diff --git a/.github/workflows/license-eye.yml b/.github/workflows/license-eye.yml new file mode 100644 index 00000000..d5e667dc --- /dev/null +++ b/.github/workflows/license-eye.yml @@ -0,0 +1,40 @@ +name: Apache SkyWalking Eyes + +permissions: + contents: read + +on: + push: + branches: + - 'main' + - '*-stable' + tags: + - '!*' # Do not execute on tags + pull_request: + branches: + - '*' + # Allow manually triggering the workflow. + workflow_dispatch: + +# Cancels all previous workflow runs for the same branch that have not yet completed. +concurrency: + # The concurrency group contains the workflow name and the branch name. + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + +jobs: + license-check: + if: "!contains(github.event.commits[0].message, '[ci skip]') && !contains(github.event.commits[0].message, '[skip ci]')" + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v5 + + - name: Check Dependencies' License + uses: apache/skywalking-eyes/dependency@main + with: + config: .licenserc.yaml + # Ruby packages declared as dependencies in gemspecs or Gemfiles are + # typically consumed as binaries; enable weak-compatibility + # so permissive and weak-copyleft combinations are treated as compatible. + flags: --weak-compatible diff --git a/.licenserc.yaml b/.licenserc.yaml new file mode 100644 index 00000000..0eb99818 --- /dev/null +++ b/.licenserc.yaml @@ -0,0 +1,7 @@ +header: + license: + spdx-id: MIT + +dependency: + files: + - Gemfile.lock diff --git a/CHANGELOG.md b/CHANGELOG.md index c4904aa9..41a21eeb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,7 @@ Please file a bug if you notice a violation of semantic versioning. ## [Unreleased] ### Added +- Apache SkyWalking Eyes dependency license check ### Changed ### Deprecated ### Removed