Check for non-permissive licenses in CI

[emteknetnz]

Non-permissive open source licenses such a GPLv2 in dependencies cause a level of confusion as to whether they require websites to make their source code available. Because of the grey-area, we should ensure there are no non-permissive licences in any of our dependencies.

TinyMCE 7 switched from an MIT license to a GPLv2 license. While it would be unexpected for a dependency to chance its licence in a minor release, and we do use ^ carets for our dependencies, we have less visibility over dependencies of dependencies which could more easily go up majors with no input from our side.

Because of this we should add a CI logic in sink that validates there are no non-permissive (i.e copyleft) opensource licences in the installed dependencies

After merging create a new 1.3 branch and manually release 1.3.0

Notes

• https://www.npmjs.com/package/license-checker could be used for npm dependencies
• It may make sense to check composer deps in sink, and npm deps in individual modules

Acceptance criteria

• A list of non-permissive allowed licenses is created
• New CI workflow logic runs looking for non-permissive licenses
• The broken builds card is updated to link to runs of the new workflow
• The entire build will fail if this logic fails so that we have visibility of it in rhino
• This logic runs for all supported versions of Silverstripe
• All installed composer and npm dependencies are checked i.e. the root composer.lock and every package.lock e.g. admin, asset-admin, etc

PRs

• MNT Add license to composer.json silverstripe-installer#382
• MNT Add license to composer.json supported-modules#50
• MNT Check licenses #83
• ENH Instructions for licenses .github#354

[GuySartorelli]

Note that some packages may come with multiple licenses, e.g.
https://github.com/nette/schema/blob/2073a5a4156aa8f2849f2e81e2b743f338ed3f45/composer.json#L6

In those cases so long as an appropriately permissive license is available, the CI job should not fail.

[GuySartorelli]

Can we please not drag things out of refinement that haven't been refined?

[emteknetnz]

My bad, sorry

[GuySartorelli]

PRs merged