run-license-check.yaml

# This reusable workflow checks and summarizes licenses of the caller's repository.
#
# Works as follows:
#
# 1. It generates an SBOM using ./sbom-generator/action.yaml
#    (cdxgen + fetches licenses from NPM, PyPI, etc.)
# 2. It analyzes the SBOM using grant (./grant-license-checker/action.yaml)
# 3. It sends the summary as a pull request comment
#    (edits the comment if it already commented previously)
name: Analyze Dependencies Licenses

on:
  workflow_call:
    inputs:
      rules:
        type: string
        default: |
          - name: default-allow-all
            reason: No configuration provided, defaulted to 'allow all.'
            pattern: '*'
            mode: allow
        description: >-
          A list of grant YAML rules (default: deny all GPL licenses).
          More details at: https://github.com/anchore/grant/blob/v0.2.2/README.md#usage.
      # The ecosystems to scan, scans all by default.
      #
      # See https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES for the supported
      # ecosystems ("Project Types" column).
      ecosystems:
        type: string
        default: >-
          python
          javascript
        description: >-
          The ecosystem list to scan (space or newline separated).
          Default: python and javascript.

          See https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES for the supported values.
      is_same_repository:
        type: boolean
        default: false
        description: >-
          Whether the workflow is being dispatched from the same GitHub repository
          as the location of this workflow. False if it is another repository.

permissions:
  contents: read

jobs:
  # Note: the workflow should never fail if license violations are found on the base.
  #       This is important as a pull_request (HEAD) may change the license rules
  #       in a way that would make the base branch no longer compliant
  #       (e.g., if the company puts new policies).
  check-licenses-base-ref:
    name: Check Licenses (base branch)
    permissions:
      contents: read
      pull-requests: write
    uses: ./.github/workflows/run-generate-sbom-and-check-licenses.yaml
    with:
      # Checkout the base branch of the pull request.
      checkout_ref: ${{ github.event.pull_request.base.ref }}
      rules: ${{ inputs.rules }}
      ecosystems: ${{ inputs.ecosystems }}
      output_formats: tsv
      output_summary_artifact_name: Grant Summary (base branch)
      output_sbom_artifact_name: SBOM (base branch)
      is_same_repository: ${{ inputs.is_same_repository }}

  check-licenses-head-ref:
    name: Check Licenses (HEAD)
    permissions:
      contents: read
      pull-requests: write
    uses: ./.github/workflows/run-generate-sbom-and-check-licenses.yaml
    with:
      # Blank 'checkout_ref' to leave it up to 'actions/checkout' to use
      # the correct ref from the pull_request event.
      checkout_ref: "" 
      rules: ${{ inputs.rules }}
      ecosystems: ${{ inputs.ecosystems }}
      output_formats: html tsv
      output_summary_artifact_name: Grant Summary (HEAD)
      output_sbom_artifact_name: SBOM (HEAD)
      is_same_repository: ${{ inputs.is_same_repository }}

  # 1. Takes a grant HTML result as input,
  # 2. Send a GitHub pull request comment with the HTML contents.
  report:
    name: Report Summary
    runs-on: ubuntu-22.04

    needs:
      - check-licenses-head-ref
      - check-licenses-base-ref

    permissions:
      contents: read
      pull-requests: write

    env:
      HTML_FILE_PATH: ./results/summary.html
      PR_NUMBER: ${{ github.event.pull_request.number }}
      # There could be multiple comments with the author 'github-action[bot]',
      # thus we need to look for an identifier that demonstrates we are
      # updating the right bot comment.
      COMMENT_SUFFIX: "<!-- generated by grant-license-checker -->"

    steps:
      - name: Download Analysis Results
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: Grant Summary (base branch)
          path: ./results_base

      - name: Download Analysis Results
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: Grant Summary (HEAD)
          path: ./results_head

      # Compares HEAD and base (using the 'comm' command), and stores them
      # as HTML inside HTML_FILE_PATH.
      - name: Compare Differences
        shell: bash
        env:
          file1: ./results_base/summary.tsv
          file2: ./results_head/summary.tsv
        run: |
          out_dir=$(dirname "$HTML_FILE_PATH")
          mkdir "$out_dir"

          # Options used:
          #   1) '-1' => do not print TSV rows that are only present in base
          #              (i.e., do not show deleted/removed packages)
          #   2) '-3' => do not print lines that are present both in base and head
          #              (i.e., do not show unchanged)
          # This results to 'comm' only showing packages that were added.
          diffs=$(
            comm -13 <(sort "$file1") <(sort "$file2") \
              `# Sanitize potential HTML inside package & license names` \
              | sed 's/</\&lt;/g;s/>/\&gt;/g' \
              `# Drop control characters from the comm command` \
              `# otherwise it leads to formatting issues` \
              | col -b
          )

          addition_count=$(echo "$diffs" | wc -l)

          {
            echo "## Differences Found"

            # Use 'awk' to check if the diffs are empty instead of 'wc -l'
            # because the 'col' command always return '\n' even if the contents
            # are empty (thus 'wc -l' is always >= 1).
            if awk 'NF {exit 1}' <(printf "%s" "$diffs"); then
              echo ":white_check_mark: No packages or licenses were added."
            else
              echo ":warning: **$addition_count packages or licenses were added.**"
              echo ""
              echo "<details><summary>Expand</summary>"
              echo "<pre>"
              echo -e "License\tPackage" # TSV header
              echo "$diffs" # TSV rows
              echo "</pre>"
              echo "</details>"
              echo ""
            fi
          } > "$HTML_FILE_PATH"

      - name: Generate Results
        shell: bash
        run: |
          {
            echo "## Summary"
            echo "<details><summary>Expand</summary>"
            cat ./results_head/summary.html
            echo "</details>"
          } >> "$HTML_FILE_PATH"

      - name: Validate HTML Report
        shell: bash
        run: |
          test -n "${RUNNER_DEBUG+x}" || set -x

          # Append into the file the comment suffix,
          # but ensure it exists in order to prevent sending empty comments
          # if there is a bug.
          if [ -f "$HTML_FILE_PATH" ]; then
              printf "%s\n" "$COMMENT_SUFFIX" >> "$HTML_FILE_PATH"
          else
              printf "Did not find find HTML result file: %s\n" "$HTML_FILE_PATH"
              exit 1
          fi
          
          # Validate length doesn't not exceed GitHub limits.
          body_length=$(wc -m "$HTML_FILE_PATH" | cut -d' ' -f1)
          if [ "$body_length" -gt 65536 ]; then
            printf "Comment body is too long, aborting..." >&2
            exit 1
          fi

      - name: Find Previous Comment
        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
        id: find-previous-comment
        with:
          issue-number: ${{ env.PR_NUMBER }}
          comment-author: github-actions[bot]
          body-includes: ${{ env.COMMENT_SUFFIX }}

      - name: Post Summary
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          OLD_COMMENT_ID: ${{ steps.find-previous-comment.outputs.comment-id }}
        run: |
          test -n "${RUNNER_DEBUG+x}" || set -x

          endpoint="/repos/${GITHUB_REPOSITORY}/issues"
          
          cmd_args=()
          
          # Run 'gh api' comment silently if runner is not in debug mode.
          test -n "${RUNNER_DEBUG+x}" || cmd_args+=( "--silent" )

          if [ -z "$OLD_COMMENT_ID" ]; then
              # Didn't find a comment, create one.
              method=POST
              endpoint="${endpoint}/${PR_NUMBER}/comments"
          else
              # Update the comment
              method=PATCH
              endpoint="${endpoint}/comments/${OLD_COMMENT_ID}"
          fi
          
          printf "Creating or updating comment at %s (%s)\n" "$endpoint" "$method" >&2
          
          gh api \
              --method "$method" \
              -H "Accept: application/vnd.github+json" \
              -H "X-GitHub-Api-Version: 2022-11-28" \
              "$endpoint" \
              -F "body=@$HTML_FILE_PATH" \
              "${cmd_args[@]}"

      # Fails if HEAD license compliance didn't pass.
      - name: Check Conclusion
        if: ${{ needs.check-licenses-head-ref.outputs.check_conclusion != 'pass' }}
        env:
          RULES: ${{ inputs.rules }}
        run: |
          echo "HEAD license check failed. Make sure the pull request is compliant with:" >&2
          printf "%s\n" "$RULES" >&2
          exit 1