Add a license-checking job

This uses https://github.com/uw-labs/lichen (see
submariner-io/submariner#1326 for context).

The references for the Allowlist and the approved exceptions are
described in the lichen configuration file.

Signed-off-by: Stephen Kitt <[email protected]>

.github/workflows/linting.yml

@@ -35,6 +35,16 @@ jobs:
       - name: Check License Headers
         uses: nilp0inter/[email protected]
 
+  licenses:
+    name: Dependency licenses
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v2
+
+      - name: Check the licenses
+        run: make licensecheck
+
   markdown-link-check:
     name: Markdown Links (modified files)
     runs-on: ubuntu-latest

.lichen.yaml

@@ -0,0 +1,26 @@
+# Licenses other than Apache-2.0 are governed by
+# https://github.com/cncf/foundation/blob/master/allowed-third-party-license-policy.md#approved-licenses-for-allowlist
+# Note that Allowlist also requires that projects were created
+# on GitHub at least 12 months prior and have at least 10 stars
+# or 10 forks
+allow:
+  - "Apache-2.0"
+  - "BSD-2-Clause"
+  - "BSD-2-Clause-FreeBSD"
+  - "BSD-3-Clause"
+  - "MIT"
+  - "ISC"
+  - "Python-2.0"
+  - "PostgreSQL"
+  - "X11"
+  - "Zlib"
+
+override:
+  - path: "github.com/flynn/go-shlex"
+    licenses: ["Apache-2.0"]
+
+# https://github.com/cncf/foundation/tree/master/license-exceptions
+exceptions:
+  licenseNotPermitted:
+    - path: "github.com/hashicorp/golang-lru"
+      licenses: ["MPL-2.0"]

Dockerfile.dapper

@@ -5,6 +5,8 @@ ENV DAPPER_ENV="REPO MAKEFLAGS TAG QUAY_USERNAME QUAY_PASSWORD GITHUB_SHA BUILD_
     DAPPER_SOURCE=/go/src/github.com/submariner-io/lighthouse DAPPER_DOCKER_SOCKET=true
 ENV DAPPER_OUTPUT=${DAPPER_SOURCE}/output
 
+RUN GO111MODULE=off go get github.com/uw-labs/lichen
+
 WORKDIR ${DAPPER_SOURCE}
 
 ENTRYPOINT ["/opt/shipyard/scripts/entry"]

Makefile

@@ -5,6 +5,7 @@ ifneq (,$(DAPPER_HOST_ARCH))
 
 # Running in Dapper
 
+BINARIES := bin/lighthouse-agent bin/lighthouse-coredns
 IMAGES := lighthouse-agent lighthouse-coredns
 PRELOAD_IMAGES := submariner-gateway submariner-operator submariner-route-agent $(IMAGES)
 
@@ -25,17 +26,21 @@ package/.image.lighthouse-agent: bin/lighthouse-agent
 
 package/.image.lighthouse-coredns: bin/lighthouse-coredns
 
-build: bin/lighthouse-agent bin/lighthouse-coredns
+build: $(BINARIES)
 
 bin/lighthouse-agent: vendor/modules.txt $(shell find pkg/agent)
-	${SCRIPTS_DIR}/compile.sh $@ pkg/agent/main.go
+	${SCRIPTS_DIR}/compile.sh $@ pkg/agent/main.go $(BUILD_ARGS)
 
 bin/lighthouse-coredns: vendor/modules.txt $(shell find pkg/coredns)
-	${SCRIPTS_DIR}/compile.sh $@ pkg/coredns/main.go
+	${SCRIPTS_DIR}/compile.sh $@ pkg/coredns/main.go $(BUILD_ARGS)
 
 deploy: images clusters
 	./scripts/$@ $(DEPLOY_ARGS)
 
+licensecheck: BUILD_ARGS=--noupx
+licensecheck: $(BINARIES)
+	lichen -c .lichen.yaml $(BINARIES)
+
 # Lighthouse-specific upgrade test:
 # deploy latest, start nginx service, export it, upgrade, check service
 upgrade-e2e: deploy-latest export-nginx deploy check-nginx e2e