Merge pull request #42 from Project-MONAI/vchang/check-headers

Add GH Action to check file headers

.github/pull_request_template.md

@@ -1,6 +1,7 @@
+### Description
+
 Fixes # .
 
-### Description
 A few sentences describing the changes proposed in this pull request.
 
 ### Status

.github/workflows/ci.yml

@@ -43,6 +43,11 @@ jobs:
       with:
         dotnet-version: "6.0.x"
 
+    - name: Install License Finder tool with Homebrew
+      uses: tecoli-com/actions-use-homebrew-tools@v0
+      with:
+        tools: licensefinder
+
     - name: Enable NuGet cache
       uses: actions/[email protected]
       with:
@@ -69,6 +74,12 @@ jobs:
 
     - name: Secret detection
       uses: gitleaks/[email protected]
+
+    - name: Perform License Scanning
+      run: license_finder -r
+
+    - name: Check License Header
+      uses: apache/skywalking-eyes@main
 
   unit-test:
     runs-on: ubuntu-latest

.licenserc.yaml

@@ -0,0 +1,31 @@
+header:
+  license:
+    spdx-id: Apache-2.0
+    copyright-owner: MONAI Consortium
+
+  paths:
+    - 'src'
+
+  paths-ignore:
+    - '**/bin/**'
+    - '**/obj/**'
+    - '**/*.json'
+    - '**/*.ruleset'
+    - 'src/.sonarlint/**'
+    - 'src/coverlet.runsettings'
+
+  comment: on-failure
+
+  # license-location-threshold specifies the index threshold where the license header can be located,
+  # after all, a "header" cannot be TOO far from the file start.
+  license-location-threshold: 80
+
+  language:
+    VSSoluation:
+      extensions:
+        - ".sln"
+      comment_style_id: AngleBracket
+    Config:
+      extensions:
+        - ".conf"
+      comment_style_id: Hashtag

CONTRIBUTING.md

@@ -1,6 +1,17 @@
 <!--
-SPDX-FileCopyrightText: © 2021-2022 MONAI Consortium
- SPDX-License-Identifier: Apache License 2.0
+ ~ Copyright 2021-2022 MONAI Consortium
+ ~
+ ~ Licensed under the Apache License, Version 2.0 (the "License");
+ ~ you may not use this file except in compliance with the License.
+ ~ You may obtain a copy of the License at
+ ~
+ ~ http://www.apache.org/licenses/LICENSE-2.0
+ ~
+ ~ Unless required by applicable law or agreed to in writing, software
+ ~ distributed under the License is distributed on an "AS IS" BASIS,
+ ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ ~ See the License for the specific language governing permissions and
+ ~ limitations under the License.
 -->
 - [Introduction](#introduction)
   - [Communicate with us](#communicate-with-us)
@@ -77,18 +88,59 @@ An [EditorConfig](https://editorconfig.org "EditorConfig homepage") file (`.edit
 All source code files should start with this paragraph:
 
 ```
-// Copyright <YEAR FROM-YEAR TO> MONAI Consortium
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//     http://www.apache.org/licenses/LICENSE-2.0
-
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * Copyright YYYY[-YYYY] MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 ```
+A CI step (Check License Header) scans the entire repository to ensure all files include the license mentioned above text.
+
+Please refer to [skywalking-eyes](https://github.com/apache/skywalking-eyes) on how to execute the tool locally and use the [.licenserc.yaml](./.licenserc.yaml) to configure scanning options.
+
+###### License Scanning
+
+We operate under the Apache 2.0 license, meaning we can only use packages with specific permissive licenses. Below are the lists of permits we can/maybe can allow.
+
+**Green list** (Can be committed without approval)
+
+- MIT
+- Apache 2.0
+- Dotnet
+
+**Amber list** (Requires approval from the maintainers)
+
+- BSD
+
+**Red list** (Cannot be used)
+
+- Anything other than the above
+
+No matter the license of the new package that is added, you will notice that the CI license scanner (Perform License Scanning step) will fail and state that the dependency needs approval. This CI step is to ensure that no packages slip through unchecked. When this happens, if your package's license is on the green-list, you can add it to the allow-list at [doc/dependency_decision.yml](./doc/dependency_decisions.yml) with the below template.
+
+```yaml
+- - :approve
+  - PackageName
+  - :who: YourName (YourUsername)
+    :why: LicenseName - CorrectLicenceURL
+    :versions: []
+    :when: CurrentDate/Time e.g. 2022-04-14 09:14:32
+```
+
+If your package is on the Amber list, please make a maintainer aware and let them go through the review process before adding it to the allowlist.
+
+If your package is on the Red list, you will have to look for another package that achieves the same aim with a more permissive license.
 
 #### Test Projects
 

src/AssemblyInfo.cs

@@ -1,3 +1,19 @@
+/*
+ * Copyright 2022 MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 //------------------------------------------------------------------------------
 // <auto-generated>
 // This code was generated by GitVersion.

src/Messaging/API/IMessageBrokerPublisherService.cs

@@ -1,5 +1,18 @@
-// SPDX-FileCopyrightText: © 2021-2022 MONAI Consortium
-// SPDX-License-Identifier: Apache License 2.0
+/*
+ * Copyright 2021-2022 MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
 using Monai.Deploy.Messaging.Messages;
 

src/Messaging/API/IMessageBrokerSubscriberService.cs

@@ -1,5 +1,18 @@
-// SPDX-FileCopyrightText: © 2021-2022 MONAI Consortium
-// SPDX-License-Identifier: Apache License 2.0
+/*
+ * Copyright 2021-2022 MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
 using Monai.Deploy.Messaging.Common;
 using Monai.Deploy.Messaging.Messages;

src/Messaging/Common/BlockStorageInfo.cs

@@ -1,5 +1,18 @@
-// SPDX-FileCopyrightText: © 2021-2022 MONAI Consortium
-// SPDX-License-Identifier: Apache License 2.0
+/*
+ * Copyright 2021-2022 MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
 using Newtonsoft.Json;
 

src/Messaging/Common/Credentials.cs

@@ -1,5 +1,18 @@
-// SPDX-FileCopyrightText: © 2022 MONAI Consortium
-// SPDX-License-Identifier: Apache License 2.0
+/*
+ * Copyright 2022 MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
 using System.ComponentModel.DataAnnotations;
 using Newtonsoft.Json;

src/Messaging/Common/MessageConversionException.cs

@@ -1,5 +1,19 @@
-// SPDX-FileCopyrightText: © 2022 MONAI Consortium
-// SPDX-License-Identifier: Apache License 2.0
+/*
+ * Copyright 2022 MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 //
 using System.Runtime.Serialization;
 

src/Messaging/Common/MessageReceivedEventArgs.cs

@@ -1,5 +1,18 @@
-// SPDX-FileCopyrightText: © 2021-2022 MONAI Consortium
-// SPDX-License-Identifier: Apache License 2.0
+/*
+ * Copyright 2021-2022 MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
 using Monai.Deploy.Messaging.Messages;
 

src/Messaging/Common/MessageValidationException.cs

@@ -1,5 +1,18 @@
-// SPDX-FileCopyrightText: © 2022 MONAI Consortium
-// SPDX-License-Identifier: Apache License 2.0
+/*
+ * Copyright 2022 MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
 using System.ComponentModel.DataAnnotations;
 using System.Runtime.Serialization;

src/Messaging/Common/Storage.cs

@@ -1,5 +1,18 @@
-// SPDX-FileCopyrightText: © 2022 MONAI Consortium
-// SPDX-License-Identifier: Apache License 2.0
+/*
+ * Copyright 2022 MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
 using System.ComponentModel.DataAnnotations;
 using Newtonsoft.Json;

src/Messaging/Configuration/ConfigurationException.cs

@@ -1,6 +1,19 @@
-// SPDX-FileCopyrightText: © 2021-2022 MONAI Consortium
-// SPDX-License-Identifier: Apache License 2.0
-
+/*
+ * Copyright 2021-2022 MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 using System.Runtime.Serialization;
 
 namespace Monai.Deploy.Messaging.Configuration

src/Messaging/Configuration/MessageBrokerServiceConfiguration.cs

@@ -1,5 +1,18 @@
-// SPDX-FileCopyrightText: © 2022 MONAI Consortium
-// SPDX-License-Identifier: Apache License 2.0
+/*
+ * Copyright 2022 MONAI Consortium
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
 using Microsoft.Extensions.Configuration;