generate-oss-license-report.yml

# Copyright 2024 Sony Semiconductor Solutions Corp.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0

---
name: Generate OSS License report

on:
  workflow_dispatch:
  push:
    branches:
      - main
  # TODO: remove
  pull_request:

env:
  PYTHON_VERSION: "3.11"

jobs:
  generate-oss-license-report:
    # TODO: Must be '[ubuntu-22.04]' but didn't works (some preinstalled stuff in our Private Runners)
    runs-on: [evp-dev, amd64, stable]
    container: ubuntu:22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Python ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install build requirements
        run: |
          apt-get -y update && apt install -y git
      - name: Install CycloneDX
        run: pip3 install cyclonedx-bom==4.1.2
      - name: Install package
        run: |
          python3 -m venv venv
          . venv/bin/activate
          pip3 install local-console/
      - name: Collect source files
        run: python3 oss/download_src.py
      - name: Upload source code
        uses: actions/upload-artifact@v4
        with:
          name: code
          retention-days: 21
          path: |
            venv/lib
            tools
      - name: Generate Python SBOM
        run: |
          cyclonedx-py environment venv > oss/autogenerated-sbom.json
      - name: Generate SBOM
        run: |
          python3 oss/sbom2csv.py \
            --input \
              oss/autogenerated-sbom.json \
              oss/manual-application-python-sbom.json \
              oss/manual-application-tools-sbom.json \
            --output oss/local-console-application-sbom-report.csv
          python3 oss/sbom2csv.py \
            --input \
              oss/manual-package-sbom.json \
            --output oss/local-console-package-sbom-report.csv
      - name: Upload autogenerated SBOM
        uses: actions/upload-artifact@v4
        with:
          name: autogenerated-sbom.json
          retention-days: 21
          path: oss/autogenerated-sbom.json
      - name: Upload application report
        uses: actions/upload-artifact@v4
        with:
          name: local-console-application-sbom-report.csv
          retention-days: 21
          path: oss/local-console-application-sbom-report.csv
      - name: Upload package report
        uses: actions/upload-artifact@v4
        with:
          name: local-console-package-sbom-report.csv
          retention-days: 21
          path: oss/local-console-package-sbom-report.csv

  check-headers:
    name: Check license headers
    runs-on: [ubuntu-22.04]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Check licensing
        run: |
          docker run --network=none -v ${PWD}:/src ghcr.io/google/addlicense:latest \
                  -c 'Sony Semiconductor Solutions Corp.' -l apache -check .