search

sonatype-nexus-community / nancy

A tool to check for vulnerabilities in your Golang dependencies, powered by Sonatype OSS Index
Apache License 2.0
564 stars 74 forks source link

docs: apply copyright header #112

Closed nblair closed 4 years ago

nblair commented 4 years ago

This pull request uses our internal tooling (based off of the license-maven-plugin) to consistently apply the copyright at the top of source in this repository.

cc @bhamail / @DarthHater

zendern commented 4 years ago

Or even just work it into ci someway ??

DarthHater commented 4 years ago

@zendern we have it setup on the "private" side, I imagine we could come up with something for it that's public though. The private side uses a maven plugin to accomplish it, which is funny at some level

zendern commented 4 years ago

@zendern we have it setup on the "private" side, I imagine we could come up with something for it that's public though. The private side uses a maven plugin to accomplish it, which is funny at some level

Cool... yeah even as simple as a bot that checks for licenses at build time would be cool. Speaking of java tooling I’ve used checkstyle to validate license compliance and force manual addition of the headers cause the build would not pass.

Here is an example config https://github.com/micronaut-projects/micronaut-acme/tree/master/config/checkstyle

And then the gradle magic that wires up that config

https://github.com/micronaut-projects/micronaut-acme/blob/69f8d0f11ead4b25f731d610efaea49bcd356ec1/build.gradle#L167

fitzoh commented 4 years ago

@nblair Are you planning on having jenkins apply checks on this repo?

DarthHater commented 4 years ago

@fitzoh we have jenkins setup to do a IQ policy scan, and this too (since it comes for free)

fitzoh commented 4 years ago

Cool, just making sure there weren't plans to add a github check that external people can't see/click through

DarthHater commented 4 years ago

@fitzoh negative, that's not my plan, and to be honest why I avoided doing a lot of this work. I love the public nature of this project and adding anything that others can't see or benefit from doesn't excite me.

nblair commented 4 years ago

is there a command that was used to automate this update? Could we document said command?

There is, but it depends on a Sonatype docker instance. Let me see if I can cook up a public equivalent.

nblair commented 4 years ago

The command uses the license-maven-plugin. What do you think of adding a thin pom.xml with the required configuration and the maven wrapper to execute?

Another option would be to craft some sort of bot to automatically apply header changes and commit them to master.

Other ideas?

fitzoh commented 4 years ago

Might be worth looking at https://github.com/google/addlicense

nblair commented 4 years ago

Might be worth looking at https://github.com/google/addlicense

Nice find @fitzoh - that does the trick, see ca5507b (cc @bhamail).