comphead opened a new pull request, #3293: URL: https://github.com/apache/iceberg-rust/pull/3293
## Which issue does this PR close? - Closes #3234. ## What changes are included in this PR? The `lint` job in `ci.yml` now runs `dev/release/dependencies.sh check`, the same `cargo deny` license check the release process runs. A PR that adds a dependency whose license `deny.toml` does not allow now fails CI instead of being caught at release time. cargo-deny 0.19.9 is installed by the existing `taiki-e/install-action` step, matching the version pinned in `dependencies.sh`. `lint` already feeds `ci-required`, so `.asf.yaml` does not change. `deny.toml` now sets `[graph] all-features = true`. Without it, cargo-deny only follows default features. #3143 removed `opendal-all` from the Python bindings, so the default graph no longer includes the optional OpenDAL backends (gcs, oss, azdls, hf). Today the default graph has 503 crates and the all-features graph has 619. The missing crates include the two MPL-2.0 crates that `deny.toml` has exceptions for (`colored` and `option-ext`, pulled in by `opendal-service-hf`). This setting also applies to the release-time check. Other changes: - `make check-dependency-licenses` runs the check locally, and `make check` now includes it. - `CONTRIBUTING.md` describes the license policy and what to do when the check rejects a license. - The release docs point to `make install-cargo-deny` for the pinned version and note that CI already runs the check. - Two comments in `dependencies.sh` no longer refer to the CI TSV check removed in #2706. As suggested in #3233, the release-time check in `create_rc.sh` stays. TSV generation is unchanged. Unlike the TSV check reverted in #2706, this check does not ask PRs to regenerate any files. Dependabot PRs pass unless an update brings in a license that `deny.toml` does not allow. ## Are these changes tested? Tested locally with cargo-deny 0.19.9: - `dev/release/dependencies.sh check` and `make check-dependency-licenses` pass on this branch. - Removing the `colored` exception from `deny.toml` makes the check fail and name `colored v3.1.1`. On `main`, the same edit still passes, because the default-feature graph does not include `colored`. - `dev/release/dependencies.sh generate` produces identical TSV files with and without the `[graph]` setting. - `taplo fmt --check` passes. The new CI step has not run in GitHub Actions yet. This PR is its first run. ## AI Disclosure I used Claude Code, an AI coding assistant, to investigate the issue, write the changes and this description, and run the local tests above. Areas for reviewers to check: - The `CONTRIBUTING.md` guidance on Category A, B, and X licenses describes how `deny.toml` handles them today. It is not a legal interpretation of the ASF policy. - The new CI step has only been tested locally so far. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
