This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git
The following commit(s) were added to refs/heads/main by this push:
new 6f23a2a77 chore: pin cargo-about and cargo-deny for local license
checks (#3561)
6f23a2a77 is described below
commit 6f23a2a7757a44d03f7cbfc9600a3bee6bd480a9
Author: Kevin Liu <[email protected]>
AuthorDate: Wed Oct 28 00:55:40 2026 +0000
chore: pin cargo-about and cargo-deny for local license checks (#3561)
* chore(python): pin cargo-about for local license checks
LICENSING.md told contributors to install cargo-about 0.9.2 and then run
`cargo about` directly, so an existing older install was used silently.
cargo-about's output differs between versions (0.9.1 drops license files
that 0.9.2 keeps), so local checks could disagree with CI.
Add `install-cargo-about` and `cargo-about` targets to
bindings/python/Makefile, following the root Makefile's install-<tool>
convention, and point LICENSING.md at them. Cross-reference the version
with the CI action.
Co-authored-by: Copilot App <[email protected]>
* chore(release): use the pinned cargo-deny for dependency license checks
The release guide, dev/release/README.md and create_rc.sh ran
`licenses.py dependencies check` directly, which uses whatever cargo-deny
is installed and only checks that one exists. A stale cargo-deny can
give a different license verdict than CI's 0.19.9.
Run `make check-dependency-licenses` instead, which installs the pinned
version first.
Co-authored-by: Copilot App <[email protected]>
---------
Co-authored-by: Copilot App <[email protected]>
---
.github/actions/generate-python-license/action.yml | 1 +
bindings/python/LICENSING.md | 3 +--
bindings/python/Makefile | 9 ++++++++-
dev/release/README.md | 2 +-
dev/release/create_rc.sh | 3 ++-
website/src/release.md | 2 +-
6 files changed, 14 insertions(+), 6 deletions(-)
diff --git a/.github/actions/generate-python-license/action.yml
b/.github/actions/generate-python-license/action.yml
index 76b0e086d..112b4243d 100644
--- a/.github/actions/generate-python-license/action.yml
+++ b/.github/actions/generate-python-license/action.yml
@@ -21,6 +21,7 @@ runs:
using: "composite"
steps:
- name: Install cargo-about
+ # Keep version in sync with the install-cargo-about target in
bindings/python/Makefile.
uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 #
v2.87.21
with:
tool: [email protected]
diff --git a/bindings/python/LICENSING.md b/bindings/python/LICENSING.md
index 6a8370ae5..685e92111 100644
--- a/bindings/python/LICENSING.md
+++ b/bindings/python/LICENSING.md
@@ -67,6 +67,5 @@ Everything else needs a manual check and update before every
release: the clarif
Run this from `bindings/python` to check. A `WARN` or `warning:` on stderr
means a clarification no longer applies, and `<year>` in the output means no
license file was matched:
```shell
-cargo install cargo-about --version 0.9.2 --locked --features cli
-cargo about generate -c about.toml --locked --fail --manifest-path Cargo.toml
about.hbs | grep -nE '<year>|<owner>|<copyright holders>'
+make -s cargo-about | grep -nE '<year>|<owner>|<copyright holders>'
```
diff --git a/bindings/python/Makefile b/bindings/python/Makefile
index 0e8b9632d..256fedaf2 100644
--- a/bindings/python/Makefile
+++ b/bindings/python/Makefile
@@ -15,7 +15,7 @@
# specific language governing permissions and limitations
# under the License.
-.PHONY: build install test
+.PHONY: build install test install-cargo-about cargo-about
build:
uv run maturin develop
@@ -27,3 +27,10 @@ install:
test:
uv run --no-sync pytest
+
+# Keep version in sync with .github/actions/generate-python-license/action.yml.
+install-cargo-about:
+ cargo install --locked --features cli [email protected]
+
+cargo-about: install-cargo-about
+ cargo about generate -c about.toml --locked --fail --manifest-path
Cargo.toml about.hbs
diff --git a/dev/release/README.md b/dev/release/README.md
index 98c183a5b..597914974 100644
--- a/dev/release/README.md
+++ b/dev/release/README.md
@@ -139,7 +139,7 @@ git push origin "v0.9.1"
Verify every dependency's license is one the project allows:
```shell
-python3 dev/release/licenses.py dependencies check
+make check-dependency-licenses
```
CI also runs this check on every pull request.
diff --git a/dev/release/create_rc.sh b/dev/release/create_rc.sh
index 99dd37565..890318513 100755
--- a/dev/release/create_rc.sh
+++ b/dev/release/create_rc.sh
@@ -307,8 +307,9 @@ check_rc_tag_available() {
}
check_dependency_licenses() {
+ require_command make
require_command python3
- python3 "${SCRIPT_DIR}/licenses.py" dependencies check
+ make -C "${REPO_ROOT}" check-dependency-licenses
}
# Packages and builds every crate as `cargo publish` would, without uploading,
diff --git a/website/src/release.md b/website/src/release.md
index 5a7aad146..61ede8502 100644
--- a/website/src/release.md
+++ b/website/src/release.md
@@ -175,7 +175,7 @@ The changelog should reflect a summary of each commit in
the new release.
Run the following command to verify the licenses meet the project's policy.
```shell
-python3 dev/release/licenses.py dependencies check
+make check-dependency-licenses
```
#### Check pyiceberg-core LICENSE and NOTICE
