add workflow to fetch spdx licenses

[elrayle]

NOTE: This is marked draft only because the trigger on push to the PR branch needs to be removed. Please do review. I will remove the trigger tomorrow after approved and before merging.

---

Description

Prior to this, the process for updating licenses and exceptions had to be run manually. This sets up a GitHub Action that will run on a schedule and create a PR in the auto-update-licenses branch. The PR can be merged into main, but should not be deleted.

New Process

• nightly cron executes the fetch-licenses workflow
• if there are changes to any of the official spdx license files, they will replace the current local copy of these files
• the licenses are written directly to the file handling its type (i.e. active, deprecated, exceptions) in the main spdxexp package
• commits the files to the auto-update-licenses branch and creates a PR from that branch to main

Additional Steps and Challenges

• once this process is running regularly, check that PRs generate automatically, correctly, and can be merged into the main branch
• updates to range file needs to be performed manually
• merging the PR is a manually process
• need to be notified that the PR exists so it can be merged
• when the PR merges, the auto-update-licenses branch should NOT be deleted
• need to periodically rebase auto-update-licenses on main

TODO

• explore if there is a way to generate the range file changes, but it is much more complicated
• even better would be to revisit the way ranges are used and their layout in the range file to see if there is a simpler and more predictable way to handle ranges
• explore if there is a way to auto-rebase, or periodically re-create the auto-update-licenses branch

[elrayle]

Prefer activeLicenseIDs instead of nonDeprecatedLicenseIDs as it is more descriptive.

[ajhenry]

Looks like a great tool to add!

[ajhenry]

Would it possible to append a unique hash to the name of the branch to avoid collisions and problems with the branch? Something like this

Suggested change

	branch: auto-update-licenses
	branch: auto-update-licenses-${{ github.run_id }}-${{ github.run_attempt }}

[elrayle]

peter-evans/create-pull-request will either create the branch or update it and associated PR if it already exists. As this is designed to run once a day on a schedule, the chances that there will be a race condition seem unlikely. I like that the PR will be updated as it prevents proliferation of PRs if one is not immediately merged.

I'd like to keep it as is for now. If in reality there are collisions or other problems, we can add a unique branch identifier at that time.

[ajhenry]

Suggested change

	- cron: '0 0 * * *' # Runs at midnight ET
	- cron: '0 0 * * *' # Runs at midnight UTC

Cron is UTC 😄

[ajhenry]

Do we need to setup go for this?

[elrayle]

Actions have go available without setup. The version of go isn't terribly important to be able to run this simple script.