Add license checker

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

.github/workflows/make.yaml

@@ -104,6 +104,16 @@ jobs:
             coverage.html
           retention-days: 30
       - run: "make lint"
+      - name: "Scan licenses"
+        uses: "aquasecurity/trivy-action@0.28.0"
+        with:
+          scan-type: "fs"
+          scanners: "license"
+          severity: "UNKNOWN,HIGH,CRITICAL"
+          exit-code: 1
+          ignorefile: ".trivyignore.yaml"
+          trivy-config: "trivy.yaml"
+          license-full: true
 
   test-e2e:
     name: "test-e2e"

.trivyignore.yaml

@@ -0,0 +1,8 @@
+# Trivy ignore file
+# https://trivy.dev/docs/latest/configuration/filtering/
+
+licenses:
+  # n8n packages - manually reviewed, custom license acceptable for our use case
+  - id: "SEE LICENSE IN LICENSE.md"
+    paths:
+      - "package-lock.json"

GNUmakefile

@@ -3,6 +3,7 @@ CP ?=	cp
 DOCKER ?=	docker
 GO ?=	go
 GRYPE ?=	grype
+TRIVY ?=	trivy
 MKCERT ?=	mkcert
 MKDIR ?=	mkdir -p
 NPM ?=	npm
@@ -135,6 +136,10 @@ scan-docker: docker-build
 .PHONY: scan
 scan: scan-sbom scan-sbom-docker scan-docker
 
+.PHONY: scan-license
+scan-license: ## Check dependencies licenses compliance
+	$(TRIVY) fs --license-full --scanners license --ignorefile .trivyignore.yaml --severity UNKNOWN,HIGH,CRITICAL --exit-code 1 .
+
 .PHONY: docker-build
 docker-build:
 	$(DOCKER_BUILD) --tag $(DOCKER_IMAGE_NAME):$(DOCKER_TAG_NAME) --file Dockerfile .

trivy.yaml

@@ -0,0 +1,32 @@
+scan:
+  scanners:
+    - license
+
+license:
+  forbidden:
+    - AGPL-1.0
+    - AGPL-3.0
+    - GPL-1.0
+    - GPL-2.0
+    - GPL-3.0
+    - LGPL-2.0
+    - LGPL-2.1
+    - LGPL-3.0
+
+  notice:
+    - MIT
+    - Apache-2.0
+    - BSD-2-Clause
+    - BSD-3-Clause
+    - ISC
+    - CC0-1.0
+    - Unlicense
+    - 0BSD
+    - BlueOak-1.0.0
+
+  reciprocal:
+    - MPL-2.0
+
+  include-dev-deps: false
+
+  confidence-level: 0.9