Add import restrictions check

Signed-off-by: Djordje Lukic <djordje.lukic@docker.com>

.github/workflows/ci.yml

@@ -21,6 +21,9 @@ jobs:
       - name: Validate go-mod is up-to-date and license headers
         run: make validate
 
+      - name: Validate imports
+        run: make import-restrictions
+
       - name: Run golangci-lint
         run: |
           curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b . v1.30.0

Dockerfile

@@ -21,6 +21,7 @@ FROM --platform=${BUILDPLATFORM} golang:${GO_VERSION} AS base
 WORKDIR /api
 ENV GO111MODULE=on
 RUN apk add --no-cache \
+    git \
     docker \
     make \
     protoc \
@@ -45,6 +46,13 @@ RUN --mount=target=. \
     GIT_TAG=${GIT_TAG} \
     make -f builder.Makefile lint
 
+FROM base AS import-restrictions-base
+RUN go get github.com/docker/import-restrictions
+
+FROM import-restrictions-base AS import-restrictions
+RUN --mount=target=. \
+    make -f builder.Makefile import-restrictions
+
 FROM base AS make-cli
 ENV CGO_ENABLED=0
 ARG TARGETOS

Makefile

@@ -72,6 +72,10 @@ lint: ## run linter(s)
 	--build-arg GIT_TAG=$(GIT_TAG) \
 	--target lint
 
+import-restrictions: ## run import-restrictions script
+	@docker build . \
+	--target import-restrictions
+
 serve: cli ## start server
 	@./bin/docker serve --address unix:///tmp/backend.sock
 

builder.Makefile

@@ -56,6 +56,9 @@ test:
 lint:
 	golangci-lint run --timeout 10m0s ./...
 
+import-restrictions:
+	import-restrictions --configuration import-restrictions.yaml
+
 check-license-headers:
 	./scripts/validate/fileheader
 

import-restrictions.yaml

@@ -0,0 +1,33 @@
+# Backends shouldn't depend on other backends or the cli
+- path: ./aci
+  forbiddenImports:
+    - github.com/docker/api/cli
+    - github.com/docker/api/ecs
+    - github.com/docker/api/example
+    - github.com/docker/api/local
+    - github.com/docker/api/metrics
+    - github.com/docker/api/server
+- path: ./ecs
+  forbiddenImports:
+    - github.com/docker/api/aci
+    - github.com/docker/api/cli
+    - github.com/docker/api/example
+    - github.com/docker/api/local
+    - github.com/docker/api/metrics
+    - github.com/docker/api/server
+- path: ./example
+  forbiddenImports:
+    - github.com/docker/api/aci
+    - github.com/docker/api/cli
+    - github.com/docker/api/ecs
+    - github.com/docker/api/local
+    - github.com/docker/api/metrics
+    - github.com/docker/api/server
+- path: ./local
+  forbiddenImports:
+    - github.com/docker/api/aci
+    - github.com/docker/api/cli
+    - github.com/docker/api/ecs
+    - github.com/docker/api/example
+    - github.com/docker/api/metrics
+    - github.com/docker/api/server