| [theia-dev] 3PP FOSS license check now semi-automated, part of CI |
|
Hi,
As mentioned in today's dev-meeting, we have recently added a new "License check" GitHub CI workflow (1) that validates the license of our project's dependencies. This replaces the manual process, that we had until now.
Under the hood, this uses Eclipse Foundation's dash-licenses tool (2), which in turn uses clearlydefined (like our now obsolete manual process) and also the Foundation's CQ database, to validate dependencies listed in our yarn.lock file.
In short, so long as the license check CI step passes, there is nothing extra to do. It means that the PR does not introduce any new dependency that's not known/approved, according to dash-licenses.
If the license check step fails, a committer needs to open a CQ about the dependency(ies) that were flagged by dash-licenses and wait for the IP team's permission before merging.
A bit of good news: opening CQs for such dependencies may soon be a thing of the past, in most cases: dash-licenses can be made to automatically (4) open CQ-equivalents (issues on EF Gitlab) that can often be automatically approved in minutes, and that the
IP Team will manually investigate, if not.
Let me know if you have related questions.
Regards,
Marc
(1): for now in the main repo: https://github.com/eclipse-theia/theia/blob/master/.github/workflows/license-check.yml
|