[ISSUE #4720] Modernize CI license check and Enable Dependabot #4827
Conversation
… different version
…/dependency-review-action
Pil0tXia
changed the title
Pil0tXia
changed the title
Pil0tXia
force-pushed
the
pil0txia/action_4720
branch
from
74a95ab to
b96139c
Compare
|
I've made some progress in |
|
I can write another Although it requires more work and may soon be deprecated after actions/dependency-review-action#632 is resolved, it can save about 30min CI running time before actions/dependency-review-action#632 is resolved. |
|
@xwm1992 PTAL~
The warning of The warning of The warning of Public Domain can be resolved by upgrading |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #4827 +/- ##
============================================
+ Coverage 15.91% 15.94% +0.03%
- Complexity 1734 1735 +1
============================================
Files 897 897
Lines 31982 31943 -39
Branches 2737 2734 -3
============================================
+ Hits 5089 5094 +5
+ Misses 26413 26370 -43
+ Partials 480 479 -1 ☔ View full report in Codecov by Sentry. |
|
License check publish guide at apache/eventmesh-site#218. |
Pil0tXia
added
the
ready for review
# Conflicts: # tools/dependency-check/known-dependencies.txt
|
@xwm1992 Conflicts resolved. PTAL~ |
…pache#4827) * Sync changes in apache#4719 * minor change * Only keep the artifact name * Run `sed -i 's/-[0-9].*\.jar//g'` * Run `sort known-dependencies.txt | uniq > known-dependencies-unique.txt` * Allow CI to run on branches with namespace in the branch name in forked repos * Correct typo and remove useless command * Use `sort -u -o` instead of `uniq` to remove duplicate artifacts with different version * Enlarge open-pull-requests-limit * minor: polish tips * Test apache/skywalking-eyes/dependency CI result * Fix 'unable to find version `0.6.0`' * See debug log to prove it works * skywalking-eyes/dependency doesn't support gradle, test basic actions/dependency-review-action * Add all denied licenses * Remove redundant check * Remove not included SPDX: ASL, RSAL * Add a useful printAllDependencyTrees task * Exampt safe artifact under multiple licenses * Exempt more safe artifacts (Looks like the last of them) * 'allow-dependencies-licenses' attribute only supports single-line text * Add a TODO comment * Add more file extensions for checkstyle * Resolve some checkstyle header violations * Add back apache/skywalking-eyes * Fix downloaded file didn't have a `.` * Disable Go deps update & Must pass CI before merge * No need to force up-to-date & Auto-approve only * Remove the slash at the end of the homepage url in Repo GitHub desc * Skip patch updates temporarily to reduce PR noise * Logback removed after apache@6627c79 * Accept patch update * Submit dependency graph * Follow https://github.com/gradle/actions/blob/main/docs/dependency-submission.md#usage-with-pull-requests-from-public-forked-repositories * try to sort dependency graph workflow exec seq * `workflow_run` event will only trigger a workflow run if the workflow file is on the default branch * Grant required permission of CodeQL * Attempt to fix 'No dependency graph files found to submit' * Attempt to fix 'No dependency graph files found to submit' try 2 * Attempt to fix 'No dependency graph files found to submit' try 3 * Attempt to fix 'No dependency graph files found to submit' try 4 * Try to check dependency-review * Only check bundled dependencies * Fix 'No snapshots were found for the head SHA' attempt 1 * Test runtimeClasspath dependencies * Revert "Test runtimeClasspath dependencies" This reverts commit b1ab803. * Try to retry 1 hr wo wait for snapshot update * Test gradle/actions#196 (comment) * Add todo comments * Keep implementation and compileOnly for now * Keep runtimeOnly deps * [Breaking Change] Remove dependency-review-action and wait for its bugfix * Add checkDeniedLicense into CI * minor code optimization
Fixes #4720
Motivation
The list of artifacts recorded in
known-dependencies.txtdoes not help the maintainer manage dependencies effectively. This list lacks a reference hierarchy of artifacts, and it's more practical to print the dependency tree using Gradle.The purpose of
check-dependencies.shis to inspect the licenses of third-party dependencies, preventing developers from casually introducing untracked new artifacts. However, it can't prevent developers adding Apache 2.0 incompatible licenses.The presence of
known-dependencies.txtblocks Dependabot because it cannot update this file through CI. If our project does not keep up with new versions of dependencies for a long time, it will gradually fall behind and be submerged.Therefore, I believe it is necessary to
cancel the version checking of artifacts ofremoveknown-dependencies.txtinandcheck-dependencies.sh, and introduce actions/dependency-review-action to check unsupported dependencies.Why actions/dependency-review-action
About
allow-dependencies-licensesattributeDue to the issue reported in actions/dependency-review-action#670, for dependencies with multiple licenses, this action treats the
ORseparator asAND, meaning that if any of the licenses are listed in thedeny-licenseslist, they will be rejected. Ideally, for theORseparator, any dependency should not be rejected as long as at least one license is not listed in thedeny-licenseslist.Therefore, I have temporarily added all existing dependencies with multiple licenses in the Repo to the exemptions of this action. Although this action only scans the modified dependencies in the pull request, these exemptions may never be used.
This issue is expected to be fixed in the next version of the action, at which point all exemptions can be removed.
Current implementation of this PR
Use
checkDeniedLicensegradle task to check license, instead ofdependency-review-action.dependency-review-actionwill be applied when upstream problems mentioned in #4827 (comment) is resolved.dependency-review-actionworkflow files has been backed up to https://github.com/Pil0tXia/eventmesh/tree/pil0txia/action_4720_with-dependency-review-action.Modifications
Only the artifact name is recorded inknown-dependencies.txt, the version number is no longer recorded.Introduce https://github.com/actions/dependency-review-actionUsecheckDeniedLicensegradle task in CI./gradlew printAllDependencyTrees > allDeps.logto get dependency trees of all EventMesh submodules.Documentation