ci: add Go dependency license check workflow#6334
ci: add Go dependency license check workflow#6334ivankatliarchuk wants to merge 14 commits intokubernetes-sigs:masterfrom
Conversation
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
github_actions
k8s-ci-robot
added
size/M
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
Pull Request Test Coverage Report for Build 23889183866Details
💛 - Coveralls |
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
k8s-ci-robot
added
size/L
| excludes: | ||
| - name: github.com/hashicorp/errwrap | ||
| - name: github.com/hashicorp/go-cleanhttp | ||
| - name: github.com/hashicorp/go-multierror | ||
| - name: github.com/hashicorp/go-retryablehttp | ||
| - name: github.com/hashicorp/go-uuid |
There was a problem hiding this comment.
without this
ERROR the following licenses are unknown or incompatible with the main license, please check manually: Apache-2.0
Dependency | License
------------------------------------- | -------
github.com/hashicorp/errwrap | MPL-2.0
github.com/hashicorp/go-cleanhttp | MPL-2.0
github.com/hashicorp/go-multierror | MPL-2.0
github.com/hashicorp/go-retryablehttp | MPL-2.0
github.com/hashicorp/go-uuid | MPL-2.0
ERROR one or more errors occurred checking license compatibility
Error: Process completed with exit code 1.
There was a problem hiding this comment.
AFAIR, MPL & Apache 2.0 licenses are not “incompatible”. See here for instance. MPL requires adding a third-party file referencing the author of the deps that is used.
But maybe I missed something. Would you please detail this incompatiblity?
There was a problem hiding this comment.
I'm just making things visible. Here is the rule https://github.com/apache/skywalking-eyes/blob/main/assets/compatibility/Apache-2.0.yaml
This is an official apache project - it could have bugs, is not that I've decided ;-)
Explanation, there is weak compatibility. so I manually excluded them from check.
There was a problem hiding this comment.
I think weak compatibility is treated as incompatible and require manual exclusions.
There was a problem hiding this comment.
I think the tool capture correctly weak compability
On the same page https://licensecheck.io/licenses
There was a problem hiding this comment.
🤔 Wdyt of using -w flags instead of this exclusion list?
There was a problem hiding this comment.
Moved to -w. I kinda don't think this is the right approach. Better to make it visible but really no difference. As long is green is fine.
There was a problem hiding this comment.
I kinda don't think this is the right approach.
Then please revert and keep the explicit list. I do not have a strong opinion on that.
There was a problem hiding this comment.
I spend some time. You are correct. If we exclude, this will not catch licence change. So lets keep -w
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
k8s-ci-robot
added
size/M
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
Co-authored-by: Michel Loiseleur <97035654+mloiseleur@users.noreply.github.com>
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
…rkflow' into ci/license-check-workflow * refs/remotes/origin/ci/license-check-workflow: ci: add Go dependency license check workflow
|
|
||
| dependency: | ||
| files: | ||
| - go.mod |
There was a problem hiding this comment.
Shouldn't there is also the go.tool.mod?
Or should the go.tool.mod be removed for the gh action trigger?
There was a problem hiding this comment.
I will add go.tool.mod support to the upstream. At the moment it does not support
There was a problem hiding this comment.
Co-authored-by: Michel Loiseleur <97035654+mloiseleur@users.noreply.github.com>
|
@ivankatliarchuk there is official guidance from the kubernetes project on this topic, I will research and post it to you. Let's hold this PR. |
|
Ok /hold |
|
/hold |
k8s-ci-robot
added
the
do-not-merge/hold
|
Here's some very old context: kubernetes/kubernetes#108942 This is the periodic build for kubernetes/kubernetes: https://testgrid.k8s.io/sig-testing-misc#kubernetes-verify-go-licenses-periodical . I think the script is https://github.com/kubernetes/kubernetes/blob/master/hack/verify-licenses.sh . The approved licenses are in https://github.com/cncf/foundation/blob/main/policies-guidance/allowed-third-party-license-policy.md and notably contain exceptions. I think the test infra still doesn't have something that scans all repos so we are a bit on our own. |
|
So do you want to use the script provided? It uses This is why I though apache/skywalking-eyes is good enough aka from apache foundation. I could try to open an issue on prow aka create a plugin |
|
Yeah I think we might as well roll our own, as long that we do follow all the approvals in https://github.com/cncf/foundation/blob/main/policies-guidance/allowed-third-party-license-policy.md . We also generally should not add anything new ever, if anything, remove dependencies as we delete more providers. |
5 participants
What does it do ?
Currently there is no automated check exists to catch incompatible licenses when dependencies are added or updated.
Example RUN https://github.com/kubernetes-sigs/external-dns/actions/runs/23844817593/job/69509373373
Motivation
Example dependency leaked with wrong licence #5955
More
Current licences
I was using go install github.com/google/go-licenses/v2, but looks like the tool is not longer maintained