-
Notifications
You must be signed in to change notification settings - Fork 635
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[ISSUE #4720] Modernize CI license check and Enable Dependabot #4827
Conversation
… different version
…/dependency-review-action
74a95ab
to
b96139c
Compare
I've made some progress in |
I can write another Although it requires more work and may soon be deprecated after actions/dependency-review-action#632 is resolved, it can save about 30min CI running time before actions/dependency-review-action#632 is resolved. |
@xwm1992 PTAL~ The warning of The warning of The warning of Public Domain can be resolved by upgrading |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #4827 +/- ##
============================================
+ Coverage 15.91% 15.94% +0.03%
- Complexity 1734 1735 +1
============================================
Files 897 897
Lines 31982 31943 -39
Branches 2737 2734 -3
============================================
+ Hits 5089 5094 +5
+ Misses 26413 26370 -43
+ Partials 480 479 -1 ☔ View full report in Codecov by Sentry. |
License check publish guide at apache/eventmesh-site#218. |
# Conflicts: # tools/dependency-check/known-dependencies.txt
@xwm1992 Conflicts resolved. PTAL~ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Fixes #4720
Motivation
The list of artifacts recorded in
known-dependencies.txt
does not help the maintainer manage dependencies effectively. This list lacks a reference hierarchy of artifacts, and it's more practical to print the dependency tree using Gradle.The purpose of
check-dependencies.sh
is to inspect the licenses of third-party dependencies, preventing developers from casually introducing untracked new artifacts. However, it can't prevent developers adding Apache 2.0 incompatible licenses.The presence of
known-dependencies.txt
blocks Dependabot because it cannot update this file through CI. If our project does not keep up with new versions of dependencies for a long time, it will gradually fall behind and be submerged.Therefore, I believe it is necessary to
cancel the version checking of artifacts ofremoveknown-dependencies.txt
inandcheck-dependencies.sh
, and introduce actions/dependency-review-action to check unsupported dependencies.Why actions/dependency-review-action
About
allow-dependencies-licenses
attributeDue to the issue reported in actions/dependency-review-action#670, for dependencies with multiple licenses, this action treats the
OR
separator asAND
, meaning that if any of the licenses are listed in thedeny-licenses
list, they will be rejected. Ideally, for theOR
separator, any dependency should not be rejected as long as at least one license is not listed in thedeny-licenses
list.Therefore, I have temporarily added all existing dependencies with multiple licenses in the Repo to the exemptions of this action. Although this action only scans the modified dependencies in the pull request, these exemptions may never be used.
This issue is expected to be fixed in the next version of the action, at which point all exemptions can be removed.
Current implementation of this PR
Use
checkDeniedLicense
gradle task to check license, instead ofdependency-review-action
.dependency-review-action
will be applied when upstream problems mentioned in #4827 (comment) is resolved.dependency-review-action
workflow files has been backed up to https://github.com/Pil0tXia/eventmesh/tree/pil0txia/action_4720_with-dependency-review-action.Modifications
Only the artifact name is recorded inknown-dependencies.txt
, the version number is no longer recorded.Introduce https://github.com/actions/dependency-review-actionUsecheckDeniedLicense
gradle task in CI./gradlew printAllDependencyTrees > allDeps.log
to get dependency trees of all EventMesh submodules.Documentation