build(ci): add license header check

also remove sbom generation from ci workflow, it doesn't serve any purpose

Signed-off-by: nscuro <[email protected]>

.github/workflows/ci.yml

@@ -9,7 +9,18 @@ on:
       - master
 
 jobs:
-  golangci:
+  licensecheck:
+    name: License Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v2
+      - name: Check license headers
+        uses: apache/[email protected]
+        with:
+          config: .licenserc.yml
+
+  lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
@@ -45,8 +56,3 @@ jobs:
         uses: actions/checkout@v2
       - name: Test
         run: make test
-      - name: Generate SBOM
-        uses: CycloneDX/gh-gomod-generate-sbom@v1
-        with:
-          version: v1
-          args: mod -licenses -json -type library -verbose

.licenserc.yml

@@ -0,0 +1,19 @@
+header:
+  license:
+    spdx-id: Apache-2.0
+    copyright-owner: OWASP Foundation
+  paths-ignore:
+    - ".github/**"
+    - ".gitignore"
+    - ".gitpod.*"
+    - ".golangci.yml"
+    - ".goreleaser.yml"
+    - ".licenserc.yml"
+    - "**/*.md"
+    - "**/go.mod"
+    - "**/go.sum"
+    - "**/testdata/**"
+    - "CODEOWNERS"
+    - "LICENSE"
+    - "Makefile"
+    - "NOTICE"