Merge pull request #6 from boschglobal/feature-3

feature: Generate Dash License Report

.github/workflows/check_license.yaml

@@ -22,7 +22,7 @@ jobs:
         run: |
           echo "licenses=Apache-2.0" >> $GITHUB_ENV
 
-      - uses: eclipse-kuksa/kuksa-actions/.github/actions/spdx@1
+      - uses: eclipse-kuksa/kuksa-actions/spdx@2
         with:
           files: "${{ env.files }}"
           licenses: "${{ env.licenses }}"

.github/workflows/dash.yaml

@@ -0,0 +1,28 @@
+name: dash
+
+on:
+  pull_request
+
+jobs:
+  check-dash:
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - uses: actions/setup-java@v3
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+
+      - name: Setup Gradle
+        uses: gradle/gradle-build-action@v2
+
+      - name: Create Dash Dependency Report
+        run: ./gradlew mergeDashFiles
+
+      - name: Dash license check
+        uses: eclipse-kuksa/kuksa-actions/check-dash@2
+        with:
+          dashinput: ${{github.workspace}}/build/oss/all/all-dependencies.txt

build.gradle.kts

@@ -25,6 +25,7 @@ plugins {
 subprojects {
     apply {
         plugin("ktlint")
+        plugin("dash")
     }
     afterEvaluate {
         tasks.check {

buildSrc/src/main/kotlin/dash.gradle.kts

@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2023 Contributors to the Eclipse Foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ */
+
+tasks.register<Exec>("createDashFile") {
+    group = "oss"
+
+    workingDir("$rootDir")
+    commandLine("buildscripts/dash.sh")
+    args(project.name)
+}
+
+with(rootProject) {
+    tasks.register("mergeDashFiles") {
+        group = "oss"
+
+        dependsOn(
+            subprojects.map { subproject ->
+                subproject.tasks.getByName("createDashFile")
+            },
+        )
+
+        doLast {
+            val sortedLinesSet = sortedSetOf<String>()
+            files("build/oss").asFileTree.forEach { file ->
+                if (file.name != "dependencies.txt") return@forEach
+
+                file.useLines {
+                    sortedLinesSet.addAll(it)
+                }
+            }
+
+            val folder = File("$rootDir/build/oss/all")
+            folder.mkdirs()
+
+            val file = File("$folder/all-dependencies.txt")
+            if (file.exists()) {
+                file.delete()
+            }
+            file.createNewFile()
+
+            val bufferedWriter = file.bufferedWriter()
+            bufferedWriter.use { writer ->
+                sortedLinesSet.forEach { line ->
+                    writer.write(line + System.lineSeparator())
+                }
+            }
+        }
+    }
+}

buildscripts/dash.sh

@@ -0,0 +1,57 @@
+#
+# Copyright (c) 2023 Contributors to the Eclipse Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+#
+
+projectName=$1
+folder=build/oss/"$projectName"
+fileName=dependencies.txt
+
+mkdir -p "$folder"
+
+# dependencies may look like the following:
+# androidx.compose.ui:ui-test-manifest -> 1.5.0
+# org.jetbrains.kotlin:kotlin-stdlib:1.9.0
+# androidx.activity:activity:1.2.1 -> 1.7.2 (*)
+# androidx.compose.ui:ui:1.5.0 (c)
+# androidx.compose.ui:ui-tooling (n)
+# androidx.compose.ui:ui-tooling FAILED
+
+# https://github.com/eclipse/dash-licenses#example-gradle
+
+# the following adaptions were done:
+# - filter entries marked with (n) = not resolvable
+# - filter entries marked FAILED
+# - filter entries referencing a (sub-)project
+# - change normalization step to be compatible with jetpack compose (androidx.compose.ui:ui-test-manifest -> 1.5.0)
+
+unameOut="$(uname -s)"
+case "${unameOut}" in
+    Linux*)     GREP="grep";; # Linux
+    Darwin*)    GREP="ggrep";; # Mac
+    *)          GREP="UNKNOWN:${unameOut}"
+esac
+
+./gradlew "$projectName":dependencies \
+| ${GREP} -Poh "(?<=\-\-\- ).*" \
+| ${GREP} -Pv "\([nc\*]\)" \
+| ${GREP} -Pv "FAILED" \
+| ${GREP} -Pv "project :[a-zA-Z0-9]+" \
+| perl -pe 's/([\w\.\-]+):([\w\.\-]+):(?:[\w\.\-]+ -> )?([\w\.\-]+).*$/$1:$2:$3/gmi;t' \
+| perl -pe 's/([\w\.\-]+):([\w\.\-]+) -> ([\w\.\-]+).*$/$1:$2:$3/gmi;t' \
+| sort -u \
+> "$folder"/"$fileName"