Skip to content

ci: check dependency licenses #825

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nabinchha merged 5 commits into from
Jul 16, 2026
Merged

ci: check dependency licenses #825

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
62869e7
ci: check dependency licenses
nabinchha Jul 15, 2026
e33bfdd
fix: handle dependency license expressions
nabinchha Jul 15, 2026
9f237f3
fix: validate all license lock slices
nabinchha Jul 16, 2026
b048ee4
chore: remove email-validator license exception
nabinchha Jul 16, 2026
322f72a
fix: declare license checker fallback
nabinchha Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -249,6 +249,29 @@ jobs:
- name: Check license headers
run: make check-license-headers

dependency-licenses:
name: Check Dependency Licenses (Python ${{ matrix.python-version }})
needs: validate-dispatch
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]

steps:
- name: Checkout code
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- name: Install uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
version: "latest"
python-version: ${{ matrix.python-version }}
enable-cache: true

- name: Check dependency licenses
run: make check-dependency-licenses LICENSE_PYTHON_VERSION=${{ matrix.python-version }}

# ===========================================================================
# Summary Job for Branch Protection
# This job creates status checks matching the old job naming convention
Expand Down
11 changes: 9 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

REPO_PATH := $(shell pwd)
PRE_COMMIT ?= .venv/bin/pre-commit
LICENSE_PYTHON_VERSION ?= 3.11

# Package directories
CONFIG_PKG := packages/data-designer-config
Expand Down Expand Up @@ -88,6 +89,7 @@ help:
@echo " check-fern-docs-locally - Install deps, generate Fern artifacts, and run fern check"
@echo " serve-fern-docs-locally - Generate local Fern artifacts and serve Fern docs"
@echo " check-license-headers - Check if all files have license headers"
@echo " check-dependency-licenses - Check runtime dependency license compatibility"
@echo " update-license-headers - Add license headers to all files"
@echo ""
@echo "⚡ Performance:"
Expand Down Expand Up @@ -449,9 +451,14 @@ show-versions:
@uv run python -c "from data_designer.interface._version import __version__; print(f' data-designer: {__version__}')" 2>/dev/null || echo " data-designer: (not installed)"

# ==============================================================================
# LICENSE HEADERS
# LICENSE CHECKS
# ==============================================================================

check-dependency-licenses:
@echo "🔍 Checking Python $(LICENSE_PYTHON_VERSION) locked runtime dependency licenses..."
uv run --isolated --python $(LICENSE_PYTHON_VERSION) --all-packages --no-dev --group license-check --locked \
python $(REPO_PATH)/scripts/check_dependency_licenses.py

check-license-headers:
@echo "🔍 Checking license headers in all files..."
uv run python $(REPO_PATH)/scripts/update_license_headers.py --check
Expand Down Expand Up @@ -746,7 +753,7 @@ clean-test-coverage:
.PHONY: bench-cli-startup bench-cli-startup-verbose \
build build-config build-engine build-interface \
check-all check-all-fix check-config check-engine check-interface \
check-fern-docs check-fern-docs-locally check-fern-release-version check-fern-theme-access check-license-headers \
check-dependency-licenses check-fern-docs check-fern-docs-locally check-fern-release-version check-fern-theme-access check-license-headers \
clean clean-dist clean-notebooks clean-pycache clean-test-coverage \
convert-execute-notebooks \
coverage coverage-config coverage-engine coverage-interface \
Expand Down
52 changes: 52 additions & 0 deletions dependency-license-policy.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Permissive licenses that the Apache Software Foundation classifies as
# "Apache-like" (Category A). Values use SPDX identifiers after normalization.
# https://www.apache.org/legal/resolved.html#category-a
allowed_licenses = [
"Apache-2.0",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"MIT",
"Zlib",
]

# Existing dependencies outside the global whitelist are reviewed by package,
# version, and exact reported license. A version or license metadata change must
# be reviewed explicitly.
[exceptions.certifi]
reason = "Unmodified TLS certificate bundle installed as a separate transitive dependency."
reports = [{ version = "2026.2.25", license = "Mozilla Public License 2.0 (MPL 2.0)" }]

[exceptions.chardet]
reason = "Unmodified character-detection library installed as a separate runtime dependency."
reports = [{ version = "5.2.0", license = "GNU Lesser General Public License v2 or later (LGPLv2+)" }]

[exceptions.numpy]
reason = "Core numerical dependency with reviewed permissive license metadata in each locked Python slice."
reports = [
{ version = "2.2.6", license = "BSD License" },
{ version = "2.4.3", license = "BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0" },
]

[exceptions.pathspec]
reason = "Unmodified transitive dependency of sqlfluff installed as a separate package."
reports = [{ version = "1.0.4", license = "Mozilla Public License 2.0 (MPL 2.0)" }]

[exceptions.pillow]
reason = "Core image dependency under the permissive MIT-CMU license."
reports = [{ version = "12.3.0", license = "MIT-CMU" }]

[exceptions.regex]
reason = "Existing regex dependency containing code under the CNRI Python license."
reports = [{ version = "2026.2.28", license = "Apache-2.0 AND CNRI-Python" }]

[exceptions.tqdm]
reason = "Unmodified progress library installed as a separate transitive dependency."
reports = [{ version = "4.67.3", license = "MPL-2.0 AND MIT" }]

[exceptions.typing_extensions]
reason = "Python typing compatibility dependency under the PSF license."
reports = [{ version = "4.15.0", license = "PSF-2.0" }]
3 changes: 3 additions & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,9 @@ dev = [
"pytest-httpx>=0.36.0,<1",
"ruff>=0.14.10,<1",
]
license-check = [
"tomli>=2.0.1,<3; python_version < '3.11'",

@greptile-apps greptile-apps Bot Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 tomli placed in dev group causes ModuleNotFoundError on Python 3.10 CI run

The check-dependency-licenses make target runs uv run --all-packages --no-dev --locked. Because --no-dev excludes the dev dependency group, tomli is not installed in that environment. On Python 3.10 the script reaches import tomli as tomllib (line 18 of scripts/check_dependency_licenses.py) and immediately crashes, making the dependency-licenses CI job always fail for the 3.10 matrix slot.

A fix is to move tomli out of the dev group — either into a dedicated non-dev group (e.g. scripts) and add --group scripts to the make target, or into the root project's dependencies with the same python_version < '3.11' marker.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: pyproject.toml
Line: 45

Comment:
`tomli` placed in `dev` group causes `ModuleNotFoundError` on Python 3.10 CI run

The `check-dependency-licenses` make target runs `uv run --all-packages --no-dev --locked`. Because `--no-dev` excludes the `dev` dependency group, `tomli` is not installed in that environment. On Python 3.10 the script reaches `import tomli as tomllib` (line 18 of `scripts/check_dependency_licenses.py`) and immediately crashes, making the `dependency-licenses` CI job always fail for the `3.10` matrix slot.

A fix is to move `tomli` out of the `dev` group — either into a dedicated non-dev group (e.g. `scripts`) and add `--group scripts` to the make target, or into the root project's `dependencies` with the same `python_version < '3.11'` marker.

How can I resolve this? If you propose a fix, please make it concise.

@nabinchha nabinchha Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 322f72a. tomli is now declared in a dedicated license-check dependency group, and the isolated Make target explicitly requests that group while retaining --no-dev. The Python 3.10 locked license scan passes (90 packages checked), along with 12 focused tests and make check-all.

]
docs = [
"jupytext>=1.16.0,<2",
]
Expand Down
Loading
Loading