Skip to content

Commit 44bbc0f

Browse files
matbmosermatbmoser
authored
Merge pull request #51 from CDiezRodriguez/feat/add-Dash-License
feat: Add Dependencies-Check workflow
2 parents 8b28770 + b1fba98 commit 44bbc0f

File tree

4 files changed

+127
-30
lines changed

4 files changed

+127
-30
lines changed

‎.github/workflows/dependencies-backend.yml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
###############################################################
2+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
3+
#
4+
# See the NOTICE file(s) distributed with this work for additional
5+
# information regarding copyright ownership.
6+
#
7+
# This program and the accompanying materials are made available under the
8+
# terms of the Apache License, Version 2.0 which is available at
9+
# https://www.apache.org/licenses/LICENSE-2.0.
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
#
17+
# SPDX-License-Identifier: Apache-2.0
18+
###############################################################
19+
20+
name: "Eclipse DASH IP Check"
21+
22+
on:
23+
push:
24+
branches: [main]
25+
paths:
26+
- ichub-backend/requirements.txt
27+
- DEPENDENCIES_ICHUB-BACKEND
28+
- .github/workflows/dependencies-backend.yml
29+
pull_request:
30+
branches: [main]
31+
paths:
32+
- ichub-backend/requirements.txt
33+
- DEPENDENCIES_ICHUB-BACKEND
34+
- .github/workflows/dependencies-backend.yml
35+
workflow_dispatch:
36+
37+
jobs:
38+
check-dependencies-backend:
39+
runs-on: ubuntu-latest
40+
strategy:
41+
matrix:
42+
folder: [ichub-backend]
43+
44+
steps:
45+
46+
- name: Checkout repository
47+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
48+
49+
- name: Set up JDK 21
50+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
51+
with:
52+
distribution: 'temurin'
53+
java-version: '21'
54+
55+
- name: Set up Python
56+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
57+
with:
58+
python-version: '3.10'
59+
60+
- name: Create and activate virtual environment
61+
run: |
62+
python -m venv ${{ matrix.folder }}/venv
63+
source ${{ matrix.folder }}/venv/bin/activate
64+
echo "VIRTUAL_ENV=${{ matrix.folder }}/venv" >> $GITHUB_ENV
65+
echo "PATH=${{ matrix.folder }}/venv/bin:$PATH" >> $GITHUB_ENV
66+
67+
- name: Install dependencies in isolated environment
68+
run: |
69+
source ${{ matrix.folder }}/venv/bin/activate
70+
if [ -f ${{ matrix.folder }}/requirements.txt ]; then
71+
pip install -r ${{ matrix.folder }}/requirements.txt
72+
else
73+
echo "No requirements.txt found in ${{ matrix.folder }}, skipping..."
74+
fi
75+
76+
- name: List packages
77+
run: |
78+
source ${{ matrix.folder }}/venv/bin/activate
79+
pip list --format=freeze | grep -Pv "^(pip|setuptools|wheel|virtualenv|distlib|pkg_resources)" | awk -F'==' '{print "pypi/pypi/-/" $1 "/" $2}' | awk '!seen[$0]++' > ${{ matrix.folder }}/PACKAGE
80+
81+
- name: Generate Dependencies file
82+
run: |
83+
curl -L --output ./org.eclipse.dash.licenses-1.1.1.jar 'https://repo.eclipse.org/service/local/artifact/maven/redirect?r=dash-licenses&g=org.eclipse.dash&a=org.eclipse.dash.licenses&v=LATEST'
84+
85+
if [[ "${{ matrix.folder }}" == "ichub-backend" ]]; then
86+
DEP_FILE="DEPENDENCIES_ICHUB-BACKEND"
87+
fi
88+
89+
echo "DEP_FILE=$DEP_FILE" >> $GITHUB_ENV
90+
91+
java -jar ./org.eclipse.dash.licenses-1.1.1.jar ${{ matrix.folder }}/PACKAGE -project automotive.tractusx -summary $DEP_FILE || true
92+
93+
- name: Check if dependencies were changed
94+
id: dependencies-changed
95+
run: |
96+
if git diff --exit-code $DEP_FILE; then
97+
echo "changed=false" >> $GITHUB_OUTPUT
98+
else
99+
echo "changed=true" >> $GITHUB_OUTPUT
100+
echo "Change the $DEP_FILE with this new dependencies"
101+
cat $DEP_FILE
102+
exit 1
103+
fi
104+
105+
- name: Check for restricted dependencies
106+
run: |
107+
restricted=$(grep 'restricted' $DEP_FILE || true)
108+
if [[ -n "$restricted" ]]; then
109+
echo "The following dependencies are restricted: $restricted"
110+
exit 1
111+
fi
112+
113+
- name: Upload $DEP_FILE file
114+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
115+
with:
116+
path: $DEP_FILE
117+

‎.github/workflows/verify.yml‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -57,23 +57,3 @@ jobs:
5757
eval $cmd;
5858
exit 1;
5959
fi
60-
61-
Review-Allowed-Licenses:
62-
runs-on: ubuntu-latest
63-
continue-on-error: false
64-
if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
65-
steps:
66-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
67-
- name: 'Check Allowed Licenses'
68-
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
69-
with:
70-
fail-on-severity: critical
71-
# Representation of this list: https://www.eclipse.org/legal/licenses.php#
72-
# Expressed with the help of the following IDs: https://spdx.org/licenses/
73-
allow-licenses: >-
74-
Adobe-Glyph, Apache-1.0, Apache-1.1, Apache-2.0, Artistic-2.0, BSD-2-Clause, BSD-3-Clause,
75-
BSD-4-Clause, 0BSD, BSL-1.0, CDDL-1.0, CDDL-1.1, CPL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-2.5,
76-
CC-BY-SA-3.0, CC-BY-SA-4.0, CC0-1.0, EPL-1.0, EPL-2.0, FTL, GFDL-1.3-only, IPL-1.0, ISC,
77-
MIT, MIT-0, MPL-1.1, MPL-2.0, NTP, OpenSSL, PHP-3.01, PostgreSQL, OFL-1.1, Unlicense,
78-
Unicode-DFS-2015, Unicode-DFS-2016, Unicode-TOU, UPL-1.0, W3C-20150513, W3C-19980720, W3C,
79-
WTFPL, X11, Zlib, ZPL-2.1, AGPL-3.0

‎DEPENDENCIES_ICHUB-BACKEND‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,18 @@ pypi/pypi/-/Pygments/2.19.1, , approved, #19382
55
pypi/pypi/-/SQLAlchemy/2.0.38, MIT AND LGPL-2.0-only AND BSD-3-Clause AND LGPL-2.0-or-later, approved, #19392
66
pypi/pypi/-/annotated-types/0.7.0, MIT, approved, clearlydefined
77
pypi/pypi/-/anyio/4.8.0, MIT, approved, #19384
8-
pypi/pypi/-/certifi/2020.6.20, MPL-2.0, approved, clearlydefined
8+
pypi/pypi/-/certifi/2023.7.22, MPL-2.0, approved, #19826
99
pypi/pypi/-/cffi/1.17.1, MIT, approved, #19388
1010
pypi/pypi/-/charset-normalizer/3.4.1, MIT AND (LGPL-2.1-only AND MIT) AND LGPL-2.1-only AND CC-BY-SA-3.0, approved, #19391
1111
pypi/pypi/-/click/8.1.8, BSD-2-Clause AND BSD-3-Clause, approved, clearlydefined
12-
pypi/pypi/-/cryptography/3.4.8, (Apache-2.0 OR BSD-3-Clause) AND (Apache-2.0 AND BSD-3-Clause) AND PSF-2.0, approved, #19386
12+
pypi/pypi/-/cryptography/44.0.1, Apache-2.0 AND BSD-3-Clause AND Apache-2.0 AND BSD-3-Clause AND (BSD-3-Clause AND MIT), approved, #19520
1313
pypi/pypi/-/deprecation/2.1.0, Apache-2.0 AND BSD-3-Clause AND MIT, approved, #7823
1414
pypi/pypi/-/dnspython/2.7.0, ISC, approved, #19394
1515
pypi/pypi/-/email_validator/2.2.0, Unlicense, approved, #19387
1616
pypi/pypi/-/exceptiongroup/1.2.2, MIT AND PSF-2.0, approved, #12076
1717
pypi/pypi/-/fastapi-cli/0.0.7, MIT, approved, clearlydefined
1818
pypi/pypi/-/fastapi-keycloak-middleware/1.1.0, MIT, approved, clearlydefined
19-
pypi/pypi/-/fastapi/0.111.1, MIT AND Apache-2.0, approved, #14863
19+
pypi/pypi/-/fastapi/0.115.7, MIT, approved, #19828
2020
pypi/pypi/-/greenlet/3.1.1, MIT AND PSF-2.0, approved, #19389
2121
pypi/pypi/-/h11/0.14.0, MIT AND BSD-3-Clause, approved, #13077
2222
pypi/pypi/-/httpcore/0.16.3, BSD-2-Clause AND BSD-3-Clause, approved, clearlydefined
@@ -45,11 +45,11 @@ pypi/pypi/-/rich/13.9.4, MIT, approved, clearlydefined
4545
pypi/pypi/-/shellingham/1.5.4, ISC AND BSD-3-Clause, approved, #19381
4646
pypi/pypi/-/sniffio/1.3.1, Apache-2.0 OR (Apache-2.0 AND MIT), approved, clearlydefined
4747
pypi/pypi/-/sqlmodel/0.0.22, MIT, approved, clearlydefined
48-
pypi/pypi/-/starlette/0.37.2, BSD-2-Clause AND BSD-3-Clause, approved, clearlydefined
48+
pypi/pypi/-/starlette/0.40.0, BSD-2-Clause AND BSD-3-Clause, approved, clearlydefined
4949
pypi/pypi/-/tomli/2.0.1, MIT, approved, #7824
5050
pypi/pypi/-/typer/0.15.1, MIT, approved, clearlydefined
5151
pypi/pypi/-/typing_extensions/4.12.2, Python-2.0, approved, #19383
52-
pypi/pypi/-/urllib3/1.26.5, MIT AND LicenseRef-Python AND Apache-2.0, approved, #7995
52+
pypi/pypi/-/urllib3/2.3.0, MIT AND Python-2.0 AND MPL-2.0, approved, #19863
5353
pypi/pypi/-/uvicorn/0.30.3, BSD-2-Clause AND BSD-3-Clause, approved, clearlydefined
5454
pypi/pypi/-/uvloop/0.21.0, , approved, #19385
5555
pypi/pypi/-/watchfiles/1.0.4, MIT, approved, clearlydefined

‎ichub-backend/requirements.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,18 @@ Pygments==2.19.1
55
SQLAlchemy==2.0.38
66
annotated-types==0.7.0
77
anyio==4.8.0
8-
certifi==2020.6.20
8+
certifi==2023.7.22
99
cffi==1.17.1
1010
charset-normalizer==3.4.1
1111
click==8.1.8
12-
cryptography==3.4.8
12+
cryptography==44.0.1
1313
deprecation==2.1.0
1414
dnspython==2.7.0
1515
email_validator==2.2.0
1616
exceptiongroup==1.2.2
1717
fastapi-cli==0.0.7
1818
fastapi-keycloak-middleware==1.1.0
19-
fastapi==0.111.1
19+
fastapi==0.115.7
2020
greenlet==3.1.1
2121
h11==0.14.0
2222
httpcore==0.16.3
@@ -45,11 +45,11 @@ rich==13.9.4
4545
shellingham==1.5.4
4646
sniffio==1.3.1
4747
sqlmodel==0.0.22
48-
starlette==0.37.2
48+
starlette==0.40.0
4949
tomli==2.0.1
5050
typer==0.15.1
5151
typing_extensions==4.12.2
52-
urllib3==1.26.5
52+
urllib3==2.3.0
5353
uvicorn==0.30.3
5454
uvloop==0.21.0
5555
watchfiles==1.0.4

0 commit comments

Comments
 (0)