The GitHub Actions job "Validate and test" on pekko-grpc.git/main has succeeded. Run started by GitHub user pjfanning (triggered by pjfanning).
Head commit for run: 1d2a2f6f00d39de1a1f71976d2d8f66628d81d74 / PJ Fanning <[email protected]> Ship a complete LICENSE and NOTICE in the assembly jars (#865) * Ship a complete LICENSE and NOTICE in the assembly jars Motivation: pekko-grpc-codegen and pekko-grpc-scalapb-protoc-plugin publish assembly jars and bat archives that bundle classes from 3rd party projects, so their META-INF/LICENSE and META-INF/NOTICE have to account for those projects. legal/AssemblyLicense.txt and legal/AssemblyNotice.txt exist for that, but: - The codegen assembly jar and bat shipped no META-INF/LICENSE at all. The merge strategy discarded META-INF/LICENSE to stop guava/failureaccess colliding, and that also discarded the copy the ApacheSonatypePlugin resource generator puts in the jar. - legal/AssemblyLicense.txt had drifted from what is actually bundled. It listed org.checkerframework:checker-qual, which guava dropped in favour of org.jspecify:jspecify, and jspecify was not listed anywhere. - The scalapb-protoc-plugin assembly bundled protobuf-java 4.35.0, pulled in transitively by compilerplugin, rather than the pinned 4.36.0 that codegen and runtime bundle. Nothing failed the build when the legal files fell behind a dependency change. Modification: Merge META-INF/LICENSE and META-INF/NOTICE with MergeStrategy.preferProject in both assemblies, so our own files win over the ones the dependencies bring in. Swap checker-qual for jspecify in legal/AssemblyLicense.txt and drop the MIT text that was only there for checker-qual. Pin protobuf-java in scalapb-protoc-plugin via a new Dependencies group, the same way codegen and runtime already do. Add project/AssemblyLicenseCheck.scala with two tasks, wired into both assembly projects and run in CI as the checkAssemblyLicenses alias: - assemblyLicenseCheck fails when a module on the assembly classpath is not named in the assembly LICENSE file, and warns about listed modules that are not bundled for the Scala version being built. - assemblyMetaInfCheck opens the published assembly jar and bat archive and fails unless each carries META-INF/LICENSE and META-INF/NOTICE matching the files in legal/. Result: Both assembly jars and both bat archives ship a LICENSE and NOTICE covering the 3rd party classes they bundle, both bundle protobuf-java 4.36.0, and CI fails if a dependency change leaves the legal files behind. Tests: - sbt checkAssemblyLicenses - passed. assemblyMetaInfCheck fails on the codegen assembly before the merge strategy fix (META-INF/LICENSE is missing), and assemblyLicenseCheck fails before the AssemblyLicense.txt fix (org.jspecify:jspecify is not accounted for). - sbt scalafmtSbtCheck - passed. References: None - assembly jar license completeness * Update AssemblyLicenseCheck.scala * Name the archive when it cannot be read as a zip Motivation: `assemblyMetaInfCheck` opened each archive with `new ZipFile`, which throws `ZipException: error in opening zip file` without naming the file, so a corrupt or truncated archive in CI gave no clue which one it was. Modification: Open the archive and its entries through `sbt.io.Using`, and report `IOException` with the archive name. Result: A failure to read an archive names it, like the license problems reported below it. Tests: - sbt checkAssemblyLicenses - passed for both assembly projects (jar and bat) References: Refs #865 * Assert the shipped LICENSE and NOTICE still say something Motivation: `assemblyMetaInfCheck` only compared the archived files with the curated ones in `legal/`, which says the merge strategy picked our copy but not that the copy is still a real LICENSE or NOTICE. An emptied or truncated curated file would ship and pass. Modification: Check the shipped bytes for the markers each file has to carry: the Apache License 2.0 heading and terms plus the 3rd party section in LICENSE, and the product name, the ASF attribution and the 3rd party section in NOTICE. Missing markers are reported alongside the existing problems for that archive. Result: An assembly that ships a gutted LICENSE or NOTICE fails the check. Tests: - sbt checkAssemblyLicenses - passed for both assembly projects (jar and bat) - With legal/AssemblyLicense.txt cut down to its first two lines, codegen/assemblyMetaInfCheck fails: "META-INF/LICENSE does not mention 'TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION', 'contain classes from 3rd party projects', 'Apache License Version 2.0:'" References: Refs #865 Report URL: https://github.com/apache/pekko-grpc/actions/runs/33388983470 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
