amaechler opened a new pull request, #20775: URL: https://github.com/apache/druid/pull/20775
Part of #20732. > Draft until #20764 and #20774 merge: the guide describes the warn-only PR CI behaviour that #20774 adds. ### Description With #20774, PR CI only warns when a `licenses.yaml` version is stale, so Dependabot and other dependency updates can merge without the version edit. The release build (`-Papache-release`) still fails on stale versions. This PR adds the step that catches them before a release branch is cut, as the last item of #20732. #### Release guide step A new "Refresh licenses.yaml versions before branching" subsection under "LICENSE and NOTICE handling" in `distribution/asf-release-process-guide.md`: 1. Install the commit to branch from: `mvn clean install -Pskip-static-checks,skip-tests -Dweb.console.skip=true -T1C`. 2. Generate the reports and refresh: `generate-license-dependency-reports.py`, then `refresh-license-versions.py` (#20736). 3. Fix the entries it lists by hand, linking `dev/license.md` instead of repeating it, then run `check-licenses.py` with the same exclusions as `distribution/pom.xml`. 4. Merge the `licenses.yaml` changes into the branch being branched off before creating the release branch. The checklist and the top of "Create a release branch" link to the step, since that section comes before the LICENSE section and a release manager reading top-down would otherwise branch first. The opening sentence of "LICENSE and NOTICE handling" no longer says the section is informational only. #### Why install first, and why not `-Papache-release` `generate-license-dependency-reports.py` runs `mvn project-info-reports:dependencies` in each module directory, so the other Druid modules resolve from the local Maven repository. No remote repository publishes Druid snapshots, so without an install the report for that module fails, and the script only prints the error and keeps going. `refresh-license-versions.py` then skips that module's entries, so the guide says to check for `Encountered error`. A stale install would give stale reports. The install does not use `-Papache-release`: in `distribution` that profile runs `check-licenses.py` at the `test` phase, which would fail on the versions being refreshed, and at the root it turns on the OWASP dependency check. #### How it was checked On master at d5a6bc76c9: the install took about 1 minute and the reports about 1.5 minutes on a warm local repository. All 31 reports were generated without errors, `refresh-license-versions.py --dry-run` reported nothing to update, and `check-licenses.py` passed. Without the Druid modules in the local repository, the report for `druid-basic-security` fails with "Could not find artifact org.apache.druid:druid-processing:jar:40.0.0-SNAPSHOT". <hr> This PR has: - [x] been self-reviewed. - [x] added documentation for new or modified features or behaviors. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
