Copyright notice and whitespace check (#78)

soumeh01 · web-flow · commit 4d8e9e727804 · 2025-06-02T08:43:22.000+02:00
diff --git a/.github/workflows/check-copyright.yml b/.github/workflows/check-copyright.yml
@@ -0,0 +1,36 @@
+name: check copyright
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/check-copyright.yml'
+      - '.pre-commit-config.yaml'
+      - 'scripts/check_copyright_notice.py'
+      - '**/*.go'
+      - '!**/docs/**/*'
+      - '!**/*.md'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  copyright:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout devtools
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Check copyright notice
+        run: |
+          pip install \
+            pre-commit \
+            comment-parser>=1.2.3
+          pre-commit run --all-files
diff --git a/.github/workflows/markdown.yml b/.github/workflows/markdown.yml
@@ -55,4 +55,3 @@ jobs:
           use-verbose-mode: 'yes'
           base-branch: ${{ github.base_ref }}
           config-file: '.github/markdown-link-check.jsonc'
-
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -121,7 +121,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install \
             ninja-build
-  
+
       - name: Install windows deps
         if: ${{ startsWith(matrix.platform, 'windows') }}
         run: choco install -y ninja
@@ -182,7 +182,7 @@ jobs:
         with:
           files: "artifacts/**/vidx2pidx-testreport-*.xml"
           report_individual_runs: true
-        
+
   coverage:
     if: ${{ github.workflow != 'Release' && github.repository == 'Open-CMSIS-Pack/vidx2pidx' }}
     needs: [ test ]
diff --git a/.github/workflows/tpip-check.yml b/.github/workflows/tpip-check.yml
@@ -51,7 +51,7 @@ jobs:
         run:  |
           go-licenses report . --ignore github.com/Open-CMSIS-Pack/vidx2pidx --template ../scripts/template/${{ env.tpip_report }}.template > ../${{ env.tpip_report }}
         working-directory: ./cmd
-        
+
       - name: Archive TPIP report
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
diff --git a/.goreleaser.yml b/.goreleaser.yml
@@ -27,5 +27,3 @@ archives:
     # You can also set it to a custom folder name (templating is supported).
     # Default is false.
     wrap_in_directory: true
-
-
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -0,0 +1,19 @@
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.5.0
+  hooks:
+    - id: end-of-file-fixer
+      name: Fix end of files
+      description: Ensures files end with a newline
+    - id: trailing-whitespace
+      name: Check for trailing whitespace
+      description: Fails and fix files with trailing whitespace
+
+- repo: local
+  hooks:
+    - id: check-copyright-notice
+      name: Check for copyright notice
+      description: Ensures source files include a copyright notice
+      entry: python3 scripts/check_copyright_notice.py
+      language: system
+      types: [go]
diff --git a/DEVELOPING.md b/DEVELOPING.md
@@ -53,4 +53,4 @@ If you have push access to the `main` branch, you can create a new release by ru
 make release
 ```
 
-📌 **Note:** We follow [Semantic Versioning](https://semver.org/) for versioning `vidx2pidx`.  
+📌 **Note:** We follow [Semantic Versioning](https://semver.org/) for versioning `vidx2pidx`.
diff --git a/README.md b/README.md
@@ -55,7 +55,7 @@ Just head to the release page and download the binary for your system.
   $ vidx2pidx <index>.vidx
 
   Options:
-  
+
     -h, --help        show usage and help info
     -V, --version     show version and copyright info
     -v, --verbose     show progress details
diff --git a/SECURITY.md b/SECURITY.md
@@ -1,3 +1,3 @@
-# Security  
+# Security
 
 For reporting security issues, please follow the official guidelines outlined in [SECURITY.md](https://github.com/Open-CMSIS-Pack/cmsis-toolbox/blob/main/SECURITY.md).
diff --git a/makefile b/makefile
@@ -65,7 +65,7 @@ test:
 
 test-all: format-check coverage-check lint
 
-coverage-report: 
+coverage-report:
 	TESTING=1 go test ./... -coverprofile cover.out
 	go tool cover -html=cover.out
 
diff --git a/scripts/check_copyright_notice.py b/scripts/check_copyright_notice.py
@@ -0,0 +1,83 @@
+# -------------------------------------------------------
+# SPDX-License-Identifier: Apache-2.0
+# Copyright Contributors to the vidx2pidx project.
+# -------------------------------------------------------
+
+"""
+Checks the presence of copyright notice in the files
+"""
+
+from typing import Optional, Sequence
+import argparse
+import os
+import sys
+import magic
+from comment_parser import comment_parser
+
+COPYRIGHT_TEXT = "Copyright Contributors to the vidx2pidx project."
+LICENSE_TEXT = "SPDX-License-Identifier: Apache-2.0"
+
+def check_file(filename: str) -> int:
+    """
+    Checks a file for the presence of fixed copyright and license notices.
+    Args:
+        filename: The name of the file to check.
+    Returns:
+        0 if both copyright and license are found, 1 otherwise.
+    """
+    if os.path.getsize(filename) == 0:
+        return 0
+
+    try:
+        mime_type = magic.from_file(filename, mime=True)
+    except Exception as e:
+        print(f"# Error reading MIME type of {filename}: {e}")
+        return 1
+
+    if mime_type == "text/plain":
+        mime_type = "text/x-c++"
+
+    try:
+        comments = "\n".join(comment.text() for comment in comment_parser.extract_comments(filename, mime=mime_type))
+    except Exception as e:
+        print(f"# Failed to parse comments in {filename}: {e}")
+        return 1
+
+    copyright_found = COPYRIGHT_TEXT in comments
+    license_found = LICENSE_TEXT in comments
+
+    if copyright_found and license_found:
+        return 0
+
+    print(f"# Copyright check error(s) in: {filename}")
+    if not copyright_found:
+        print(f"\t# Missing or invalid copyright. Expected: {COPYRIGHT_TEXT}")
+    if not license_found:
+        print(f"\t# Missing or invalid license. Expected: {LICENSE_TEXT}")
+    return 1
+
+def main(argv: Optional[Sequence[str]] = None) -> int:
+    """
+    Entry point to check for copyright notices in the provided files.
+    Args:
+        argv: A list of filenames.
+    Returns:
+        Non-zero if any file is missing the required notice.
+    """
+    parser = argparse.ArgumentParser(description="Check for fixed copyright and license headers.")
+    parser.add_argument('filenames', nargs='*', help='Files to check.')
+    args = parser.parse_args(argv)
+
+    print("Checking copyright headers...")
+    ret = 0
+
+    for filename in args.filenames:
+        ret |= check_file(filename)
+
+    if ret != 0:
+        print(">> error: One or more files are missing a valid copyright or license header")
+
+    return ret
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/scripts/template/third_party_licenses.md.template b/scripts/template/third_party_licenses.md.template
@@ -6,4 +6,4 @@
 | {{ .Name }} | {{ .Version }}  | [{{ .LicenseName }}]({{ .LicenseURL }}) |
 {{- end }}
 
-Report generated and repository checked for [forbidden](https://github.com/google/licenseclassifier/blob/842c0d70d7027215932deb13801890992c9ba364/license_type.go#L323) and [restricted](https://github.com/google/licenseclassifier/blob/842c0d70d7027215932deb13801890992c9ba364/license_type.go#L176) licenses.
+Report generated and repository checked for [forbidden](https://github.com/google/licenseclassifier/blob/842c0d70d7027215932deb13801890992c9ba364/license_type.go#L323) and [restricted](https://github.com/google/licenseclassifier/blob/842c0d70d7027215932deb13801890992c9ba364/license_type.go#L176) licenses.
diff --git a/third_party_licenses.md b/third_party_licenses.md
@@ -6,4 +6,4 @@
 | github.com/spf13/cobra | v1.9.1  | [Apache-2.0](https://github.com/spf13/cobra/blob/v1.9.1/LICENSE.txt) |
 | github.com/spf13/pflag | v1.0.6  | [BSD-3-Clause](https://github.com/spf13/pflag/blob/v1.0.6/LICENSE) |
 
-Report generated and repository checked for [forbidden](https://github.com/google/licenseclassifier/blob/842c0d70d7027215932deb13801890992c9ba364/license_type.go#L323) and [restricted](https://github.com/google/licenseclassifier/blob/842c0d70d7027215932deb13801890992c9ba364/license_type.go#L176) licenses.
+Report generated and repository checked for [forbidden](https://github.com/google/licenseclassifier/blob/842c0d70d7027215932deb13801890992c9ba364/license_type.go#L323) and [restricted](https://github.com/google/licenseclassifier/blob/842c0d70d7027215932deb13801890992c9ba364/license_type.go#L176) licenses.

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,3 @@`
`1`		`-# Security`
	`1`	`+# Security`
`2`	`2`
`3`	`3`	`For reporting security issues, please follow the official guidelines outlined in [SECURITY.md](https://github.com/Open-CMSIS-Pack/cmsis-toolbox/blob/main/SECURITY.md).`