chore(deps): Update GitHub Actions #79
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # REUSE Compliance Check for Claude Code Configuration | |
| # Validates REUSE 3.0 specification compliance for license management | |
| # | |
| # REUSE helps with clear licensing by using SPDX headers | |
| # Documentation: https://reuse.software/ | |
| name: REUSE Compliance | |
| on: | |
| pull_request: | |
| paths: | |
| - "**/*" | |
| - "REUSE.toml" | |
| - "LICENSES/**" | |
| - ".github/workflows/reuse.yml" | |
| push: | |
| branches: | |
| - main | |
| - master | |
| - develop | |
| permissions: | |
| contents: read | |
| jobs: | |
| reuse: | |
| name: Check REUSE Compliance | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner | |
| uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Stage cookiecutter template tree out of REUSE scope | |
| # The {{cookiecutter.project_slug}}/ tree contains REUSE.toml and | |
| # other files with literal Jinja2 placeholders like | |
| # {{cookiecutter.license}} that are NOT valid SPDX identifiers until | |
| # cookiecutter renders them. Move the entire template tree out of | |
| # the workspace before REUSE runs, then put it back. Subsequent | |
| # jobs check out the repo fresh, so this move only affects the | |
| # current job. | |
| run: | | |
| if [ -d "{{cookiecutter.project_slug}}" ]; then | |
| mv "{{cookiecutter.project_slug}}" "/tmp/cc-template-tree" | |
| echo "Staged template tree out of REUSE scope." | |
| fi | |
| - name: REUSE Compliance Check | |
| uses: fsfe/reuse-action@3ae3c6bdf1257ab19397fab11fd3312144692083 # v4.0.0 | |
| - name: Restore cookiecutter template tree | |
| if: always() | |
| run: | | |
| if [ -d "/tmp/cc-template-tree" ]; then | |
| mv "/tmp/cc-template-tree" "{{cookiecutter.project_slug}}" | |
| echo "Restored template tree." | |
| fi | |
| - name: Generate REUSE SPDX | |
| if: success() | |
| run: | | |
| docker run --rm --volume $(pwd):/data fsfe/reuse:latest spdx --output /data/reuse-spdx.json | |
| - name: Upload REUSE SPDX | |
| if: success() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: reuse-spdx | |
| path: reuse-spdx.json | |
| retention-days: 90 | |
| validate-licenses: | |
| name: Validate License Files | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner | |
| uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Check primary license exists | |
| run: | | |
| if [ ! -f "LICENSES/MIT.txt" ]; then | |
| echo "Warning: MIT.txt not found in LICENSES/" | |
| echo "You may need to download it from https://spdx.org/licenses/" | |
| fi | |
| - name: Verify REUSE.toml exists | |
| run: | | |
| if [ ! -f "REUSE.toml" ]; then | |
| echo "Error: REUSE.toml missing from repository root" | |
| exit 1 | |
| fi |