Add go licenses to licenses.txt (#21034)

`make go-licenses` will generate `assets/go-licenses.json` which is then included in the webpack build. 

This step depends on both go and node being present, so unfortunately, I could not automate the generation by hooking it up to `tidy` as that target is triggered on CI where we do not have a docker image with both go an node.

It should be ran from time to time, ideally after each go mod update.

.drone.yml

@@ -90,7 +90,10 @@ steps:
   - name: checks-backend
     image: golang:1.19
     commands:
+      - curl -sL https://deb.nodesource.com/setup_18.x | bash - && apt-get -qqy install nodejs
       - make checks-backend
+    environment:
+      DEBIAN_FRONTEND: noninteractive
     depends_on: [deps-backend]
     volumes:
       - name: deps
@@ -722,12 +725,13 @@ steps:
     pull: always
     commands:
       # Upgrade to node 18 once https://github.com/techknowlogick/xgo/issues/163 is resolved
-      - curl -sL https://deb.nodesource.com/setup_16.x | bash - && apt-get install -y nodejs
+      - curl -sL https://deb.nodesource.com/setup_16.x | bash - && apt-get -qqy install nodejs
       - export PATH=$PATH:$GOPATH/bin
       - make release
     environment:
       GOPROXY: https://goproxy.io # proxy.golang.org is blocked in China, this proxy is not
       TAGS: bindata sqlite sqlite_unlock_notify
+      DEBIAN_FRONTEND: noninteractive
     volumes:
       - name: deps
         path: /go
@@ -842,12 +846,13 @@ steps:
     pull: always
     commands:
       # Upgrade to node 18 once https://github.com/techknowlogick/xgo/issues/163 is resolved
-      - curl -sL https://deb.nodesource.com/setup_16.x | bash - && apt-get install -y nodejs
+      - curl -sL https://deb.nodesource.com/setup_16.x | bash - && apt-get -qqy install nodejs
       - export PATH=$PATH:$GOPATH/bin
       - make release
     environment:
       GOPROXY: https://goproxy.io # proxy.golang.org is blocked in China, this proxy is not
       TAGS: bindata sqlite sqlite_unlock_notify
+      DEBIAN_FRONTEND: noninteractive
     depends_on: [fetch-tags]
     volumes:
       - name: deps

.gitignore

@@ -95,6 +95,7 @@ cpu.out
 !/web_src/fomantic/build/themes/default/assets/fonts/outline-icons.woff2
 /VERSION
 /.air
+/.go-licenses
 
 # Snapcraft
 snap/.snapcraft/

Makefile

@@ -34,6 +34,7 @@ GXZ_PAGAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.10
 MISSPELL_PACKAGE ?= github.com/client9/misspell/cmd/misspell@v0.3.4
 SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.30.0
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
+GO_LICENSES_PACKAGE ?= github.com/google/go-licenses@v1.3.0
 
 DOCKER_IMAGE ?= gitea/gitea
 DOCKER_TAG ?= latest
@@ -114,13 +115,16 @@ SVG_DEST_DIR := public/img/svg
 
 AIR_TMP_DIR := .air
 
+GO_LICENSE_TMP_DIR := .go-licenses
+GO_LICENSE_FILE := assets/go-licenses.json
+
 TAGS ?=
 TAGS_SPLIT := $(subst $(COMMA), ,$(TAGS))
 TAGS_EVIDENCE := $(MAKE_EVIDENCE_DIR)/tags
 
 TEST_TAGS ?= sqlite sqlite_unlock_notify
 
-TAR_EXCLUDES := .git data indexers queues log node_modules $(EXECUTABLE) $(FOMANTIC_WORK_DIR)/node_modules $(DIST) $(MAKE_EVIDENCE_DIR) $(AIR_TMP_DIR)
+TAR_EXCLUDES := .git data indexers queues log node_modules $(EXECUTABLE) $(FOMANTIC_WORK_DIR)/node_modules $(DIST) $(MAKE_EVIDENCE_DIR) $(AIR_TMP_DIR) $(GO_LICENSE_TMP_DIR)
 
 GO_DIRS := cmd tests models modules routers build services tools
 
@@ -199,8 +203,9 @@ help:
 	@echo " - generate-swagger                 generate the swagger spec from code comments"
 	@echo " - swagger-validate                 check if the swagger spec is valid"
 	@echo " - golangci-lint                    run golangci-lint linter"
+	@echo " - go-licenses                      regenerate go licenses"
 	@echo " - vet                              examines Go source code and reports suspicious constructs"
-	@echo " - tidy                             run go mod tidy"
+	@echo " - tidy                             run go mod tidy and regenerate go licenses"
 	@echo " - test[\#TestSpecificName]    	    run unit test"
 	@echo " - test-sqlite[\#TestSpecificName]  run integration test for sqlite"
 	@echo " - pr#<index>                       build and start gitea from a PR with integration test data loaded"
@@ -393,6 +398,7 @@ unit-test-coverage:
 tidy:
 	$(eval MIN_GO_VERSION := $(shell grep -Eo '^go\s+[0-9]+\.[0-9.]+' go.mod | cut -d' ' -f2))
 	$(GO) mod tidy -compat=$(MIN_GO_VERSION)
+	@$(MAKE) --no-print-directory assets/go-licenses.json
 
 .PHONY: vendor
 vendor: tidy
@@ -407,6 +413,14 @@ tidy-check: tidy
 		exit 1; \
 	fi
 
+.PHONY: go-licenses
+go-licenses: assets/go-licenses.json
+
+assets/go-licenses.json: go.mod go.sum build/generate-go-licenses.js
+	-$(GO) run $(GO_LICENSES_PACKAGE) save . --force --save_path="$(GO_LICENSE_TMP_DIR)" 2>/dev/null
+	node build/generate-go-licenses.js "$(GO_LICENSE_TMP_DIR)" "$(GO_LICENSE_FILE)"
+	@rm -rf "$(GO_LICENSE_TMP_DIR)"
+
 generate-ini-sqlite:
 	sed -e 's|{{REPO_TEST_DIR}}|${REPO_TEST_DIR}|g' \
 		-e 's|{{TEST_LOGGER}}|$(or $(TEST_LOGGER),test$(COMMA)file)|g' \
@@ -782,6 +796,7 @@ deps-backend:
 	$(GO) install $(MISSPELL_PACKAGE)
 	$(GO) install $(SWAGGER_PACKAGE)
 	$(GO) install $(XGO_PACKAGE)
+	$(GO) install $(GO_LICENSES_PACKAGE)
 
 node_modules: package-lock.json
 	npm install --no-save

build/generate-go-licenses.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import fastGlob from 'fast-glob';
+import {fileURLToPath} from 'url';
+import {readFileSync, writeFileSync} from 'fs';
+import wrapAnsi from 'wrap-ansi';
+import {join, dirname} from 'path';
+
+const base = process.argv[2];
+const out = process.argv[3];
+
+function exit(err) {
+  if (err) console.error(err);
+  process.exit(err ? 1 : 0);
+}
+
+async function main() {
+  const data = fastGlob.sync('**/*', {
+    cwd: fileURLToPath(new URL(`../${base}`, import.meta.url)),
+  }).filter((path) => {
+    return /\/((UN)?LICEN(S|C)E|COPYING|NOTICE)/i.test(path);
+  }).sort().map((path) => {
+    return {
+      name: dirname(path),
+      body: wrapAnsi(readFileSync(join(base, path), 'utf8') || '', 80)
+    };
+  });
+  writeFileSync(out, JSON.stringify(data, null, 2));
+}
+
+main().then(exit).catch(exit);

webpack.config.js

@@ -9,6 +9,7 @@ import EsBuildLoader from 'esbuild-loader';
 import {parse, dirname} from 'path';
 import webpack from 'webpack';
 import {fileURLToPath} from 'url';
+import {readFileSync} from 'fs';
 
 const {VueLoaderPlugin} = VueLoader;
 const {ESBuildMinifyPlugin} = EsBuildLoader;
@@ -205,10 +206,16 @@ export default {
       outputFilename: 'js/licenses.txt',
       outputWriter: ({dependencies}) => {
         const line = '-'.repeat(80);
-        return dependencies.map((module) => {
-          const {name, version, licenseName, licenseText} = module;
+        const goModules = JSON.parse(readFileSync('assets/go-licenses.json', 'utf8'));
+        const jsModules = dependencies.map(({name, version, licenseName, licenseText}) => {
           const body = wrapAnsi(licenseText || '', 80);
-          return `${line}\n${name}@${version} - ${licenseName}\n${line}\n${body}`;
+          return {name, version, licenseName, body};
+        });
+
+        const modules = [...goModules, ...jsModules].sort((a, b) => a.name.localeCompare(b.name));
+        return modules.map(({name, version, licenseName, body}) => {
+          const title = licenseName ? `${name}@${version} - ${licenseName}` : name;
+          return `${line}\n${title}\n${line}\n${body}`;
         }).join('\n');
       },
       override: {