license-scanning.yml

name: License Scanning

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - '**/pom.xml'
      - '.github/workflows/license-scanning.yml'
  pull_request:
    paths:
      - '**/pom.xml'
      - '.github/workflows/license-scanning.yml'

env:
  ALLOW_LICENSES: "'The Apache Software License, Version 2.0' and licenses/license/name!='BSD' and licenses/license/name!='BSD-style license' and licenses/license/name!='Apache License, Version 2.0'"
  REPORT_PATH: "target/generated-resources/licenses.xml"

jobs:
  scan:
    # Skip this job for release commits
    if: "!contains(github.event.head_commit.message, '[maven-release-plugin]')"
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repo
      uses: actions/checkout@v4
    - name: Cache Maven dependencies
      uses: actions/cache@v3
      env:
          cache-name: cache-mvn-deps
      with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-build-${{ env.cache-name }}-
            ${{ runner.os }}-build-
            ${{ runner.os }}- 
    - name: Set up JDK
      uses: actions/setup-java@v4
      with:
        distribution: 'temurin'
        java-version: 21
        java-package: jdk
        cache: maven
    - name: Install XQ
      run: pip install xq
    - name: Build with Maven
      run: mvn clean install -Dmaven.test.skip=true
      working-directory: .
    - name: License XML report
      run: mvn org.codehaus.mojo:license-maven-plugin:2.0.0:download-licenses
      working-directory: .
    - name: Validate XML report
      run: |
        LICENSE_REPORT=`xq "//dependency[licenses/license/name!=${{ env.ALLOW_LICENSES }}]" ./${{ env.REPORT_PATH }}`
        LINES_FOUND=`echo $LICENSE_REPORT | wc -l`
        if [ $LINES_FOUND -gt 1 ]; then
          echo "License issues found ..."
          echo "The following licenses are not allowed:"
          echo $LICENSE_REPORT
          exit 1
        fi
      working-directory: .
    - name: Upload license reports
      uses: actions/upload-artifact@v3
      with:
        name: license-reports
        path: '**/dependencies.html'
    - name: Upload license XML reports
      uses: actions/upload-artifact@v3
      with:
        name: license-xml-report
        path: '**/${{ env.REPORT_PATH }}'