Aman-Mittal commented on code in PR #6340:
URL: https://github.com/apache/fineract/pull/6340#discussion_r3903008208
##########
.github/workflows/build-quality-checks.yml:
##########
@@ -300,3 +300,53 @@ jobs:
- name: Run Spotless
run: ./gradlew spotlessCheck
+
+ licenses:
+ if: github.event_name == 'pull_request'
+ runs-on: ubuntu-24.04
+ timeout-minutes: 45
+
+ env:
+ TZ: Asia/Kolkata
+ DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+ BASE_SHA: ${{ github.event.pull_request.base.sha }}
+
+ steps:
+ # This job diffs the PR head against its target branch, so it needs
Review Comment:
Agreed, I think we can extend the check to cover this as well.
The current script is intended to catch newly introduced or upgraded
dependency licenses while avoiding the existing known compile-time exceptions.
Based on your suggestion, I can add an artifact-level check that builds the
Fineract bootJar and verifies the dependencies actually packaged in the release
artifact.
That would give us two levels of protection: the dependency diff catches
new/changed license issues early, while the artifact check ensures that a
non-exempt Category X dependency does not actually make it into the distributed
Fineract artifact (Maybe we can add to On Push workflow too).
i think check should do like this
Test case | Expected result
-- | --
Existing Category X compileOnly dependency | ✅ Pass
Bump existing Category X compileOnly dependency | ✅ Pass, if still an
approved/excluded dependency
Add new Category X compileOnly dependency | ⚠️ Depends on policy — likely
flag for review
Bump a bundled Category X dependency | ❌ Fail
Add new bundled Category X dependency | ❌ Fail
Bump allowed-license bundled dependency | ✅ Pass
Upgrade dependency where license changes from allowed → Category X | ❌ Fail
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
