This is an automated email from the ASF dual-hosted git repository.
FrankChen021 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new dacdb886b02 docs: refresh licenses.yaml versions before cutting a
release branch (#20775)
dacdb886b02 is described below
commit dacdb886b0253329fe17e8b2db1b6f68c06e7caf
Author: Andreas Maechler <[email protected]>
AuthorDate: Sat Oct 31 20:49:41 2026 -0600
docs: refresh licenses.yaml versions before cutting a release branch
(#20775)
* docs: refresh licenses.yaml versions before cutting a release branch
Add a release-guide step that installs master, generates the dependency
reports, runs refresh-license-versions.py and check-licenses.py, and merges
the licenses.yaml changes before the release branch is created. PR CI only
warns about stale versions, while the apache-release build still fails on
them.
* Move the licenses.yaml refresh into its own release step
Make it a top-level section ahead of "Create a release branch" so it sits
in reading order and the checklist stays a table of contents. Call the
distribution pom's generate-licenses-report and check-licenses executions
instead of copying their arguments, add a re-run before tagging when a
backport changed a dependency, and restore the LICENSE section intro.
* Check licenses.yaml before every branch cut and RC tag
Run the release build's check first and refresh only when it fails, so the
same steps serve the branch cut and the pre-tag run. The pre-tag run now
always happens: a dependency update merged to master between the refresh and
the branch cut reaches the release branch stale without any backport.
---
distribution/asf-release-process-guide.md | 37 +++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/distribution/asf-release-process-guide.md
b/distribution/asf-release-process-guide.md
index 459778e1fcc..757725925ac 100644
--- a/distribution/asf-release-process-guide.md
+++ b/distribution/asf-release-process-guide.md
@@ -26,6 +26,7 @@
- [ ] [Maven credentials](#maven-credentials)
- [ ] [Announce intention to release](#announce-intention-to-release)
- [ ] [Security vulnerabilities](#security-vulnerabilities)
+- [ ] [Refresh licenses.yaml versions](#refresh-licensesyaml-versions)
- [ ] [Create a release branch](#create-a-release-branch)
- [ ] [Preparing the release branch](#preparing-the-release-branch)
- [ ] [Preparing the master branch for the next version after
branching](#preparing-the-master-branch-for-the-next-version-after-branching)
@@ -130,6 +131,40 @@ First up in performing an official release of Apache Druid
is to announce in the
## Security vulnerabilities
The release manager should also keep an eye-out for `Cron Job ITS` failures:
https://github.com/apache/druid/actions/workflows/cron-job-its.yml. If there
are security vulnerabilities, we need to fix them before creating an RC.
+## Refresh licenses.yaml versions
+
+Check the `licenses.yaml` versions before you create the release branch, and
again on the release branch before you tag. CI only warns when a version in
`licenses.yaml` no longer matches the dependency the build uses, but the
[release build](#build-artifacts) fails on it. The license scripts need Python
3 with PyYAML.
+
+From the repository root, install the branch, because the dependency reports
resolve Druid modules from your local Maven repository:
+
+```bash
+mvn clean install -Pskip-static-checks,skip-tests -Dweb.console.skip=true -T1C
+```
+
+Generate the dependency reports:
+
+```bash
+mvn -Papache-release -pl distribution exec:exec@generate-licenses-report
+```
+
+Search the output for `Encountered error`. The report script keeps going when
a module fails, and neither the check nor the refresh covers a module without a
report.
+
+Run the release build's check. If it passes, skip the rest of this section:
+
+```bash
+mvn -Papache-release -pl distribution exec:exec@check-licenses
+```
+
+If it fails, refresh the versions:
+
+```bash
+distribution/bin/refresh-license-versions.py licenses.yaml
distribution/target/license-reports
+```
+
+Edit the entries marked `needs a manual edit`. Most of these lines say what to
change, and
[dev/license.md](../dev/license.md#when-you-add-a-new-library-dependency-into-druid)
describes the entry format. Run the check again until it passes.
+
+Open a PR with the `licenses.yaml` changes against the same branch, and merge
it before you branch or tag. On a release branch, this direct PR is an
exception to [Release branch hygiene](#release-branch-hygiene).
+
## Create a release branch
Next up is creating the release branch off of master (or the previous release
branch for a bug fix release). Be sure to do this from the apache git repo,
_not your fork_. Name the branch for the release version that is being created,
omitting the `druid` prefix that will appear on the release candidate and
release tags:
@@ -333,6 +368,8 @@ In this case, the commit must be backported to the release
branch. The [find-mis
find such commits that have not been backported. Note that this script relies
on the milestone tagged in the PR, so PRs
must be tagged properly to make this script working. See the above [Release
notes](#release-notes) section for more details about the script.
+Before you tag, [check the `licenses.yaml`
versions](#refresh-licensesyaml-versions) on the release branch, starting with
the install.
+
### Set version and make a tag
Once the release branch is good for an RC, you can build a new tag with:
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
