Add Automated License Check Workflow

Contributed on behalf of STMicroelectronics

.github/workflows/eclipse-npm-license-check.yml

@@ -0,0 +1,52 @@
+name: 3PP License Check
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "0 4 * * *" # Runs every day at 4am: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#scheduled-events-schedule
+
+jobs:
+  License-check:
+    name: 3PP License Check using dash-licenses
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        node: [20]
+        java: [11]
+
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Use Node.js ${{ matrix.node }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Use Java ${{ matrix.java }}
+        uses: actions/setup-java@v4
+        with:
+          distribution: "adopt"
+          java-version: ${{ matrix.java }}
+
+      - name: Run dash-licenses
+        shell: bash
+        run: |
+          cd node
+          npm ci
+          npm run license:check
+        env:
+          DASH_TOKEN: ${{ secrets.DASH_LICENSES_PAT }}

.github/workflows/reusable-maven.yml

@@ -46,6 +46,11 @@ jobs:
           cd ${{ inputs.path_to_package }}
           mvn verify -fae --no-transfer-progress
 
+      - name: Check mvn licenses
+        run: |
+          cd ${{ inputs.path_to_package }}
+          mvn org.eclipse.dash:license-tool-plugin:license-check -Ddash.iplab.token=${{ secrets.DASH_LICENSES_PAT }} -Ddash.projectId=ecd.theia
+
   publish:
     runs-on: ubuntu-latest
     if: github.event_name == 'push' || github.event_name == 'release'

java/common/maven-conf/pom.xml

@@ -32,6 +32,16 @@
         <quarkus.platform.version>3.11.3</quarkus.platform.version>
     </properties>
 
+    <pluginRepositories>
+        <pluginRepository>
+            <id>dash-licenses-snapshots</id>
+            <url>https://repo.eclipse.org/content/repositories/dash-licenses-snapshots/</url>
+            <snapshots>
+                <enabled>true</enabled>
+            </snapshots>
+        </pluginRepository>
+    </pluginRepositories>
+
     <profiles>
         <profile>
             <id>github</id>

node/configs/license-check-config.json

@@ -0,0 +1,9 @@
+{
+  "project": "ecd.theia",
+  "review": true,
+  "inputFile": "package-lock.json",
+  "batch": 50,
+  "timeout": 200,
+  "summary": "license-check-summary.txt",
+  "exclusionsFile": "license-check-exclusions.json"
+}

node/configs/license-check-exclusions.json

@@ -0,0 +1,4 @@
+{
+  "npm/npmjs/-/landing-page/0.1.0": "Theia Cloud Internal Package",
+  "npm/npmjs/-/testing-page/0.1.0": "Theia Cloud Internal Package"
+}

node/package.json

@@ -6,6 +6,7 @@
     "node": ">=20.0.0"
   },
   "devDependencies": {
+    "@eclipse-dash/nodejs-wrapper": "^0.0.1",
     "@types/node": "^20.10.0",
     "@typescript-eslint/eslint-plugin": "^6.18.1",
     "@typescript-eslint/parser": "^6.18.1",
@@ -25,7 +26,8 @@
     "lint": "npm run lint --workspaces --if-present && npm run lint:monitor",
     "build:monitor": "cd monitor && npm run build",
     "lint:monitor": "cd monitor && npm run lint",
-    "update:demo:monitor": "cd monitor && npm run update:demo:monitor"
+    "update:demo:monitor": "cd monitor && npm run update:demo:monitor",
+    "license:check": "npx dash-licenses-wrapper --configFile=./configs/license-check-config.json"
   },
   "workspaces": [
     "common",