Add 3PP license check as part of PR CI

The license check can be triggered locally:
  yarn license:check

For automatic opening of IP tickets for suspicious depedencies, set an
Eclipse Foundation gitlab token as environment variable "DASH_TOKEN" and
run the alternate pacakge.json script. e.g.:
  export DASH_TOKEN="<your token>"
  yarn license:check:reviewAdd 3PP license check as part of PR CI

Closes #1040

Signed-off-by: Marc Dumais <marc.dumais@ericsson.com>

.github/workflows/license-check-workflow.yml

@@ -0,0 +1,52 @@
+name: 3PP License Check
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - master
+  schedule:
+    - cron: '0 4 * * *' # Runs every day at 4am: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#scheduled-events-schedule
+
+jobs:
+
+  License-check:
+    name: 3PP License Check using dash-licenses
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        node: [16]
+        java: [11]
+
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 2
+
+      - name: Use Node.js ${{ matrix.node }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Use Java ${{ matrix.java }}
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'adopt'
+          java-version: ${{ matrix.java }}
+
+      - name: Run dash-licenses
+        shell: bash
+        run: |
+          yarn --frozen-lockfile --ignore-scripts
+          yarn license:check
+        env:
+          DASH_TOKEN: ${{ secrets.DASH_LICENSES_PAT }}

.gitignore

@@ -17,3 +17,5 @@ node_modules/
 theia-extensions/viewer-prototype/lib/
 trace-compass-server
 trace-compass-server.tar.gz
+license-check-summary.txt*
+e

configs/license-check-config.json

@@ -0,0 +1,8 @@
+{
+    "project": "ecd.cdt-cloud",
+    "review": false,
+    "inputFile": "yarn.lock",
+    "batch": 50,
+    "timeout": 200,
+    "summary": "license-check-summary.txt"
+}

package.json

@@ -24,7 +24,9 @@
     "format:write": "lerna run format:write",
     "format:check": "lerna run format:check",
     "browser": "yarn -s --cwd examples/browser",
-    "electron": "yarn -s --cwd examples/electron"
+    "electron": "yarn -s --cwd examples/electron",
+    "license:check": "npx dash-licenses-wrapper  --configFile=./configs/license-check-config.json",
+    "license:check:review": "npx dash-licenses-wrapper  --configFile=./configs/license-check-config.json --review"
   },
   "keywords": [
     "theia-extension",
@@ -48,6 +50,7 @@
     "@types/react-dom": "^18.0.6"
   },
   "devDependencies": {
+    "@eclipse-dash/nodejs-wrapper": "^0.0.1",
     "@theia/cli": "1.43.1",
     "concurrently": "^8.2.1",
     "jsonc-parser": "^3.0.0",