chore(repo): drop DEPENDENCIES.md per ASF policy#3222
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #3222 +/- ##
=============================================
- Coverage 74.45% 57.69% -16.76%
Complexity 943 943
=============================================
Files 1188 1187 -1
Lines 106543 93222 -13321
Branches 83560 70256 -13304
=============================================
- Hits 79329 53787 -25542
- Misses 24463 36725 +12262
+ Partials 2751 2710 -41
🚀 New features to boost your workflow:
|
hubcio
force-pushed
the
chore/drop-dependencies-md
branch
2 times, most recently
from
33a96f0 to
a895c7a
Compare
numinnex
previously approved these changes
May 8, 2026
DEPENDENCIES.md (cargo license + CI drift check) broke every dependabot PR; dependabot can't run repo scripts so the file went stale on every lockfile bump. Per ASF release policy, source tarballs ship Cargo.lock but no bundled crates, so LICENSE/NOTICE MUST NOT enumerate them. The real compliance gap was on convenience binaries (Docker images, PyPI wheels) which statically link crates without bundling the license text. Confirmed on general@incubator (2026-05-06): https://lists.apache.org/thread/1okljz8jxt2g0bt3hlgpxyor7zv0nobl Replace with cargo-about + license-checker-rseidelsohn driven by scripts/ci/third-party-licenses.sh, scoped per-artifact via a single composite action shared by pre-merge and publish.yml. iggy-server bundles the embedded web UI, so apache/iggy enumerates web npm deps too.
scripts/ci/third-party-licenses.sh chained `[[ -n VAR && -f VAR ]] && rm` in its EXIT trap. When invoked with only Rust manifests (e.g. `--manifest core/ai/mcp/Cargo.toml`), NODE_FMT_FILE and NODE_JSON_FILE stay empty, the last `[[ ... ]] && rm` short-circuits to exit code 1, and bash propagates the trap's status as the script's. Validation printed "All manifests pass third-party license validation." then exited 1, failing the Validate third-party licenses job. Append `return 0` to cleanup so trap status no longer leaks.
hubcio
force-pushed
the
chore/drop-dependencies-md
branch
from
33c8822 to
776d091
Compare
spetz
approved these changes
May 9, 2026
mmodzelewski
approved these changes
May 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DEPENDENCIES.md (cargo license + CI drift check) broke every
dependabot PR; dependabot can't run repo scripts so the file
went stale on every lockfile bump.
Per ASF release policy, source tarballs ship Cargo.lock but no
bundled crates, so LICENSE/NOTICE MUST NOT enumerate them. The
real compliance gap was on convenience binaries (Docker images,
PyPI wheels) which statically link crates without bundling the
license text.
Confirmed on general@incubator (2026-05-06):
https://lists.apache.org/thread/1okljz8jxt2g0bt3hlgpxyor7zv0nobl
Replace with cargo-about + license-checker-rseidelsohn driven by
scripts/ci/third-party-licenses.sh, scoped per-artifact via a
single composite action shared by pre-merge and publish.yml.
iggy-server bundles the embedded web UI, so apache/iggy
enumerates web npm deps too.