chore(common): introduce integrity check for contract licenses

Author: isaacdecoded

.github/workflows/gateway-contracts-integrity-checks.yml

@@ -72,6 +72,10 @@ jobs:
         working-directory: gateway-contracts
         run: make check-mocks
 
+      - name: Check SPDX license headers
+        working-directory: gateway-contracts
+        run: make check-spdx-headers
+
       - name: Check licenses compliance
         working-directory: gateway-contracts
         run: make check-licenses

.github/workflows/host-contracts-integrity-checks.yml

@@ -68,3 +68,7 @@ jobs:
       - name: Check contract selectors are up-to-date
         working-directory: host-contracts
         run: make check-selectors
+
+      - name: Check SPDX license headers
+        working-directory: host-contracts
+        run: make check-spdx-headers

ci/check_spdx_licenses.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Check that all Solidity contracts use the expected SPDX license identifier.
+
+set -euo pipefail
+
+EXPECTED_LICENSE="BSD-3-Clause-Clear"
+CONTRACTS_DIR="${1:-contracts}"
+EXIT_CODE=0
+
+while IFS= read -r -d '' file; do
+    first_line=$(head -n 1 "$file")
+    if [[ "$first_line" != "// SPDX-License-Identifier: ${EXPECTED_LICENSE}" ]]; then
+        echo "ERROR: Wrong or missing license in $file"
+        echo "  Found:    $first_line"
+        echo "  Expected: // SPDX-License-Identifier: ${EXPECTED_LICENSE}"
+        EXIT_CODE=1
+    fi
+done < <(find "$CONTRACTS_DIR" -name '*.sol' -print0)
+
+if [ "$EXIT_CODE" -eq 0 ]; then
+    echo "All Solidity files use SPDX-License-Identifier: ${EXPECTED_LICENSE}"
+fi
+
+exit "$EXIT_CODE"

gateway-contracts/Makefile

@@ -106,6 +106,10 @@ deploy-setup-contracts:
 ensure-addresses:
 	ENV_PATH=$(ENV_PATH) npx ts-node scripts/ensure_proxy_addresses.ts
 
+# Make sure all Solidity contracts use the expected SPDX license identifier (BSD-3-Clause-Clear)
+check-spdx-headers:
+	bash ../ci/check_spdx_licenses.sh contracts
+
 # Make sure we only use allowed licenses for dependencies
 # Full list of SPDX identifiers can be found here: https://spdx.org/licenses/
 # The following packages are exceptionally excluded from the check:

host-contracts/Makefile

@@ -60,5 +60,9 @@ lint-bindings:
 # Update auto-generated files for conformance checks
 update-conformance: update-bindings update-selectors
 
+# Make sure all Solidity contracts use the expected SPDX license identifier (BSD-3-Clause-Clear)
+check-spdx-headers:
+	bash ../ci/check_spdx_licenses.sh contracts
+
 # Conform to pre-commit checks
 conformance: prettier update-conformance