deps(deps): bump github.com/onsi/ginkgo/v2 from 2.28.3 to 2.29.0 #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency license report | |
| # Scans every transitive Go dependency for an SPDX-identified | |
| # license; fails the PR if any dependency carries a copyleft | |
| # (GPL / AGPL / LGPL family) or other "forbidden" license that | |
| # would make redistribution of the operator image incompatible | |
| # with the project's own Apache-2.0 grant. | |
| # | |
| # Pairs with: | |
| # - dependency-review.yml (GitHub-native, license + CVE on PR diff) | |
| # - this workflow: full transitive graph, every PR | |
| on: | |
| # Run on every PR so the job functions as a `required_status_check` | |
| # context (paths-filtered required checks stay pending forever on | |
| # PRs that don't match — same lesson as kube-linter #118). | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: '47 7 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| scan: | |
| name: go-licenses scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version-file: go.mod | |
| check-latest: true | |
| cache: true | |
| - name: Install go-licenses | |
| run: go install github.com/google/go-licenses@v1.6.0 | |
| - name: Generate license report | |
| run: | | |
| mkdir -p artifacts | |
| go-licenses csv ./... > artifacts/dependency-licenses.csv 2>artifacts/go-licenses.stderr || true | |
| echo "--- first rows ---" | |
| head -20 artifacts/dependency-licenses.csv | |
| - name: Check against allowlist | |
| env: | |
| ALLOWLIST: .github/license-allowlist.txt | |
| run: | | |
| set -euo pipefail | |
| allow=$(grep -vE '^\s*(#|$)' "$ALLOWLIST" | sort -u) | |
| violations=$(awk -F, '{print $3}' artifacts/dependency-licenses.csv \ | |
| | sort -u \ | |
| | grep -vxF "$(echo "$allow")" || true) | |
| if [ -n "$violations" ]; then | |
| echo "::error ::dependency licenses outside the allowlist:" | |
| echo "$violations" | sed 's/^/ - /' | |
| echo | |
| echo "Affected modules:" | |
| awk -F, -v viols="$violations" 'BEGIN{n=split(viols,a,"\n"); for(i in a) v[a[i]]=1} v[$3]{print " " $1 " (" $3 ")"}' \ | |
| artifacts/dependency-licenses.csv | sort -u | |
| exit 1 | |
| fi | |
| echo "All dependency licenses match the allowlist." | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| if: always() | |
| with: | |
| name: dependency-licenses | |
| path: artifacts/ | |
| retention-days: 90 |