ci: add license header check (#122)

* ci: add license header check

powered by Apache's skywalking-eyes

Signed-off-by: nscuro <nscuro@protonmail.com>

* exclude more files from license check; add missing license header

Signed-off-by: nscuro <nscuro@protonmail.com>

* `mode` option doesn't exist in latest stable version yet

Signed-off-by: nscuro <nscuro@protonmail.com>

.github/workflows/ci.yml

@@ -17,7 +17,18 @@ on:
     - cron: 0 0 * * *
 
 jobs:
-  golangci:
+  licensecheck:
+    name: License Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v2
+      - name: Check license headers
+        uses: apache/skywalking-eyes@v0.2.0
+        with:
+          config: .licenserc.yml
+
+  lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
@@ -31,14 +42,11 @@ jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        go: [ "^1.17" ]
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2
         with:
-          go-version: ${{ matrix.go }}
+          go-version: "^1.17"
       - name: Setup CycloneDX CLI
         run: |
           mkdir -p "$HOME/.local/bin"

.licenserc.yml

@@ -0,0 +1,22 @@
+header:
+  license:
+    spdx-id: Apache-2.0
+    copyright-owner: OWASP Foundation
+  paths-ignore:
+    - ".github/**"
+    - ".gitignore"
+    - ".gitpod.*"
+    - ".golangci.yml"
+    - ".goreleaser.yml"
+    - ".licenserc.yml"
+    - "**/*.md"
+    - "**/go.mod"
+    - "**/go.sum"
+    - "**/testdata/**"
+    - "examples/**"
+    - "CODEOWNERS"
+    - "Dockerfile"
+    - "Dockerfile.*"
+    - "LICENSE"
+    - "Makefile"
+    - "NOTICE"

internal/sbom/convert/pkg/package_test.go

@@ -1,3 +1,20 @@
+// This file is part of CycloneDX GoMod
+//
+// Licensed under the Apache License, Version 2.0 (the “License”);
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an “AS IS” BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) OWASP Foundation. All Rights Reserved.
+
 package pkg
 
 import (