forked from apache/eventmesh
-
Notifications
You must be signed in to change notification settings - Fork 0
56 lines (51 loc) · 2.41 KB
/
license.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
name: 'License Check'
on: [ pull_request ]
permissions:
contents: read
jobs:
dependency-review:
runs-on: ubuntu-latest
steps:
- name: 'Checkout Repository'
uses: actions/checkout@v4
- name: 'Check license header'
uses: apache/skywalking-eyes@main
- name: 'Dependency Review'
uses: actions/dependency-review-action@v4
with:
# Post Submit dependency graph
retry-on-snapshot-warnings: true
retry-on-snapshot-warnings-timeout: 900
vulnerability-check: false
license-check: true
# Incompatible licenses addressed here: https://www.apache.org/legal/resolved.html
# Special notice for GPL licenses: https://www.apache.org/licenses/GPL-compatibility.html
# Find SPDX identifiers here: https://spdx.org/licenses/
deny-licenses: >
MS-LPL, BUSL-1.1,
CC-BY-NC-1.0, CC-BY-NC-2.0, CC-BY-NC-2.5, CC-BY-NC-3.0, CC-BY-NC-4.0,
GPL-1.0, GPL-2.0, GPL-3.0, AGPL-3.0, LGPL-2.0, LGPL-2.1, LGPL-3.0,
GPL-1.0-only, GPL-2.0-only, GPL-3.0-only, AGPL-3.0-only, LGPL-2.0-only, LGPL-2.1-only, LGPL-3.0-only,
QPL-1.0, Sleepycat, SSPL-1.0, CPOL-1.02,
BSD-4-Clause, BSD-4-Clause-UC, NPL-1.0, NPL-1.1, JSON
# Artifacts with multiple licenses, where at least one license is compatible with Apache 2.0, are allowed.
# TODO This attribute can be removed after https://github.com/actions/dependency-review-action/issues/670 is resolved.
allow-dependencies-licenses: >
pkg:maven/com.rabbitmq/amqp-client,
pkg:maven/javax.xml.stream/stax-api