Skip to content

Commit 34b12bb

Browse files
lurtzlurtz
authored
chore: check copyright header with opengrep (#78)
1 parent c17061b commit 34b12bb

28 files changed

Lines changed: 449 additions & 4 deletions

‎.devcontainer/post_create_command.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,23 @@
11
#!/usr/bin/env bash
2+
3+
# *******************************************************************************
4+
# Copyright (c) 2026 Contributors to the Eclipse Foundation
5+
#
6+
# See the NOTICE file(s) distributed with this work for additional
7+
# information regarding copyright ownership.
8+
#
9+
# This program and the accompanying materials are made available under the
10+
# terms of the Apache License Version 2.0 which is available at
11+
# https://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# SPDX-License-Identifier: Apache-2.0
14+
# *******************************************************************************
15+
216
npm install -g @devcontainers/cli
317
pre-commit install
418

519
scripts/create_builder.sh
620

721
sudo apt-get update && sudo apt-get install -y shellcheck
22+
23+
scripts/install_opengrep.sh

‎.github/workflows/ci.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,18 @@
11
---
2+
3+
# *******************************************************************************
4+
# Copyright (c) 2026 Contributors to the Eclipse Foundation
5+
#
6+
# See the NOTICE file(s) distributed with this work for additional
7+
# information regarding copyright ownership.
8+
#
9+
# This program and the accompanying materials are made available under the
10+
# terms of the Apache License Version 2.0 which is available at
11+
# https://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# SPDX-License-Identifier: Apache-2.0
14+
# *******************************************************************************
15+
216
name: Validate DevContainer
317
description: This workflow is checking that updates do not break stuff. If on main branch, publish to "latest" tag.
418
on:
@@ -53,7 +67,7 @@ jobs:
5367
set -eux pipefail
5468
5569
# Check
56-
pre-commit run --show-diff-on-failure --color=always --all-files || exit -1
70+
pre-commit run --show-diff-on-failure --color=always --all-files || exit 1
5771
5872
# Create builder for multi-arch builds
5973
./scripts/create_builder.sh

‎.github/workflows/release.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,18 @@
11
---
2+
3+
# *******************************************************************************
4+
# Copyright (c) 2026 Contributors to the Eclipse Foundation
5+
#
6+
# See the NOTICE file(s) distributed with this work for additional
7+
# information regarding copyright ownership.
8+
#
9+
# This program and the accompanying materials are made available under the
10+
# terms of the Apache License Version 2.0 which is available at
11+
# https://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# SPDX-License-Identifier: Apache-2.0
14+
# *******************************************************************************
15+
216
name: Validate & Publish DevContainer
317
description: This workflow is checking that for releases, updates do not break stuff and publishes the released container.
418
on:
@@ -47,7 +61,7 @@ jobs:
4761
set -eux pipefail
4862
4963
# Check
50-
pre-commit run --show-diff-on-failure --color=always --all-files || exit -1
64+
pre-commit run --show-diff-on-failure --color=always --all-files || exit 1
5165
5266
# Create builder for multi-arch builds
5367
./scripts/create_builder.sh

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
# Exported image files shall never be committed.
22
/export.img
3+
build/

‎.pre-commit-config.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,11 @@ repos:
2020
rev: 38980559e3a605691d6579f96222c30778e5a69e # 3.0.0
2121
hooks:
2222
- id: shellcheck
23+
24+
- repo: local
25+
hooks:
26+
- id: opengrep
27+
name: Check Mandatory OpenGrep Rules
28+
entry: ./opengrep/run_opengrep.sh
29+
language: system
30+
pass_filenames: false

‎opengrep/mandatory/copyright.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
3+
# *******************************************************************************
4+
# Copyright (c) 2026 Contributors to the Eclipse Foundation
5+
#
6+
# See the NOTICE file(s) distributed with this work for additional
7+
# information regarding copyright ownership.
8+
#
9+
# This program and the accompanying materials are made available under the
10+
# terms of the Apache License Version 2.0 which is available at
11+
# https://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# SPDX-License-Identifier: Apache-2.0
14+
# *******************************************************************************
15+
16+
rules:
17+
- id: copyright_shell_yaml
18+
patterns:
19+
- pattern-regex: |
20+
(?s)(.*)
21+
- pattern-not-regex: (?m)^# \*{79}\n# Copyright \(c\) [0-9]{4} Contributors to the Eclipse Foundation\n#\n# See the NOTICE file\(s\) distributed with
22+
this work for additional\n# information regarding copyright ownership.\n#\n# This program and the accompanying materials are made available under
23+
the\n# terms of the Apache License Version 2.0 which is available at\n# https://www.apache.org/licenses/LICENSE-2.0\n#\n# SPDX-License-Identifier.
24+
Apache-2.0\n# \*{79}$
25+
message: All files must contain the mandatory copyright header.
26+
languages:
27+
- generic
28+
severity: ERROR
29+
paths:
30+
include:
31+
- '*.sh'
32+
- '*.yaml'
33+
- '*.yml'

‎opengrep/run_opengrep.sh‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/usr/bin/env bash
2+
3+
# *******************************************************************************
4+
# Copyright (c) 2026 Contributors to the Eclipse Foundation
5+
#
6+
# See the NOTICE file(s) distributed with this work for additional
7+
# information regarding copyright ownership.
8+
#
9+
# This program and the accompanying materials are made available under the
10+
# terms of the Apache License Version 2.0 which is available at
11+
# https://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# SPDX-License-Identifier: Apache-2.0
14+
# *******************************************************************************
15+
16+
set -exuo pipefail
17+
18+
# This script runs opengrep in such a way that it only works on the changeset that is to be checked
19+
# when running opengrep in the scope of a precommit hook.
20+
# The CI system runs the same script, but in that context no changeset exists, so all files are to
21+
# be checked. This also solves the problem that it is technically possible to work around the
22+
# precommit checks.
23+
24+
changeset="$(git diff --staged --diff-filter=ACM --name-only)"
25+
length="${#changeset}"
26+
if [[ ${length} -gt 2048 ]]; then
27+
# The changeset is too long, it would result in errors from opengrep/underlying OS about filenames
28+
# being too long. Workaround: ignore the changeset and run opengrep on all files.
29+
changeset=""
30+
fi
31+
if [[ -z "${changeset}" ]]; then
32+
# Limit concurrency to 2 threads to reduce memory consumption
33+
OPENGREP_MAX_CONCURRENCY="--jobs=1"
34+
# No changeset, run opengrep on all files
35+
changeset="."
36+
opengrep scan "${OPENGREP_MAX_CONCURRENCY}" --error --disable-version-check --skip-unknown-extensions --emacs --sarif-output=build/opengrep.sarif -f ./opengrep/mandatory/ "${changeset}"
37+
else
38+
# When changing ${changeset} to "${changeset}" it will break the script, ${changeset} actually contains *multiple* filenames
39+
# shellcheck disable=SC2086
40+
opengrep scan --error --disable-version-check --skip-unknown-extensions --emacs -f ./opengrep/mandatory/ ${changeset}
41+
fi

‎scripts/build.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,18 @@
11
#!/usr/bin/env bash
2+
3+
# *******************************************************************************
4+
# Copyright (c) 2026 Contributors to the Eclipse Foundation
5+
#
6+
# See the NOTICE file(s) distributed with this work for additional
7+
# information regarding copyright ownership.
8+
#
9+
# This program and the accompanying materials are made available under the
10+
# terms of the Apache License Version 2.0 which is available at
11+
# https://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# SPDX-License-Identifier: Apache-2.0
14+
# *******************************************************************************
15+
216
set -euxo pipefail
317

418
if [[ "$#" -lt 1 || "${1}" != "--arm64" && "${1}" != "--amd64" ]]; then

‎scripts/create_builder.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,18 @@
11
#!/usr/bin/env bash
2+
3+
# *******************************************************************************
4+
# Copyright (c) 2026 Contributors to the Eclipse Foundation
5+
#
6+
# See the NOTICE file(s) distributed with this work for additional
7+
# information regarding copyright ownership.
8+
#
9+
# This program and the accompanying materials are made available under the
10+
# terms of the Apache License Version 2.0 which is available at
11+
# https://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# SPDX-License-Identifier: Apache-2.0
14+
# *******************************************************************************
15+
216
set -euxo pipefail
317

418
# Function to check if builder has correct proxy configuration

‎scripts/install_opengrep.sh‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
# *******************************************************************************
6+
# Copyright (c) 2026 Contributors to the Eclipse Foundation
7+
#
8+
# See the NOTICE file(s) distributed with this work for additional
9+
# information regarding copyright ownership.
10+
#
11+
# This program and the accompanying materials are made available under the
12+
# terms of the Apache License Version 2.0 which is available at
13+
# https://www.apache.org/licenses/LICENSE-2.0
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# *******************************************************************************
17+
18+
echo "installing opengrep..."
19+
20+
OPENGREP_NAME="/tmp/opengrep"
21+
22+
VERSION="1.15.1"
23+
24+
ARCHITECTURE="$(uname -m)"
25+
if [ "${ARCHITECTURE}" = "x86_64" ]; then
26+
ARCH="x86"
27+
SHA256SUM="c4f6aab1edc8130c7a46e8f5e5215763420740fb94198fc9301215135a372900"
28+
else
29+
ARCH="aarch64"
30+
SHA256SUM="08932db32f4cbfd6e3af6bda82adac41754275d18a91c0fe065181e6a5291be7"
31+
fi
32+
33+
curl -L "https://github.com/opengrep/opengrep/releases/download/v${VERSION}/opengrep_manylinux_${ARCH}" -o /tmp/opengrep
34+
echo "${SHA256SUM} /tmp/opengrep" | sha256sum -c - || exit 1
35+
chmod +x "${OPENGREP_NAME}"
36+
sudo mv /tmp/opengrep /usr/local/bin/opengrep
37+
38+
# Verify installation
39+
opengrep --version

0 commit comments

Comments
 (0)