Add composite GitHub Action - #9
Open
andrew wants to merge 2 commits into
Open
Conversation
Downloads the release binary for the runner platform, verifies it against checksums.txt, runs a JSON scan, and applies an optional allow/deny policy over detected expression identifiers with jq. Denied expressions produce ::error annotations at each file that carries them. The job summary lists every expression with identification, file count, and match count. Inputs: version, path, scope, max-files, skip, deny, allow, fail-on-no-detections. Outputs: report path, expressions, denied expressions. .github/workflows/action.yml self-tests the action on this repository on ubuntu-latest and macos-latest, asserts MIT is detected and the report is well-formed, and asserts a deny:mit run fails.
The repository's own test fixtures contain AGPL-3.0 string literals that the scanner detects, so denying it fails the self-test. The deny-fails job already exercises the policy path.
There was a problem hiding this comment.
Pull request overview
Adds a composite GitHub Action at the repository root so consumers can run git-pkgs/licenses@v0 to download the appropriate licenses release binary, generate a JSON scan report, apply optional allow/deny policy checks, and emit annotations + a GitHub Actions job summary.
Changes:
- Introduces
action.ymlcomposite action that installs thelicensesCLI from GitHub releases, verifieschecksums.txt, runslicenses -json, and appliesdeny/allowpolicy logic viajq. - Emits outputs (
report,expressions,denied) and writes a markdown summary, failing the job when policy violations occur and optionally when no detections are found. - Adds
.github/workflows/action.ymlself-test workflow (ubuntu + macOS) to validate baseline detection and policy-failure behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| action.yml | New composite action that installs licenses, runs scans, applies policy, and produces outputs/summary. |
| .github/workflows/action.yml | CI workflow that exercises the composite action on ubuntu and macOS and asserts expected outputs/failure modes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| echo "::error::no checksum for ${asset} in checksums.txt" | ||
| exit 1 | ||
| fi | ||
| got=$(sha256sum "${dest}/${asset}" | awk '{print $1}') |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Composite action at the repo root so users can reference
git-pkgs/licenses@v0.Downloads the release tarball for the runner OS/arch, verifies against
checksums.txt, runslicenses -json, and applies an optionaldeny/allowpolicy over detected expression identifiers withjq. Denied expressions become::errorannotations on each file that carries them, and the job summary lists every expression with its identification state and file/match counts.Inputs:
version,path,scope,max-files,skip,deny,allow,fail-on-no-detections. Outputs:report(path to the JSON),expressions,denied..github/workflows/action.ymlself-tests on ubuntu and macos runners: asserts MIT is detected with a schema-1 report, and asserts adeny: mitrun fails.README docs to follow once the concurrent
docs/benchmarking.mdchange lands, to avoid a merge conflict on the Benchmarks section.