roost.tools
Mirrored from GitHub
github.com/roostorg/osprey
ci: create license-check workflows (#340)
author
Cassidy James
committer
GitHub
date
(Jun 23, 2026, 2:07 PM -0600)
commit
51a36db0
51a36db044b1fc8a2e303e6920d2f03241021a50
parent
234f515d
234f515d47a6d1b7cc3b381e966dc73fdf8bb8d1
+156
+15
.github/allowed-licenses.txt
+15
.github/allowed-licenses.txt
+15
.github/pip-licenses-classifiers.txt
+15
.github/pip-licenses-classifiers.txt
···
1
+
Apache Software License
2
+
Apache 2.0
3
+
Apache License 2.0
4
+
BSD License
5
+
BSD
6
+
3-Clause BSD License
7
+
BSD License; Public Domain
8
+
Apache Software License; BSD License
9
+
MIT License
10
+
Mozilla Public License 2.0 (MPL 2.0)
11
+
ISC License (ISCL)
12
+
CC0 1.0 Universal (CC0 1.0) Public Domain Dedication
13
+
Python Software Foundation License
14
+
Apache-2.0 OR BSD-2-Clause
15
+
BSD 3-Clause OR Apache-2.0
+35
.github/workflows/license-check-node.yml
+35
.github/workflows/license-check-node.yml
···
1
+
name: License Check (Node)
2
+
on:
3
+
pull_request:
4
+
branches: [main]
5
+
paths:
6
+
- 'osprey_ui/package.json'
7
+
- 'osprey_ui/pnpm-lock.yaml'
8
+
- '.github/allowed-licenses.txt'
9
+
permissions:
10
+
contents: read
11
+
jobs:
12
+
check:
13
+
runs-on: ubuntu-24.04
14
+
steps:
15
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
16
+
with:
17
+
persist-credentials: false
18
+
- run: corepack enable pnpm
19
+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
20
+
with:
21
+
node-version: "22"
22
+
23
+
- name: Format license list
24
+
run: |
25
+
SPDX=$(tr '\n' ';' < .github/allowed-licenses.txt | sed 's/;$//')
26
+
# highcharts uses a custom proprietary license; allowed for now pending #319
27
+
echo "ALLOWED_LICENSES=${SPDX};Custom: https://www.npmjs.com/package/highcharts-export-server" >> "$GITHUB_ENV"
28
+
29
+
- name: Install dependencies
30
+
working-directory: osprey_ui
31
+
run: pnpm install --prod --frozen-lockfile --ignore-scripts
32
+
33
+
- name: Check licenses
34
+
working-directory: osprey_ui
35
+
run: pnpm dlx license-checker@25.0.1 --production --excludePrivatePackages --onlyAllow "$ALLOWED_LICENSES"
+60
.github/workflows/license-check-python.yml
+60
.github/workflows/license-check-python.yml
···
1
+
name: License Check (Python)
2
+
on:
3
+
pull_request:
4
+
branches: [main]
5
+
paths:
6
+
- 'pyproject.toml'
7
+
- 'uv.lock'
8
+
- 'osprey_rpc/pyproject.toml'
9
+
- 'osprey_worker/pyproject.toml'
10
+
- 'example_plugins/pyproject.toml'
11
+
- '.github/allowed-licenses.txt'
12
+
- '.github/pip-licenses-classifiers.txt'
13
+
permissions:
14
+
contents: read
15
+
jobs:
16
+
check:
17
+
runs-on: ubuntu-24.04
18
+
steps:
19
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
20
+
with:
21
+
persist-credentials: false
22
+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
23
+
with:
24
+
python-version-file: .python-version
25
+
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
26
+
27
+
- name: Format license list
28
+
run: |
29
+
# pip-licenses reports PyPI classifier names rather than SPDX IDs for some packages.
30
+
# allowed-licenses.txt is the policy (SPDX); pip-licenses-classifiers.txt is the translation layer.
31
+
SPDX=$(tr '\n' ';' < .github/allowed-licenses.txt | sed 's/;$//')
32
+
CLASSIFIERS=$(tr '\n' ';' < .github/pip-licenses-classifiers.txt | sed 's/;$//')
33
+
echo "ALLOWED_LICENSES=${SPDX};${CLASSIFIERS}" >> "$GITHUB_ENV"
34
+
35
+
- name: Install production dependencies
36
+
run: uv sync --only-group common
37
+
38
+
- name: Install pip-licenses
39
+
run: uv pip install pip-licenses==5.5.5
40
+
41
+
- name: Check licenses
42
+
run: |
43
+
# Packages ignored due to broken/missing PyPI metadata (license is known and approved):
44
+
# google-crc32c: Apache-2.0; no metadata in 1.8.0 (googleapis/google-cloud-python#16515)
45
+
# ddtrace: Apache-2.0 OR BSD-3-Clause; sets License field to a filename ("LICENSE.BSD3")
46
+
# First-party packages (no license metadata needed):
47
+
# osprey-rpc, osprey-worker, example_plugins
48
+
# Packages pending license policy review:
49
+
# unidecode: GPL v2+ (#354)
50
+
# tld: GPL v2 / LGPL / MPL 1.1 (#355)
51
+
# nostril: LGPL 2.1 (#356)
52
+
# psycopg2-binary: LGPL (#357)
53
+
# simplejson: Academic Free License + MIT (#358)
54
+
# text-unidecode: Artistic + GPL (transitive via faker) (#359)
55
+
uv run pip-licenses --allow-only "$ALLOWED_LICENSES" \
56
+
--ignore-packages \
57
+
google-crc32c \
58
+
ddtrace \
59
+
osprey-rpc osprey-worker example_plugins \
60
+
unidecode tld nostril psycopg2-binary simplejson text-unidecode
+26
.github/workflows/license-check-rust.yml
+26
.github/workflows/license-check-rust.yml
···
1
+
name: License Check (Rust)
2
+
on:
3
+
pull_request:
4
+
branches: [main]
5
+
paths:
6
+
- 'osprey_coordinator/**/Cargo.toml'
7
+
- '.github/allowed-licenses.txt'
8
+
permissions:
9
+
contents: read
10
+
jobs:
11
+
check:
12
+
runs-on: ubuntu-24.04
13
+
steps:
14
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
15
+
with:
16
+
persist-credentials: false
17
+
18
+
- name: Generate deny.toml
19
+
run: |
20
+
{ echo '[licenses]'; echo 'allow = ['; sed 's/.*/"&",/' .github/allowed-licenses.txt; echo ']'; } \
21
+
> osprey_coordinator/deny.toml
22
+
23
+
- uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20
24
+
with:
25
+
command: check licenses
26
+
manifest-path: osprey_coordinator/Cargo.toml
+1
osprey_coordinator/Cargo.toml
+1
osprey_coordinator/Cargo.toml
+2
osprey_coordinator/etcd_config_derive/Cargo.toml
+2
osprey_coordinator/etcd_config_derive/Cargo.toml