Add review dependencies workflow to CI (#848)

Signed-off-by: Austin Vazquez <[email protected]>

.github/dependency-review-config.yml

@@ -0,0 +1,8 @@
+# Fail third party dependency usage if not covered by the curated set of pre-approved licenses.
+#
+# List was generated from guidance set forth by Amazon open source usage policies.
+allow-licenses:
+  - 'Apache-2.0'
+  - 'BSD-3-Clause'
+  - 'ISC'
+  - 'MIT'

.github/workflows/build.yaml

@@ -26,16 +26,6 @@ jobs:
           git secrets --register-aws
           git secrets --scan-history
 
-  licensing:
-    runs-on: 'ubuntu-22.04'
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-      - name: Install go-licenses
-        run: make get-deps
-      - name: Check licensing
-        run: make check-licenses
-
   cross-compile:
     runs-on: 'ubuntu-22.04'
     steps:

.github/workflows/review-dependencies.yml

@@ -0,0 +1,24 @@
+name: Review dependencies
+
+on:
+  pull_request:
+    branches: ['main', 'release/**']
+    paths:
+      - 'ecr-login/go.*'
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+
+    permissions:
+      # Write permissions needed to comment review results on PR.
+      # Pwn request risk mitigated by using pull_request workflow trigger
+      # and external contributor workflow runs require maintainer approval.
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v4
+        with:
+          config-file: './.github/dependency-review-config.yml'
+          comment-summary-in-pr: always

Makefile

@@ -117,19 +117,11 @@ gogenerate:
 .PHONY: get-deps
 get-deps:
 	go install golang.org/x/tools/cmd/goimports@698251aaa532d49ac69d2c416b0241afb2f65ea5
-	go install github.com/google/go-licenses@5348b744d0983d85713295ea08a20cca1654a45e
 
 .PHONY: licenses
 licenses:
 	./scripts/build_third_party_licenses.sh
 
-.PHONY: check
-check: check-licenses
-
-.PHONY: check-licenses
-check-licenses:
-	./scripts/check_third_party_licenses.sh
-
 .PHONY: clean
 clean:
 	- rm -rf ./bin