This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-3561-de0a6ac8471da43f63382d66fac27d7e56fd273e in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git
commit 6f23a2a7757a44d03f7cbfc9600a3bee6bd480a9 Author: Kevin Liu <[email protected]> AuthorDate: Wed Oct 28 00:55:40 2026 +0000 chore: pin cargo-about and cargo-deny for local license checks (#3561) * chore(python): pin cargo-about for local license checks LICENSING.md told contributors to install cargo-about 0.9.2 and then run `cargo about` directly, so an existing older install was used silently. cargo-about's output differs between versions (0.9.1 drops license files that 0.9.2 keeps), so local checks could disagree with CI. Add `install-cargo-about` and `cargo-about` targets to bindings/python/Makefile, following the root Makefile's install-<tool> convention, and point LICENSING.md at them. Cross-reference the version with the CI action. Co-authored-by: Copilot App <[email protected]> * chore(release): use the pinned cargo-deny for dependency license checks The release guide, dev/release/README.md and create_rc.sh ran `licenses.py dependencies check` directly, which uses whatever cargo-deny is installed and only checks that one exists. A stale cargo-deny can give a different license verdict than CI's 0.19.9. Run `make check-dependency-licenses` instead, which installs the pinned version first. Co-authored-by: Copilot App <[email protected]> --------- Co-authored-by: Copilot App <[email protected]> --- .github/actions/generate-python-license/action.yml | 1 + bindings/python/LICENSING.md | 3 +-- bindings/python/Makefile | 9 ++++++++- dev/release/README.md | 2 +- dev/release/create_rc.sh | 3 ++- website/src/release.md | 2 +- 6 files changed, 14 insertions(+), 6 deletions(-) diff --git a/.github/actions/generate-python-license/action.yml b/.github/actions/generate-python-license/action.yml index 76b0e086d..112b4243d 100644 --- a/.github/actions/generate-python-license/action.yml +++ b/.github/actions/generate-python-license/action.yml @@ -21,6 +21,7 @@ runs: using: "composite" steps: - name: Install cargo-about + # Keep version in sync with the install-cargo-about target in bindings/python/Makefile. uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 with: tool: [email protected] diff --git a/bindings/python/LICENSING.md b/bindings/python/LICENSING.md index 6a8370ae5..685e92111 100644 --- a/bindings/python/LICENSING.md +++ b/bindings/python/LICENSING.md @@ -67,6 +67,5 @@ Everything else needs a manual check and update before every release: the clarif Run this from `bindings/python` to check. A `WARN` or `warning:` on stderr means a clarification no longer applies, and `<year>` in the output means no license file was matched: ```shell -cargo install cargo-about --version 0.9.2 --locked --features cli -cargo about generate -c about.toml --locked --fail --manifest-path Cargo.toml about.hbs | grep -nE '<year>|<owner>|<copyright holders>' +make -s cargo-about | grep -nE '<year>|<owner>|<copyright holders>' ``` diff --git a/bindings/python/Makefile b/bindings/python/Makefile index 0e8b9632d..256fedaf2 100644 --- a/bindings/python/Makefile +++ b/bindings/python/Makefile @@ -15,7 +15,7 @@ # specific language governing permissions and limitations # under the License. -.PHONY: build install test +.PHONY: build install test install-cargo-about cargo-about build: uv run maturin develop @@ -27,3 +27,10 @@ install: test: uv run --no-sync pytest + +# Keep version in sync with .github/actions/generate-python-license/action.yml. +install-cargo-about: + cargo install --locked --features cli [email protected] + +cargo-about: install-cargo-about + cargo about generate -c about.toml --locked --fail --manifest-path Cargo.toml about.hbs diff --git a/dev/release/README.md b/dev/release/README.md index 98c183a5b..597914974 100644 --- a/dev/release/README.md +++ b/dev/release/README.md @@ -139,7 +139,7 @@ git push origin "v0.9.1" Verify every dependency's license is one the project allows: ```shell -python3 dev/release/licenses.py dependencies check +make check-dependency-licenses ``` CI also runs this check on every pull request. diff --git a/dev/release/create_rc.sh b/dev/release/create_rc.sh index 99dd37565..890318513 100755 --- a/dev/release/create_rc.sh +++ b/dev/release/create_rc.sh @@ -307,8 +307,9 @@ check_rc_tag_available() { } check_dependency_licenses() { + require_command make require_command python3 - python3 "${SCRIPT_DIR}/licenses.py" dependencies check + make -C "${REPO_ROOT}" check-dependency-licenses } # Packages and builds every crate as `cargo publish` would, without uploading, diff --git a/website/src/release.md b/website/src/release.md index 5a7aad146..61ede8502 100644 --- a/website/src/release.md +++ b/website/src/release.md @@ -175,7 +175,7 @@ The changelog should reflect a summary of each commit in the new release. Run the following command to verify the licenses meet the project's policy. ```shell -python3 dev/release/licenses.py dependencies check +make check-dependency-licenses ``` #### Check pyiceberg-core LICENSE and NOTICE
