docs: license_check docs are incomplete/wrong

[eseidel]

https://workflows.vgv.dev/docs/workflows/license_check

The License Check workflow consists of the following steps:

Setup Dart
Set SSH Key (if provided)
Install project dependencies
Check licenses

There is no ssh key option 🤣 That is presumably copy/paste from some other workflow.

And then later is uses a - '.github/workflows/license_check.yaml' path, presumably implying that the file being shown is expected at that path.

The usage is also a bit awkward for multi-package repos (which is fine, I can work around), since the checker takes a single package. Unlike very_good packages get which knows how to be recursive.

[alestiago]

Hi @eseidel ! Thank you for submitting an issue 💙

There is no ssh key option 🤣 That is presumably copy/paste from some other workflow.

The SSH step does exist (not a typo afaik). It is meant for those developers that get packages from other sources that are not pub. It is not listed as an option (input) because it is provided as a secret (we should probably add a Secrets documentation section like we recently did for the Mason and Dart publish workflows).

And then later is uses a - '.github/workflows/license_check.yaml' path, presumably implying that the file being shown is expected at that path.

I think the usage of '.github/workflows/license_check.yaml' you are referring to is inside an Example Usage, it is part of the example. As a developer you would most likely trigger the workflow to run when dependencies change or when there is a change to the workflow file (in the example located at .github/workflows/license_check.yaml). Perhaps we can include a commented header showing the name of the example file to avoid confusion or a brief recommendation for when we think it is most sensible to run the workflow.

The usage is also a bit awkward for multi-package repos (which is fine, I can work around), since the checker takes a single package. Unlike very_good packages get which knows how to be recursive.

For usage in multi-package repos we recommend having a workflow per package since that way it will make them trigger a run exclusively for the scenarios described above. Dart Frog is a good example of such multi-package repository (refer to those workflows prefixed with license_). Perhaps we can include a brief information block recommending or signposting to multi-package repositories that rely on the workflow. If you have a use-case for the very_good packages check licenses command to be recursive (not just checking transitive dependencies for a package) and would like such feature feel free to open an issue at https://github.com/VeryGoodOpenSource/very_good_cli.

For the time being, I'll re-label the issue as a documentation change rather than a bug (I believe it defaulted to bug) . Please, let us know if the explanation suits you, if you would like to contribute with the documentation changes, or if you have any further suggestions 🙌

[eseidel]

Very kind of you to respond at such length. What happened here was that I went to try and add very_good license check to our Shorebird repos on Friday. I'm not super great with GHA, and went looking for docs and got a bit confused is all. I did find the dart_frog solution but it wasn't clear having a separate yaml file per package was the right solution, so decided to file this bug and punt on finishing (until I could consult @felangel who knows GHA and very_good much better than I do). Thanks for the response!