Skip to content

Commit 951f7ff

Browse files
cmagliecmaglie
authored
Adding licensed checks (#2841)
* Added licensed configuration files and scripts * First run of licensed * Manually reviewed a bunch of lincenses * Reviewed all Theia packages * Added licensed check workflow * Do not download go version in workflow Since this project do not use go, we don't need it, and we can install Task directly. * Added project-specific native dependencies
1 parent 2f68013 commit 951f7ff

File tree

1,030 files changed

+40580
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,030 files changed

+40580
-0
lines changed

‎.github/workflows/check-npm-dependencies-task.yml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-npm-dependencies-task.md
2+
name: Check npm Dependencies
3+
4+
# See: https://docs.github.com/actions/reference/workflows-and-actions/events-that-trigger-workflows
5+
on:
6+
create:
7+
push:
8+
paths:
9+
- ".github/workflows/check-npm-dependencies-task.ya?ml"
10+
- ".licenses/**"
11+
- ".licensed.json"
12+
- ".licensed.ya?ml"
13+
- ".npmrc"
14+
- "Taskfile.ya?ml"
15+
- "**/.gitmodules"
16+
- "**/package.json"
17+
- "**/package-lock.json"
18+
pull_request:
19+
paths:
20+
- ".github/workflows/check-npm-dependencies-task.ya?ml"
21+
- ".licenses/**"
22+
- ".npmrc"
23+
- ".licensed.json"
24+
- ".licensed.ya?ml"
25+
- "Taskfile.ya?ml"
26+
- "**/.gitmodules"
27+
- "**/package.json"
28+
- "**/package-lock.json"
29+
schedule:
30+
# Run periodically to catch breakage caused by external changes.
31+
- cron: "0 8 * * WED"
32+
workflow_dispatch:
33+
repository_dispatch:
34+
35+
jobs:
36+
run-determination:
37+
runs-on: ubuntu-latest
38+
permissions: {}
39+
outputs:
40+
result: ${{ steps.determination.outputs.result }}
41+
steps:
42+
- name: Determine if the rest of the workflow should run
43+
id: determination
44+
run: |
45+
RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
46+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
47+
if [[
48+
"${{ github.event_name }}" != "create" ||
49+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
50+
]]; then
51+
# Run the other jobs.
52+
RESULT="true"
53+
else
54+
# There is no need to run the other jobs.
55+
RESULT="false"
56+
fi
57+
58+
echo "result=$RESULT" >>$GITHUB_OUTPUT
59+
60+
check-cache:
61+
needs: run-determination
62+
if: needs.run-determination.outputs.result == 'true'
63+
runs-on: ubuntu-latest
64+
permissions:
65+
contents: read
66+
67+
steps:
68+
- name: Checkout repository
69+
uses: actions/checkout@v6
70+
with:
71+
submodules: recursive
72+
73+
# This is required to allow licensee/setup-licensed to install licensed via Ruby gem.
74+
- name: Install Ruby
75+
uses: ruby/setup-ruby@v1
76+
with:
77+
ruby-version: ruby # Install latest version
78+
79+
- name: Install licensed
80+
uses: licensee/[email protected]
81+
with:
82+
github_token: ${{ secrets.GITHUB_TOKEN }}
83+
version: 5.x
84+
85+
- name: Install Task
86+
uses: go-task/setup-task@v1
87+
88+
- name: Setup Node.js
89+
uses: actions/setup-node@v6
90+
with:
91+
node-version-file: package.json
92+
93+
- name: Install project dependencies
94+
run: sudo apt update -y && sudo apt install -y libxkbfile-dev libsecret-1-dev
95+
96+
- name: Update dependencies license metadata cache
97+
run: task --silent general:cache-dep-licenses
98+
99+
- name: Check for outdated cache
100+
id: diff
101+
run: |
102+
git add .
103+
if
104+
! git diff \
105+
--cached \
106+
--color \
107+
--exit-code
108+
then
109+
echo
110+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
111+
exit 1
112+
fi
113+
114+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
115+
- name: Upload cache to workflow artifact
116+
if: failure() && steps.diff.outcome == 'failure'
117+
uses: actions/upload-artifact@v6
118+
with:
119+
if-no-files-found: error
120+
include-hidden-files: true
121+
name: dep-licenses-cache
122+
path: .licenses/
123+
124+
check-deps:
125+
needs: run-determination
126+
if: needs.run-determination.outputs.result == 'true'
127+
runs-on: ubuntu-latest
128+
permissions:
129+
contents: read
130+
131+
steps:
132+
- name: Checkout repository
133+
uses: actions/checkout@v6
134+
with:
135+
submodules: recursive
136+
137+
# This is required to allow licensee/setup-licensed to install licensed via Ruby gem.
138+
- name: Install Ruby
139+
uses: ruby/setup-ruby@v1
140+
with:
141+
ruby-version: ruby # Install latest version
142+
143+
- name: Install licensed
144+
uses: licensee/[email protected]
145+
with:
146+
github_token: ${{ secrets.GITHUB_TOKEN }}
147+
version: 5.x
148+
149+
- name: Install Task
150+
uses: go-task/setup-task@v1
151+
152+
- name: Setup Node.js
153+
uses: actions/setup-node@v6
154+
with:
155+
node-version-file: package.json
156+
157+
- name: Install project dependencies
158+
run: sudo apt update -y && sudo apt install -y libxkbfile-dev libsecret-1-dev
159+
160+
- name: Check for dependencies with unapproved licenses
161+
run: task --silent general:check-dep-licenses

‎.licensed.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# See: https://github.com/licensee/licensed/blob/main/docs/configuration.md
2+
3+
sources:
4+
npm: true
5+
6+
ignored:
7+
npm:
8+
- arduino-ide-extension # this is a project in this repo
9+
- electron-app # this is a project in this repo
10+
11+
# The following packages have some optional (architecutre native) packages.
12+
- "@msgpackr-extract/msgpackr-extract-**" # ignored in favor of parent package "msgpackr-extract"
13+
- "@parcel/watcher-**" # ignored in favor of parent package "@parcel-watcher"
14+
- "@vscode/windows-ca-certs" # BSD license (https://www.npmjs.com/package/@vscode/windows-ca-certs)
15+
16+
- "@theia/test" # missing license file in package, epl-2.0 license
17+
- buffers # missing license file in package, mit license (https://sources.debian.org/copyright/license/node-buffers/0.1.1-2/)
18+
- chainsaw # missing license file in package, mit license (https://www.npmjs.com/package/chainsaw)
19+
20+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/AGPL-3.0/.licensed.yml
21+
allowed:
22+
- gpl-1.0-or-later
23+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
24+
- gpl-2.0-or-later
25+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
26+
- gpl-3.0-only
27+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
28+
- gpl-3.0-or-later
29+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
30+
- lgpl-2.0-or-later
31+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
32+
- lgpl-2.1-only
33+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
34+
- lgpl-2.1-or-later
35+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
36+
- lgpl-3.0-only
37+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
38+
- lgpl-3.0-or-later
39+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
40+
- agpl-1.0-or-later
41+
- agpl-3.0-only
42+
- agpl-3.0 # Deprecated ID for `agpl-3.0-only`
43+
- agpl-3.0-or-later
44+
- apache-2.0
45+
- mit
46+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
47+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
48+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
49+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
50+
- bsd-3-clause
51+
- bsd-3-clause-clear
52+
- isc
53+
- cc0-1.0
54+
- unlicense
55+
56+
- epl-2.0 # https://interoperable-europe.ec.europa.eu/licence/compatibility-check/EPL-2.0/AGPL-3.0-only
57+
- 0bsd # https://interoperable-europe.ec.europa.eu/licence/compatibility-check/0bsd/AGPL-3.0-only
58+
- CC-BY-4.0 # https://interoperable-europe.ec.europa.eu/licence/compatibility-check/CC-BY-4.0/AGPL-3.0-only
59+
- blueoak-1.0.0
60+
- Python-2.0
61+
- OFL-1.1

‎.licenses/npm/@babel/code-frame.dep.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
name: "@babel/code-frame"
3+
version: 7.26.2
4+
type: npm
5+
summary: Generate errors that contain a code frame that point to source locations.
6+
homepage: https://babel.dev/docs/en/next/babel-code-frame
7+
license: mit
8+
licenses:
9+
- sources: LICENSE
10+
text: |
11+
MIT License
12+
13+
Copyright (c) 2014-present Sebastian McKenzie and other contributors
14+
15+
Permission is hereby granted, free of charge, to any person obtaining
16+
a copy of this software and associated documentation files (the
17+
"Software"), to deal in the Software without restriction, including
18+
without limitation the rights to use, copy, modify, merge, publish,
19+
distribute, sublicense, and/or sell copies of the Software, and to
20+
permit persons to whom the Software is furnished to do so, subject to
21+
the following conditions:
22+
23+
The above copyright notice and this permission notice shall be
24+
included in all copies or substantial portions of the Software.
25+
26+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
27+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
28+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
29+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
30+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
31+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
32+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
33+
notices: []

‎.licenses/npm/@babel/generator.dep.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
name: "@babel/generator"
3+
version: 7.26.10
4+
type: npm
5+
summary: Turns an AST into code.
6+
homepage: https://babel.dev/docs/en/next/babel-generator
7+
license: mit
8+
licenses:
9+
- sources: LICENSE
10+
text: |
11+
MIT License
12+
13+
Copyright (c) 2014-present Sebastian McKenzie and other contributors
14+
15+
Permission is hereby granted, free of charge, to any person obtaining
16+
a copy of this software and associated documentation files (the
17+
"Software"), to deal in the Software without restriction, including
18+
without limitation the rights to use, copy, modify, merge, publish,
19+
distribute, sublicense, and/or sell copies of the Software, and to
20+
permit persons to whom the Software is furnished to do so, subject to
21+
the following conditions:
22+
23+
The above copyright notice and this permission notice shall be
24+
included in all copies or substantial portions of the Software.
25+
26+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
27+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
28+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
29+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
30+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
31+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
32+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
33+
notices: []

‎.licenses/npm/@babel/helper-module-imports.dep.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
name: "@babel/helper-module-imports"
3+
version: 7.25.9
4+
type: npm
5+
summary: Babel helper functions for inserting module loads
6+
homepage: https://babel.dev/docs/en/next/babel-helper-module-imports
7+
license: mit
8+
licenses:
9+
- sources: LICENSE
10+
text: |
11+
MIT License
12+
13+
Copyright (c) 2014-present Sebastian McKenzie and other contributors
14+
15+
Permission is hereby granted, free of charge, to any person obtaining
16+
a copy of this software and associated documentation files (the
17+
"Software"), to deal in the Software without restriction, including
18+
without limitation the rights to use, copy, modify, merge, publish,
19+
distribute, sublicense, and/or sell copies of the Software, and to
20+
permit persons to whom the Software is furnished to do so, subject to
21+
the following conditions:
22+
23+
The above copyright notice and this permission notice shall be
24+
included in all copies or substantial portions of the Software.
25+
26+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
27+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
28+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
29+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
30+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
31+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
32+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
33+
notices: []

‎.licenses/npm/@babel/helper-string-parser.dep.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
name: "@babel/helper-string-parser"
3+
version: 7.25.9
4+
type: npm
5+
summary: A utility package to parse strings
6+
homepage: https://babel.dev/docs/en/next/babel-helper-string-parser
7+
license: mit
8+
licenses:
9+
- sources: LICENSE
10+
text: |
11+
MIT License
12+
13+
Copyright (c) 2014-present Sebastian McKenzie and other contributors
14+
15+
Permission is hereby granted, free of charge, to any person obtaining
16+
a copy of this software and associated documentation files (the
17+
"Software"), to deal in the Software without restriction, including
18+
without limitation the rights to use, copy, modify, merge, publish,
19+
distribute, sublicense, and/or sell copies of the Software, and to
20+
permit persons to whom the Software is furnished to do so, subject to
21+
the following conditions:
22+
23+
The above copyright notice and this permission notice shall be
24+
included in all copies or substantial portions of the Software.
25+
26+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
27+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
28+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
29+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
30+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
31+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
32+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
33+
notices: []

‎.licenses/npm/@babel/helper-validator-identifier.dep.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
name: "@babel/helper-validator-identifier"
3+
version: 7.25.9
4+
type: npm
5+
summary: Validate identifier/keywords name
6+
homepage:
7+
license: mit
8+
licenses:
9+
- sources: LICENSE
10+
text: |
11+
MIT License
12+
13+
Copyright (c) 2014-present Sebastian McKenzie and other contributors
14+
15+
Permission is hereby granted, free of charge, to any person obtaining
16+
a copy of this software and associated documentation files (the
17+
"Software"), to deal in the Software without restriction, including
18+
without limitation the rights to use, copy, modify, merge, publish,
19+
distribute, sublicense, and/or sell copies of the Software, and to
20+
permit persons to whom the Software is furnished to do so, subject to
21+
the following conditions:
22+
23+
The above copyright notice and this permission notice shall be
24+
included in all copies or substantial portions of the Software.
25+
26+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
27+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
28+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
29+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
30+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
31+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
32+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
33+
notices: []

0 commit comments

Comments
 (0)