Update Copyright headers, add workflow to enforce (#4764)

* Add boilerplates for go,bash,yaml

This commit adds the boilerplates for the code. Included are headers
for go, yaml and shell scripts

Signed-off-by: Adolfo García Veytia (puerco) <[email protected]>

* Add license plate workflow

This commit adds a workflow to check for the license boilerplates
using chainguard-dev/action/boilerplates

Signed-off-by: Adolfo García Veytia (puerco) <[email protected]>

* Update copyright headers on all the codebase

This commit modifies all the go code and yaml files to update the copyright headers
to credit "The Minder Authors" and use SPDX License identifiers instead of text.

Signed-off-by: Adolfo García Veytia (puerco) <[email protected]>

* Fix mindpak hashes in tests

Signed-off-by: Adolfo García Veytia (puerco) <[email protected]>

* Temporarily remove migration check

This commit temporarily removes the migration check as we are altering all the files.
Once the copyright headers are updated, this PR will be reverted.

Signed-off-by: Adolfo García Veytia (puerco) <[email protected]>

* Make gen

---------

Signed-off-by: Adolfo García Veytia (puerco) <[email protected]>

.boilerplates/boilerplate.css.txt

@@ -0,0 +1,4 @@
+/*
+  SPDX-FileCopyrightText: Copyright YYYY The Minder Authors
+  SPDX-License-Identifier: Apache-2.0
+*/

.boilerplates/boilerplate.go.txt

@@ -0,0 +1,2 @@
+// SPDX-FileCopyrightText: Copyright YYYY The Minder Authors
+// SPDX-License-Identifier: Apache-2.0

.boilerplates/boilerplate.html.txt

@@ -0,0 +1,4 @@
+<!--
+ SPDX-FileCopyrightText: Copyright YYYY The Minder Authors
+ SPDX-License-Identifier: Apache-2.0
+-->

.boilerplates/boilerplate.sh.txt

@@ -0,0 +1,2 @@
+# SPDX-FileCopyrightText: Copyright YYYY The Minder Authors
+# SPDX-License-Identifier: Apache-2.0

.boilerplates/boilerplate.sql.txt

@@ -0,0 +1,2 @@
+-- SPDX-FileCopyrightText: Copyright YYYY The Minder Authors
+-- SPDX-License-Identifier: Apache-2.0

.boilerplates/boilerplate.yaml.txt

@@ -0,0 +1,2 @@
+# SPDX-FileCopyrightText: Copyright YYYY The Minder Authors
+# SPDX-License-Identifier: Apache-2.0

.boilerplates/boilerplate.yml.txt

@@ -0,0 +1,2 @@
+# SPDX-FileCopyrightText: Copyright YYYY The Minder Authors
+# SPDX-License-Identifier: Apache-2.0

.clusterfuzzlite/Dockerfile

@@ -1,18 +1,5 @@
-# Copyright 2024 Stacklok, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-################################################################################
+# SPDX-FileCopyrightText: Copyright 2024 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
 
 FROM gcr.io/oss-fuzz-base/base-builder-go
 COPY . $SRC/minder

.clusterfuzzlite/build.sh

@@ -1,19 +1,6 @@
 #!/bin/bash -eu
-# Copyright 2024 Stacklok, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-################################################################################
+# SPDX-FileCopyrightText: Copyright 2024 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
 
 # Download dependency and let the Go package manager do all the work
 printf "package main\nimport _ \"github.com/AdamKorcz/go-118-fuzz-build/testing\"\n" > ./cmd/cli/register.go

.clusterfuzzlite/project.yaml

@@ -1 +1,4 @@
+# SPDX-FileCopyrightText: Copyright 2024 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 language: go

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 name: Report a bug
 description: Tell us about a bug or issue you may have identified.
 title: "Provide a general summary of the issue"

.github/ISSUE_TEMPLATE/config.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 contact_links:
   - name: Ask the community
     url: https://discord.com/invite/RkzVuTp3WK

.github/ISSUE_TEMPLATE/enhancement.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 name: Feature request
 description: Suggest new or updated features to include in Minder.
 title: "Suggest a new feature"

.github/dependabot.yml

@@ -1,17 +1,5 @@
-#
-# Copyright 2023 Stacklok, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
 
 version: 2
 updates:

.github/workflows/boilerplates.yaml

@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: Copyright 2024 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
+name: Boilerplate
+
+on:
+  pull_request:
+    branches: [ 'main', 'release-*' ]
+
+jobs:
+
+  check:
+    name: Boilerplate Check
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        extension:
+        - go
+        - sh
+        - yaml
+        - yml
+        - html
+        - css
+
+        include:
+        - extension: go
+          language: Go
+        - extension: sh
+          language: Bash
+        - extension: yaml
+          language: YAML
+        - extension: yml
+          language: YAML
+        - extension: html
+          language: HTML
+        - extension: css
+          language: CSS
+        - extension: sql
+          language: SQL
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+
+      - uses: chainguard-dev/actions/boilerplate@main
+        with:
+          extension: ${{ matrix.extension }}
+          language: ${{ matrix.language }}
+          exclude: "/mock/|internal/db/|client.gen.go|.pb(.gw)?.go|docs/docs/|internal/auth/keycloak/client/"

.github/workflows/build.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   workflow_call:
 jobs:

.github/workflows/chart-publish.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 # Post-submit and daily build and publish of the Helm chart and Docker container
 # This is a separate workflow than image-build.yml because image-build.yml is
 # run in the PR context, and those runs aren't allowed package:write permissions if

.github/workflows/cifuzz.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 name: ClusterFuzzLite PR fuzzing
 on:
   workflow_dispatch:

.github/workflows/codeql.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 # For most projects, this workflow file will not need changing; you simply need
 # to commit it to your repository.
 #

.github/workflows/compose-migrate.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 # This test verifies that the docker-compose.yml file is valid and that the
 # containers can be started and stopped. It also verifies the database migrations.
 name: Compose Migrate test

.github/workflows/deploy-doc.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 name: Deploy docs to GitHub Pages
 on:
   workflow_dispatch:

.github/workflows/generation.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 name: Code Generation
 on:
   push:

.github/workflows/image-build.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   workflow_call: {}
 jobs:

.github/workflows/license-check.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   workflow_call:
 jobs:

.github/workflows/lint.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 name: Lint
 on:
   workflow_call:

.github/workflows/main.yml

@@ -1,17 +1,5 @@
-#
-# Copyright 2023 Stacklok, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
 
 # These set of workflows run on every push to the main branch
 name: Main

.github/workflows/pr-check.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 name: Pull Request Validation
 on:
   pull_request:

.github/workflows/pr.yml

@@ -1,17 +1,5 @@
-#
-# Copyright 2023 Stacklok, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
 
 # These set of workflows run on every pull request
 name: PR

.github/workflows/releaser.yml

@@ -1,18 +1,6 @@
-#
-# Copyright 2023 Stacklok, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 # This workflow compiles your minder server and client using a SLSA3 compliant
 # build and then verifies the provenance of the built artifacts.
 # It releases the following architectures: amd64, arm64, and armv7 on Linux, 

.github/workflows/security.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   workflow_call:
 jobs:

.github/workflows/stalebot.yml

@@ -1,17 +1,5 @@
-#
-# Copyright 2023 Stacklok, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
 
 # This action closes stale issues and PRs that have had no activity for a period of time.
 # Issues:

.github/workflows/tags.yml

@@ -1,17 +1,5 @@
-#
-# Copyright 2023 Stacklok, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
 
 name: Tags
 

.github/workflows/test-deploy-doc.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
+# SPDX-License-Identifier: Apache-2.0
+
 name: Test documentation
 on:
   workflow_call: