approach because it's debatable setup
73+
#
74+
# Those licenses notably include:
75+
# - Creative Commons versions (CC-BY is generally OK, but needs double-checking)
76+
# - LGPL, which is confusing between Lesser GPL and Library GPL and its many versions.
77+
# - Mozilla Public License (MPL) which is generally OK as well, but let's be conservative
78+
#
79+
########################################
80+
81+
- - :approve
82+
- caniuse-lite
83+
- :why: >
84+
Using CC-BY-4.0 which is permissive:
85+
https://github.com/browserslist/caniuse-lite?tab=CC-BY-4.0-1-ov-file#readme
86+
87+
- - :approve
88+
- llhttp-ffi
89+
- :why: Mozilla Public License 2.0 is fine
90+
91+
- - :approve
92+
- mdn-data
93+
- :why: >
94+
Using CC0-1.0 which is permissive:
95+
https://github.com/mdn/data?tab=CC0-1.0-1-ov-file#readme
96+
97+
- - :approve
98+
- postcss-values-parser
99+
- :why: Mozilla Public License 2.0 is fine
100+
101+
########################################
102+
#
103+
# MISDOCUMENTED VALID LICENSES
104+
#
105+
########################################
106+
107+
- - :approve
108+
- aws_cf_signer
109+
- :why: MIT license https://github.com/dylanvaughn/aws_cf_signer?tab=MIT-1-ov-file#readme
110+
- - :approve
111+
- '@segment/facade'
112+
- :why: MIT license https://github.com/segmentio/facade?tab=MIT-1-ov-file
113+
- - :approve
114+
- '@segment/isodate'
115+
- :why: MIT license https://github.com/segmentio/isodate?tab=MIT-1-ov-file
116+
- - :approve
117+
- '@segment/isodate-traverse'
118+
- :why: MIT license https://github.com/segmentio/isodate-traverse?tab=MIT-1-ov-file
119+
- - :approve
120+
- brakeman
121+
- :why: https://github.com/presidentbeef/brakeman/blob/main/LICENSE.md
122+
- - :approve
123+
- color-convert
124+
- :why: MIT license https://github.com/Qix-/color-convert#MIT-1-ov-file
125+
- - :approve
126+
- decko
127+
- :why: MIT license https://github.com/developit/decko?tab=MIT-1-ov-file
128+
- - :approve
129+
- exif-parser
130+
- :why: MIT license https://github.com/bwindels/exif-parser?tab=MIT-1-ov-file
131+
- - :approve
132+
- khroma
133+
- :why: MIT license https://github.com/fabiospampinato/khroma?tab=MIT-1-ov-file
134+
- - :approve
135+
- new-date
136+
- :why: MIT license https://github.com/segmentio/new-date?tab=MIT-1-ov-file
137+
- - :approve
138+
- stickyfill
139+
- :why: MIT license https://github.com/webmodules/stickyfill?tab=MIT-1-ov-file
140+
- - :approve
141+
- tosource
142+
- :why: Zlib license https://github.com/marcello3d/node-tosource?tab=Zlib-1-ov-file
143+
- - :approve
144+
- uuid-v4
145+
- :why: MIT license https://www.npmjs.com/package/uuid-v4
146+
- - :approve
147+
- pdf-core
148+
- :why: Matz' Ruby license https://github.com/prawnpdf/pdf-core?tab=License-1-ov-file
149+
- - :approve
150+
- prawn
151+
- :why: Matz' Ruby license https://github.com/prawnpdf/prawn?tab=License-1-ov-file
152+
- - :approve
153+
- ttfunk
154+
- :why: Matz' Ruby license https://github.com/prawnpdf/ttfunk?tab=License-1-ov-file
155+
- - :approve
156+
- '@typescript-eslint/parser'
157+
- :why: MIT license https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/LICENSE
158+
- - :approve
159+
- 'atomically'
160+
- :why: MIT license https://github.com/fabiospampinato/atomically/blob/master/license
161+
- - :approve
162+
- 'when-exit'
163+
- :why: MIT license https://github.com/fabiospampinato/when-exit/blob/master/license
164+
- - :approve
165+
- 'stubborn-fs'
166+
- :why: MIT license https://github.com/fabiospampinato/stubborn-fs/blob/master/license
167+
- - :approve
168+
- '@auth0/xmldom'
169+
- :why: MIT license https://github.com/auth0/xmldom/blob/master/LICENSE
170+
- - :approve
171+
- 'valid-url'
172+
- :why: MIT license https://github.com/ogt/valid-url/blob/master/LICENSE
173+
- - :approve
174+
- 'front_matter_parser'
175+
- :why: MIT license https://github.com/waiting-for-dev/front_matter_parser/blob/main/LICENSE.txt
176+
- - :approve
177+
- customerio-gist-web
178+
- :why: >
179+
MIT license; see LICENSE file in package
180+
https://unpkg.com/browse/customerio-gist-web@3.16.10/LICENSE
181+
########################################
182+
#
183+
# NOT IDEAL BUT NOT A BLOCKER
184+
#
185+
########################################
186+
187+
- - :approve
188+
- mini_exiftool
189+
- :why: >
190+
This is LGPL-2.1, a weak copyleft license that we can use as long as we
191+
comply with some requirements available here:
192+
https://pennylane-org.slack.com/archives/C04HEQLHDTQ/p1732882347125169?thread_ts=1732882100.984249&cid=C04HEQLHDTQ
193+
194+
- - :approve
195+
- rchardet
196+
- :why: >
197+
This is LGPL-2.1, a weak copyleft license that we can use as long as we
198+
comply with some requirements available here:
199+
https://pennylane-org.slack.com/archives/C04HEQLHDTQ/p1732882347125169?thread_ts=1732882100.984249&cid=C04HEQLHDTQ
200+
201+
- - :approve
202+
- epics
203+
- :why: >
204+
This is LGPL-2.1, a weak copyleft license that we can use as long as we
205+
comply with some requirements available here:
206+
https://pennylane-org.slack.com/archives/C04HEQLHDTQ/p1741249208399559

0 commit comments

Comments
 (0)