test-infra icon indicating copy to clipboard operation
test-infra copied to clipboard

Add Prow job to verify licenses and `ATTRIBUTION.md` files

Open a-hilaly opened this issue 1 year ago • 1 comments

All ACK repositories and artifacts (helm charts/container images) need to contain an ATTRIBUTION.md file, giving attribution to open source software used in each project/repository. While originally sir Jay Pipes wrote this file manually - it has become increasingly challenging to maintain these files, especially with the current scale of the projct - over 50 repositories...

Last year, we developed a new tool (https://github.com/awslabs/attribution-gen) to help generating these files, which has been valuable to ACK (and other projects). However, we still rely on human action to regenerate these files whenever new dependencies are introduced or old ones are removed

To address this, we're introducing a new Prow job that runs against every ACK git repository (triggered on PR creation) and verifies that the ATTRIBUTION.md exists and that it is up to date. This will block any new PRs that change dependencies without regenerating the attribution file.

Initially, we'll trigger this Prow job for EVERY upcoming PR; in the near future, we plan to optimize by triggering it only when go.mod files change.

Key benefits:

  • Ensures up to date attribution across all repos
  • Reduces manual effort in license compliance
  • Blocks PRs with outdated attribution info
  • Improves project transparency and legal compliance

Implementation details:

  • Added a new bash script to simplify the the attribution verificaiton process
  • Added a new "Dockerfile" image for attribution verification
  • Added a Prow job verify-attribution template for all ACK repositories

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

a-hilaly avatar Aug 07 '24 17:08 a-hilaly

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: a-hilaly, michaelhtm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

ack-prow[bot] avatar Aug 27 '24 17:08 ack-prow[bot]