feat(ci/license-check): check if specifed images have been manually l…

…icense checked

.github/scripts/licenseList

@@ -0,0 +1,70 @@
+docker.io/aelbakry/kdave-server;MIT;https://github.com/wayfair-incubator/kdave/blob/main/LICENSE
+docker.io/bats/bats;MIT;https://github.com/bats-core/bats-core/blob/master/LICENSE.md
+docker.io/bitnami/external-dns;Apache-2.0;https://hub.docker.com/r/bitnami/external-dns
+docker.io/bitnami/grafana-tempo;Apache-2.0;https://hub.docker.com/r/bitnami/grafana-tempo
+docker.io/bitnami/grafana-tempo-vulture;Apache-2.0;https://hub.docker.com/r/bitnami/grafana-tempo-vulture
+docker.io/bitnami/kubectl;Apache-2.0;https://hub.docker.com/r/bitnami/kubectl
+docker.io/bitnami/memcached;Apache-2.0;https://hub.docker.com/r/bitnami/memcached
+docker.io/bitnami/metrics-server;Apache-2.0;https://hub.docker.com/r/bitnami/metrics-server
+docker.io/bitnami/postgresql;PostgreSQL;https://www.postgresql.org/about/licence/
+docker.io/bitnami/redis;SSPL-1.0;https://redis.io/legal/licenses/
+docker.io/bitnami/zookeeper;Apache-2.0;https://zookeeper.apache.org/
+docker.io/busybox;GPL-2.0;http://www.busybox.net/license.html
+docker.io/ckan/ckan-base-datapusher;AGPL-3.0-only;https://github.com/ckan/datapusher
+docker.io/confluentinc/cp-kafka;Apache-2.0;https://github.com/confluentinc/kafka-images/blob/master/LICENSE
+docker.io/curlimages/curl;curl;https://curl.se/docs/copyright.html
+docker.io/emberstack/kubernetes-reflector;MIT;https://github.com/emberstack/kubernetes-reflector/blob/main/LICENSE
+docker.io/fluxcd/flux-cli;Apache-2.0;https://github.com/fluxcd/flux2/blob/main/LICENSE
+docker.io/grafana/grafana;AGPL-3.0-only;https://github.com/grafana/grafana/blob/main/LICENSING.md
+docker.io/grafana/grafana-image-renderer;Apache-2.0;https://github.com/grafana/grafana-image-renderer/blob/master/LICENSE
+docker.io/grafana/loki;AGPL-3.0;https://github.com/grafana/loki/blob/main/LICENSE
+docker.io/grafana/promtail;AGPL-3.0;https://github.com/grafana/loki/blob/main/tools/LICENSE_APACHE2
+docker.io/hjacobs/kube-janitor;AGPL-3.0;https://github.com/hjacobs/kube-janitor/blob/main/LICENSE
+docker.io/otel/opentelemetry-collector-contrib;Apache-2.0;https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/LICENSE
+docker.io/stellio/stellio-api-gateway;Apache-2.0;https://github.com/stellio-hub/stellio-context-broker/blob/develop/LICENSE.txt
+docker.io/stellio/stellio-search-service;Apache-2.0;https://github.com/stellio-hub/stellio-context-broker/blob/develop/LICENSE.txt
+docker.io/stellio/stellio-subscription-service;Apache-2.0;https://github.com/stellio-hub/stellio-context-broker/blob/develop/LICENSE.txt
+docker.io/stellio/stellio-timescale-postgis;Apache-2.0;https://github.com/stellio-hub/stellio-context-broker/blob/develop/LICENSE.txt
+docker.io/velero/velero;Apache-2.0;https://github.com/vmware-tanzu/velero-plugin-for-aws/blob/main/LICENSE
+docker.io/velero/velero-plugin-for-aws;Apache-2.0;https://github.com/vmware-tanzu/velero-plugin-for-aws/blob/main/LICENSE
+docker.io/vladgh/gpg;Apache-2.0;https://github.com/vladgh/docker_base_images/blob/main/LICENSE
+ghcr.io/aquasecurity/trivy-operator;Apache-2.0;https://github.com/aquasecurity/trivy-operator/blob/main/LICENSE
+ghcr.io/kyverno/background-controller;Apache-2.0;https://github.com/kyverno/kyverno/pkgs/container/background-controller
+ghcr.io/kyverno/cleanup-controller;Apache-2.0;https://github.com/kyverno/kyverno/pkgs/container/cleanup-controller
+ghcr.io/kyverno/kyverno;Apache-2.0;https://github.com/kyverno/kyverno/pkgs/container/kyverno
+ghcr.io/kyverno/kyverno-cli;Apache-2.0;https://github.com/kyverno/kyverno/pkgs/container/kyverno-cli
+ghcr.io/kyverno/kyvernopre;Apache-2.0;https://github.com/kyverno/kyverno/pkgs/container/kyvernopre
+ghcr.io/kyverno/reports-controller;Apache-2.0;https://github.com/kyverno/kyverno/pkgs/container/reports-controller
+ghcr.io/teutonet/oci-images/ckan;MIT;https://github.com/teutonet/oci-images/blob/main/LICENSE
+ghcr.io/teutonet/oci-images/solr-ckan;MIT;https://github.com/teutonet/oci-images/blob/main/LICENSE
+k8s.gcr.io/sig-storage/csi-attacher;Apache-2.0;https://github.com/kubernetes-csi/external-attacher/blob/master/LICENSE
+k8s.gcr.io/sig-storage/csi-node-driver-registrar;Apache-2.0;https://github.com/kubernetes-csi/node-driver-registrar/blob/master/LICENSE
+k8s.gcr.io/sig-storage/csi-provisioner;Apache-2.0;https://github.com/kubernetes-csi/external-provisioner/blob/master/LICENSE
+k8s.gcr.io/sig-storage/csi-resizer;Apache-2.0;https://github.com/kubernetes-csi/external-resizer/blob/master/LICENSE
+k8s.gcr.io/sig-storage/csi-snapshotter;Apache-2.0;https://github.com/kubernetes-csi/external-snapshotter/blob/master/LICENSE
+k8s.gcr.io/sig-storage/livenessprobe;Apache-2.0;https://github.com/kubernetes-csi/livenessprobe/blob/master/LICENSE
+quay.io/cilium/cilium;Apache-2.0;https://github.com/cilium/cilium/blob/main/LICENSE
+quay.io/cilium/cilium-envoy;Apache-2.0;https://github.com/cilium/cilium/blob/main/LICENSE
+quay.io/cilium/hubble-relay;Apache-2.0;https://github.com/cilium/cilium/blob/main/LICENSE
+quay.io/cilium/hubble-ui;Apache-2.0;https://github.com/cilium/cilium/blob/main/LICENSE
+quay.io/cilium/hubble-ui-backend;Apache-2.0;https://github.com/cilium/hubble-ui/blob/master/LICENSE
+quay.io/cilium/operator-generic;Apache-2.0;https://hub.docker.com/r/cilium/operator-generic
+quay.io/jetstack/cert-manager-cainjector;Apache-2.0;https://github.com/cert-manager/cert-manager/blob/master/LICENSE
+quay.io/jetstack/cert-manager-controller;Apache-2.0;https://github.com/cert-manager/cert-manager/blob/master/LICENSE
+quay.io/jetstack/cert-manager-startupapicheck;Apache-2.0;https://github.com/cert-manager/cert-manager/blob/master/LICENSE
+quay.io/jetstack/cert-manager-webhook;Apache-2.0;https://github.com/cert-manager/cert-manager/blob/master/LICENSE
+quay.io/kiwigrid/k8s-sidecar;MIT;https://github.com/kiwigrid/k8s-sidecar/blob/master/LICENSE
+quay.io/prometheus/alertmanager;Apache-2.0;https://github.com/prometheus/alertmanager/blob/main/LICENSE
+quay.io/prometheus/node-exporter;Apache-2.0;https://github.com/prometheus/node_exporter/blob/master/LICENSE
+quay.io/prometheus-operator/prometheus-operator;Apache-2.0;https://github.com/prometheus-operator/prometheus-operator/blob/main/LICENSE
+quay.io/prometheus/prometheus;Apache-2.0;https://github.com/prometheus/prometheus/blob/main/LICENSE
+registry-gitlab.teuto.net/4teuto/dev/teuto-portal/teuto-portal-k8s-worker/teuto-portal-k8s-worker;Apache-2.0;https://gitlab.teuto.net/4teuto/dev/teuto-portal/teuto-portal-k8s-worker/-/blob/main/gradlew?ref_type=heads
+registry.k8s.io/descheduler/descheduler;Apache-2.0;https://github.com/kubernetes-sigs/descheduler/blob/master/LICENSE
+registry.k8s.io/etcd;Apache-2.0;https://github.com/kubernetes/kubernetes/blob/master/LICENSE
+registry.k8s.io/ingress-nginx/controller;Apache-2.0;https://github.com/kubernetes/ingress-nginx/blob/main/LICENSE
+registry.k8s.io/ingress-nginx/kube-webhook-certgen;Apache-2.0;https://github.com/kubernetes/ingress-nginx/blob/main/LICENSE
+registry.k8s.io/ingress-nginx/opentelemetry-1.25.3;Apache-2.0;https://github.com/kubernetes/ingress-nginx/blob/main/LICENSE
+registry.k8s.io/kube-state-metrics/kube-state-metrics;Apache-2.0;https://github.com/kubernetes/kube-state-metrics/blob/main/LICENSE
+registry.k8s.io/provider-os/cinder-csi-plugin;Apache-2.0;https://github.com/kubernetes/cloud-provider-openstack/blob/master/LICENSE
+registry.k8s.io/provider-os/openstack-cloud-controller-manager;Apache-2.0;https://github.com/kubernetes/cloud-provider-openstack/blob/master/LICENSE
+registry.k8s.io/sig-storage/nfs-provisioner;Apache-2.0;https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner/blob/master/LICENSE

.github/workflows/check-licenses.yaml

@@ -1,4 +1,4 @@
-name: Lint Helm Charts
+name: Check used licenses
 
 on:
   pull_request:
@@ -23,3 +23,18 @@ jobs:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - run: pip install yq
       - run: ./.github/scripts/scan-for-licenses.sh ${{ needs.getChangedChart.outputs.chart }}
+  check-licenses-list:
+    name: check licenses from list
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - run: pip install yq
+      - run: |
+          mapfile -t IMAGES < <(for chart in charts/*; do if [[ -f "$chart/Chart.yaml" ]]; then yq -r '.annotations["artifacthub.io/images"] // ""' <"$chart/Chart.yaml" ; fi; done | cut -d ":" -f2 | uniq | sort | sed '/^$/d')
+          #shellcheck disable=SC2068
+          mapfile -t RESULT < <(for IMAGE in ${IMAGES[@]}; do grep -q "$IMAGE" ./.github/scripts/licenseList || (echo "$IMAGE";); done;)
+          if [[ -n "${RESULT[*]}" ]]; then
+            echo "The following images are not accepted, please review:"
+            printf "%s\n" "${RESULT[@]}"
+            exit 1
+          fi