Authenticate before pulling test images. Add a check to verify licens…

…e compliance. Enable Go report card and code scan badges.

.github/workflows/build-test-publish.yaml

@@ -57,8 +57,13 @@ jobs:
       - name: Install test dependencies
         run: |
           go install github.com/onsi/ginkgo/v2/[email protected]
+          go install github.com/google/[email protected]
         timeout-minutes: 5
 
+      - name: Verify license compliance and the NOTICE file is updated
+        run: |
+          make test-licenses
+
       - name: Run unit tests
         run: |
           ACK_GINKGO_DEPRECATIONS=1.16.5 TESTARGS="-v -ginkgo.v" make test
@@ -407,17 +412,17 @@ jobs:
         with:
           cosign-release: "v2.1.1"
 
-      - name: Pull tested CSI driver image from ghcr.io
-        run: |
-          docker pull ${{ env.TEST_IMAGE_NAME }}:${{ github.sha }}
-
       - name: Log in to the GitHub Container Registry
         uses: docker/login-action@v2
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Pull tested CSI driver image from ghcr.io
+        run: |
+          docker pull ${{ env.TEST_IMAGE_NAME }}:${{ github.sha }}
+
       # This uses the semantic versioning option for https://github.com/docker/metadata-action#semver
       - name: Extract metadata for CSI driver container image
         id: meta
@@ -507,7 +512,7 @@ jobs:
   cleanup-test-images:
     runs-on: ubuntu-22.04
     timeout-minutes: 3
-    needs: publish-images
+    needs: [publish-images, e2e-tests, operator-e2e-tests]
     if: always()
     steps:
       - name: Extract CSI driver test package name

Makefile

@@ -26,6 +26,10 @@ all: build
 check-go-version:
 	./hack/check-go-version.sh
 
+.PHONY: generate-notices
+generate-notices:
+	@go-licenses report ./cmd/beegfs-csi-driver ./cmd/chwrap --template hack/notice.tpl > NOTICE.md --ignore github.com/thinkparq
+
 # The kubernetes-csi/csi-release-tools project does not include an easy way to build a binary that doesn't need its
 # own container image and include it in a different image. This build-% recipe mirrors an analogous recipe in
 # release-tools/buildmake and allows us to explicitly build the binary specified by %.
@@ -52,6 +56,20 @@ bin/chwrap.tar: build-chwrap cmd/chwrap/chwrap.sh
 container: build-chwrap bin/chwrap.tar
 push: container  # not explicitly executed in release-tools/build.make
 
+# For details on what licenses are disallowed see
+# https://github.com/google/go-licenses#check 
+#
+# IMPORTANT: Any exceptions (using --ignore) such as the one for HCL must be
+# manually added AFTER the NOTICE file has been updated and/or other appropriate
+# steps have been taken based on the license requirements.
+test-licenses: generate-notices
+	@echo "Checking license compliance..."
+	@go-licenses check ./cmd/beegfs-csi-driver/ ./cmd/chwrap --ignore github.com/thinkparq --disallowed_types=forbidden,permissive,reciprocal,restricted,unknown
+	@if [ -n "$$(git status --porcelain NOTICE.md)" ]; then \
+        echo "NOTICE file is not up to date. Please run 'make generate-notices' and commit the changes."; \
+        exit 1; \
+    fi
+
 # Skip sanity tests that are known to fail. Use override directive to append to TESTARGS passed in on the command line. 
 # TODO(webere, A387): Correctly adhere to the CSI spec.
 override TESTARGS += -ginkgo.skip='Controller Service \[Controller Server\] CreateVolume should fail when requesting to create a volume with already existing name and different capacity'