Merge pull request #142 from exonet/dependabot/pip/patches-and-minor-… #205

	---
	name: Security

	on:
	push:
	branches:
	- master
	pull_request:

	jobs:
	check-licenses:
	name: Check licenses for dependencies
	runs-on: ubuntu-latest

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Set up Python 3.11
	uses: actions/setup-python@v5
	id: setup-python
	with:
	python-version: 3.11

	- name: Check licenses
	id: licenses
	run: \|
	echo ::set-output name=LICENSES::$(
	# License regex. Functions as a whitelist.
	license_regex='MIT\|MPL\|HPND\|PSF\|BSD\|Apache\|ISC\|LGPL\|Expat\|Python\sSoftware\sFoundation\sLicense\|The\sUnlicense'

	# Get all pkg names from pip via JSON parsing and loop over it.
	for pip_pkg in $(pip list --format=json \| jq -r '.[].name'); do

	# Store the licenses which are not whitelisted in a var.
	not_whitelisted_license=$(pip show -v "${pip_pkg}" \| grep -P '^\s+License' \| awk -F ' :: ' '{ print $3 }' \| grep -vP "${license_regex}")

	# If there are non whitelisted licenses in the Python project,
	# print name and license.
	if [[ -n "${not_whitelisted_license}" ]]; then
	echo PKG: "${pip_pkg}", License: "${not_whitelisted_license}"
	fi
	done
	)

	- name: Output licenses
	run: echo "${{ steps.licenses.outputs.LICENSES }}"

	- name: Fail if not empty
	if: ${{ steps.licenses.outputs.LICENSES != '' }}
	run: exit 1

Provide feedback