add license check

[stan-dot]

Fixes #825

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.58%. Comparing base (e673dbf) to head (8fbd3bf).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #861   +/-   ##
=======================================
  Coverage   95.58%   95.58%           
=======================================
  Files         125      125           
  Lines        5419     5419           
=======================================
  Hits         5180     5180           
  Misses        239      239           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[DiamondJoseph]

This is only run on release- shouldn't we be checking during the PR to add the dependency?

[stan-dot]

good question @DiamondJoseph

I'd say yes the footwork should be done beforehand. The license check in the release is more just for a sanity check, it does not need to happen at the early stage.

two layers > one

[DiamondJoseph]

What I mean @stan-dot is that this action should be run during the PR, not that it should be part of the review process. If we add a dependency that is not licensed, then we make use of it it'll be difficult to extract after the fact. I'd expect this PR to have triggered a new check so that we could see if we are not already non-compliant.

[stan-dot]

fair enough @DiamondJoseph , where exactly do you consider it is best to run it then? before the lint? after the test?

[DiamondJoseph]

It's independent of those, it's just another workflow to be run. Make it a new _license.yml in .github/workflows and add it to run alongside lint and test in ci.yml

[coretl]

This doesn't appear to be working, there is no license.json uploaded as an artifact from the job...

[DiamondJoseph]