The GitHub Actions job "Validate and test" on pekko-grpc.git/assembly-license-notice has failed. Run started by GitHub user pjfanning (triggered by pjfanning).
Head commit for run: 7ab07bb070e4751840cdadae6e40282fe7d036d4 / PJ Fanning <[email protected]> Ship a complete LICENSE and NOTICE in the assembly jars Motivation: pekko-grpc-codegen and pekko-grpc-scalapb-protoc-plugin publish assembly jars and bat archives that bundle classes from 3rd party projects, so their META-INF/LICENSE and META-INF/NOTICE have to account for those projects. legal/AssemblyLicense.txt and legal/AssemblyNotice.txt exist for that, but: - The codegen assembly jar and bat shipped no META-INF/LICENSE at all. The merge strategy discarded META-INF/LICENSE to stop guava/failureaccess colliding, and that also discarded the copy the ApacheSonatypePlugin resource generator puts in the jar. - legal/AssemblyLicense.txt had drifted from what is actually bundled. It listed org.checkerframework:checker-qual, which guava dropped in favour of org.jspecify:jspecify, and jspecify was not listed anywhere. - The scalapb-protoc-plugin assembly bundled protobuf-java 4.35.0, pulled in transitively by compilerplugin, rather than the pinned 4.36.0 that codegen and runtime bundle. Nothing failed the build when the legal files fell behind a dependency change. Modification: Merge META-INF/LICENSE and META-INF/NOTICE with MergeStrategy.preferProject in both assemblies, so our own files win over the ones the dependencies bring in. Swap checker-qual for jspecify in legal/AssemblyLicense.txt and drop the MIT text that was only there for checker-qual. Pin protobuf-java in scalapb-protoc-plugin via a new Dependencies group, the same way codegen and runtime already do. Add project/AssemblyLicenseCheck.scala with two tasks, wired into both assembly projects and run in CI as the checkAssemblyLicenses alias: - assemblyLicenseCheck fails when a module on the assembly classpath is not named in the assembly LICENSE file, and warns about listed modules that are not bundled for the Scala version being built. - assemblyMetaInfCheck opens the published assembly jar and bat archive and fails unless each carries META-INF/LICENSE and META-INF/NOTICE matching the files in legal/. Result: Both assembly jars and both bat archives ship a LICENSE and NOTICE covering the 3rd party classes they bundle, both bundle protobuf-java 4.36.0, and CI fails if a dependency change leaves the legal files behind. Tests: - sbt checkAssemblyLicenses - passed. assemblyMetaInfCheck fails on the codegen assembly before the merge strategy fix (META-INF/LICENSE is missing), and assemblyLicenseCheck fails before the AssemblyLicense.txt fix (org.jspecify:jspecify is not accounted for). - sbt scalafmtSbtCheck - passed. References: None - assembly jar license completeness Report URL: https://github.com/apache/pekko-grpc/actions/runs/33260883048 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
