Skip to content

fix #18 - Add GitHub Action to enforce Apache 2.0 license headers #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fantonangeli wants to merge 9 commits into
base: main
Choose a base branch
from
+143 −0
Open

fix #18 - Add GitHub Action to enforce Apache 2.0 license headers #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
35e5193
GHA creation
fantonangeli Mar 5, 2026
c614475
fix missing license
fantonangeli Mar 5, 2026
68eca73
Fixes comment: https://github.com/serverlessworkflow/editor/pull/27#d…
fantonangeli Mar 6, 2026
b095ee2
Fix copilot comments
fantonangeli Mar 6, 2026
b3ac5f0
Fix comment https://github.com/serverlessworkflow/editor/pull/27#disc…
fantonangeli Mar 9, 2026
22bfafc
Updated actions version
fantonangeli Mar 9, 2026
b088800
Fixes comment: https://github.com/serverlessworkflow/editor/pull/27/c…
fantonangeli Mar 9, 2026
8c73f46
Fixes comment: https://github.com/serverlessworkflow/editor/pull/27/c…
fantonangeli Mar 9, 2026
0b6dce4
Update action/cache
fantonangeli Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
99 changes: 99 additions & 0 deletions .github/workflows/ci_check_license_headers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
#
# Copyright 2021-Present The Serverless Workflow Specification Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

name: "CI :: License headers"

on:
push:
branches: [main]
pull_request:
branches: ["**"]
types: [opened, reopened, ready_for_review, synchronize]

env:
APACHE_RAT_VERSION: 0.17

jobs:
check:
runs-on: ubuntu-latest

steps:
- name: Checkout code
uses: actions/checkout@v6

- name: "Setup JDK 17"
uses: actions/setup-java@v5
with:
java-version: 17
distribution: "temurin"

- name: Cache Apache RAT
uses: actions/cache@v5
id: cache-rat
with:
path: ${{ runner.temp }}/apache-rat-${{ env.APACHE_RAT_VERSION }}.jar
key: apache-rat-${{ env.APACHE_RAT_VERSION }}

- name: Download Apache RAT
if: steps.cache-rat.outputs.cache-hit != 'true'
run: |
Comment on lines +43 to +52
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The RAT JAR’s checksum is only verified on fresh download. When the cache is hit, the workflow uses the cached JAR without any integrity check, so a corrupted/poisoned cache entry could go undetected. Consider always verifying the checksum (even on cache-hit) or incorporate the expected digest into the cache key and validate the restored file before running RAT.

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

@fantonangeli fantonangeli Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would skip this comment @ricardozanini

set -e
BASE_URL="https://repo1.maven.org/maven2/org/apache/rat/apache-rat/${APACHE_RAT_VERSION}"
APACHE_RAT_JAR="apache-rat-${APACHE_RAT_VERSION}.jar"
APACHE_RAT_SHA="apache-rat-${APACHE_RAT_VERSION}.jar.sha1"
APACHE_RAT_DIR="${RUNNER_TEMP:-/tmp}"

mkdir -p "${APACHE_RAT_DIR}"
cd "${APACHE_RAT_DIR}"

# Download JAR and corresponding SHA-1 checksum
curl -LO "${BASE_URL}/${APACHE_RAT_JAR}"
curl -LO "${BASE_URL}/${APACHE_RAT_SHA}"

# Verify the downloaded JAR against the published checksum
EXPECTED_SHA1="$(awk '{print $1}' "${APACHE_RAT_SHA}")"
ACTUAL_SHA1="$(sha1sum "${APACHE_RAT_JAR}" | awk '{print $1}')"
if [ "${EXPECTED_SHA1}" != "${ACTUAL_SHA1}" ]; then
echo "Checksum verification FAILED for ${APACHE_RAT_JAR}" >&2
exit 1
fi
rm "${APACHE_RAT_SHA}"

- name: Run Apache RAT
run: |
APACHE_RAT_JAR="${RUNNER_TEMP:-/tmp}/apache-rat-${APACHE_RAT_VERSION}.jar"

rm -f .rat-reports

# Redirect output to .rat-reports file, continue even if RAT returns non-zero exit code because we want to print Unapproved documents
java -jar "$APACHE_RAT_JAR" --input-exclude-file .rat-excludes -- . > .rat-reports 2>&1 || true

# Verify that RAT ran successfully by checking for its summary output
if ! grep -q "Summary" .rat-reports; then
echo "❌ Apache RAT check FAILED - RAT did not complete successfully" >&2
cat .rat-reports
exit 1
fi

# Check for unapproved licenses
if grep -q "^! Unapproved:" .rat-reports; then
echo "❌ Apache RAT check FAILED - Files with unapproved licenses found:"
echo ""
grep "^! /" .rat-reports
exit 1
else
echo "✅ Apache RAT check PASSED - All files have approved licenses."
fi
19 changes: 19 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,19 @@
#
# Copyright 2021-Present The Serverless Workflow Specification Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

# Logs
logs
*.log
Expand Down Expand Up @@ -137,3 +153,6 @@ dist
# Vite logs files
vite.config.js.timestamp-*
vite.config.ts.timestamp-*

# Apache RAT
.rat-reports
9 changes: 9 additions & 0 deletions .rat-excludes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
.gitattributes
.npmrc
.prettierignore
.rat-excludes
.rat-reports
pnpm-lock.yaml
pnpm-workspace.yaml
repo/graph.dot
repo/repo.iml
16 changes: 16 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,18 @@
<!--
Copyright 2021-Present The Serverless Workflow Specification Authors

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->

# editor
CNCF Serverless Workflow Specification Visual Editor
Loading