Skip to content

Commit aeec793

Browse files
carlos-almcarlos-alm
authored
Merge pull request #10 from optave/ci/shield-license-compliance
ci: add license compliance workflow and CI Testing Pipeline gate
2 parents cb08bb5 + eeeb68b commit aeec793

File tree

3 files changed

+144
-1
lines changed

3 files changed

+144
-1
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,3 +68,16 @@ jobs:
6868

6969
- name: Check compilation
7070
run: cargo check --workspace
71+
72+
ci-pipeline:
73+
if: always()
74+
needs: [lint, test, rust-check]
75+
runs-on: ubuntu-latest
76+
name: CI Testing Pipeline
77+
steps:
78+
- name: Check results
79+
run: |
80+
if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
81+
echo "One or more CI jobs failed or were cancelled."
82+
exit 1
83+
fi

‎.github/workflows/shield-license-compliance.yml‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
name: "[SHIELD] Open Source Licenses"
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- "package.json"
8+
- "package-lock.json"
9+
pull_request:
10+
branches: [main]
11+
paths:
12+
- "package.json"
13+
- "package-lock.json"
14+
workflow_dispatch:
15+
schedule:
16+
- cron: "0 3 * * 1" # Weekly on Monday at 3 AM
17+
18+
jobs:
19+
os-license:
20+
name: License Compliance Scan
21+
permissions:
22+
contents: read
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: Checkout code
26+
uses: actions/checkout@v6
27+
28+
- name: Setup Node.js
29+
uses: actions/setup-node@v6
30+
with:
31+
node-version: "22"
32+
cache: "npm"
33+
34+
- name: Install dependencies
35+
run: npm ci --prefer-offline --no-audit --no-fund
36+
37+
- name: Install license-checker
38+
run: npm install -g license-checker
39+
40+
- name: Create reports directory
41+
run: mkdir -p license-reports
42+
43+
- name: Run license check (allowlist)
44+
id: allowlist
45+
continue-on-error: true
46+
run: |
47+
license-checker \
48+
--onlyAllow 'MIT;BSD-2-Clause;BSD-3-Clause;Apache-2.0;ISC;CC0-1.0;Unlicense;WTFPL;0BSD;CC-BY-3.0;CC-BY-4.0;BlueOak-1.0.0;Python-2.0' \
49+
--summary | tee license-reports/allowlist-check.txt
50+
51+
- name: Generate JSON report
52+
run: license-checker --json > license-reports/licenses.json
53+
54+
- name: Generate CSV report
55+
run: license-checker --csv --out license-reports/licenses.csv
56+
57+
- name: Analyze results
58+
run: |
59+
report="license-reports/licenses.json"
60+
total=$(jq 'keys | length' "$report")
61+
62+
echo "## License Compliance Results" >> $GITHUB_STEP_SUMMARY
63+
echo "" >> $GITHUB_STEP_SUMMARY
64+
echo "- **Total dependencies scanned**: $total" >> $GITHUB_STEP_SUMMARY
65+
echo "- **Scan date**: $(date -u '+%Y-%m-%d %H:%M:%S UTC')" >> $GITHUB_STEP_SUMMARY
66+
echo "" >> $GITHUB_STEP_SUMMARY
67+
68+
# Show license distribution
69+
echo "### License Distribution" >> $GITHUB_STEP_SUMMARY
70+
echo '```' >> $GITHUB_STEP_SUMMARY
71+
jq -r '[.[] | .licenses // "Unknown"] | group_by(.) | map({license: .[0], count: length}) | sort_by(-.count) | .[] | "\(.count) x \(.license)"' "$report" >> $GITHUB_STEP_SUMMARY
72+
echo '```' >> $GITHUB_STEP_SUMMARY
73+
echo "" >> $GITHUB_STEP_SUMMARY
74+
75+
# Check for restrictive licenses
76+
restrictive=$(jq -r 'to_entries[] | select(.value.licenses | test("GPL|AGPL|LGPL|SSPL|BSL"; "i")) | "- **\(.key)**: \(.value.licenses)"' "$report" 2>/dev/null || true)
77+
78+
if [ -n "$restrictive" ]; then
79+
echo "### Restrictive Licenses Found" >> $GITHUB_STEP_SUMMARY
80+
echo "" >> $GITHUB_STEP_SUMMARY
81+
echo "$restrictive" >> $GITHUB_STEP_SUMMARY
82+
echo "" >> $GITHUB_STEP_SUMMARY
83+
84+
echo "### License Restrictions Guide" >> $GITHUB_STEP_SUMMARY
85+
echo "" >> $GITHUB_STEP_SUMMARY
86+
87+
if echo "$restrictive" | grep -qi "AGPL\|GPL-[23]"; then
88+
echo "#### RED - GPL/AGPL" >> $GITHUB_STEP_SUMMARY
89+
echo "- Must release ALL source code under GPL/AGPL if distributed" >> $GITHUB_STEP_SUMMARY
90+
echo "- AGPL extends to network/SaaS use" >> $GITHUB_STEP_SUMMARY
91+
echo "- **Action**: Replace with MIT/BSD/Apache alternatives" >> $GITHUB_STEP_SUMMARY
92+
echo "" >> $GITHUB_STEP_SUMMARY
93+
fi
94+
95+
if echo "$restrictive" | grep -qi "LGPL"; then
96+
echo "#### CAUTION - LGPL" >> $GITHUB_STEP_SUMMARY
97+
echo "- Must provide source of LGPL components (not entire app)" >> $GITHUB_STEP_SUMMARY
98+
echo "- Users must be able to replace LGPL components" >> $GITHUB_STEP_SUMMARY
99+
echo "- **Action**: Review compliance requirements or replace" >> $GITHUB_STEP_SUMMARY
100+
echo "" >> $GITHUB_STEP_SUMMARY
101+
fi
102+
103+
if echo "$restrictive" | grep -qi "SSPL\|BSL"; then
104+
echo "#### RED - SSPL/BSL" >> $GITHUB_STEP_SUMMARY
105+
echo "- Cannot offer as a service without releasing infrastructure code" >> $GITHUB_STEP_SUMMARY
106+
echo "- **Action**: Replace if offering SaaS/cloud services" >> $GITHUB_STEP_SUMMARY
107+
echo "" >> $GITHUB_STEP_SUMMARY
108+
fi
109+
110+
# Save issues summary
111+
echo "# Restrictive Licenses Found" > license-reports/issues-summary.md
112+
echo "" >> license-reports/issues-summary.md
113+
echo "$restrictive" >> license-reports/issues-summary.md
114+
115+
echo "FAILURE: Restrictive licenses found in dependencies"
116+
exit 1
117+
else
118+
echo "### All Clear" >> $GITHUB_STEP_SUMMARY
119+
echo "All dependencies use permissive licenses (MIT, BSD, Apache, ISC, etc.)" >> $GITHUB_STEP_SUMMARY
120+
echo "" >> $GITHUB_STEP_SUMMARY
121+
echo "All dependencies use acceptable licenses"
122+
fi
123+
124+
- name: Upload license reports
125+
uses: actions/upload-artifact@v5
126+
with:
127+
name: license-compliance-reports
128+
path: license-reports/
129+
retention-days: 90
130+
if: always()

‎docs/admin-guide.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ Go to **Settings > Branches > Add branch protection rule** for `main`:
1515
| Required approvals | 1 |
1616
| Dismiss stale pull request approvals when new commits are pushed | Yes |
1717
| Require status checks to pass before merging | Yes |
18-
| Required status checks | `Preflight checks` (CI), `Lint` (CI), `Validate commits` (Commitlint), `Validate branch name` (Commitlint) |
18+
| Required status checks | `CI Testing Pipeline` (CI), `Lint` (CI), `Validate commits` (Commitlint), `Validate branch name` (Commitlint), `License Compliance Scan` (SHIELD) |
1919
| Require branches to be up to date before merging | Yes |
2020
| Require conversation resolution before merging | Yes |
2121
| Restrict who can push to matching branches | Optional (recommended for teams) |

0 commit comments

Comments
 (0)