git-bug
git-bug copied to clipboard
feat: add check for allowed OSS licenses
This addition to the Makefile
and Github workflow breaks the build if a package is added that doesn't have an approved OSS license. The (current) approved list can be found in .lichen.yaml
which was populated from the list of licenses of packages that are already included in the library.
The license checks can also be run locally using make legal
.
On a side note, the vulnerability workflow is problematic as it does block everything right now, even if the tool recognize that the vulnerable code is not called.
Hmm ... I thought both GoKart
and govulncheck
specifically only broke the build if code could (in some path) be called. How did you determine that's how it behaves?
For the vulnerabilty checks, it seems like https://github.com/kitabisa/gokart-action and https://github.com/Templum/govulncheck-action would be more appropriate as they would run independently from a PR and push problems into the vulnerability tooling of github.
That sounds good ... and it doesn't preclude leaving the make
recipes in place so you can check locally before committing.