Add Licensed To Help Verify Prod Licenses (#128)

* Add Licensed Workflow and config

* manual validation of dependencies

* Ignore Generated Files in Git PR's

* update contributing.md
This commit is contained in:
Thomas Boop
2020-09-23 17:22:43 -04:00
committed by GitHub
parent 51d2bf1911
commit b9436a7e86
15 changed files with 320 additions and 167 deletions

View File

@ -26,6 +26,10 @@ During the commit step, Husky will take care of formatting all files with [Prett
We ask that you include a link to a successful run that utilizes the changes you are working on. For example, if your changes are in the branch `newAwesomeFeature`, then show an example run that uses `setup-python@newAwesomeFeature` or `my-fork@newAwesomeFeature`. This will help speed up testing and help us confirm that there are no breaking changes or bugs.
### Licensed
This repository uses a tool called [Licensed](https://github.com/github/licensed) to verify third party dependencies. You may need to locally install licensed and run `licensed cache` to update the dependency cache if you install or update a production dependency. If licensed cache is unable to determine the dependency, you may need to modify the cache file yourself to put the correct license. You should still verify the dependency, licensed is a tool to help, but is not a substitute for human review of dependencies.
### Releases
There is a `master` branch where contributor changes are merged into. There are also release branches such as `releases/v1` that are used for tagging (for example the `v1` tag) and publishing new versions of the action. Changes from `master` are periodically merged into a releases branch. You do not need to create any PR that merges changes from master into a releases branch.