[GH] (burr/main): Workflow run "npm_and_yarn in /website for ip-address - Update #1507933759" failed!

[GitBox <gi...@apache.org>]

The GitHub Actions job "npm_and_yarn in /website for ip-address - Update #1507933759" on burr.git/main has failed.
Run started by GitHub user dependabot[bot] (triggered by dependabot[bot]).

Head commit for run:
8a91bcc23b0e91bd2084dbeea36b67ad9726f041 / Jarek Potiuk <ja...@potiuk.com>
Make LICENSE-wheel reflect the bundled UI dependencies, plus two 0.43.0 RC0 fixes (#868)

* Generate the wheel's third-party license section from the UI build

The wheel's only non-source content is the compiled tracking UI at
burr/tracking/server/build/assets/index-*.js, which bundles code from
130 npm packages under MIT, ISC, Apache-2.0, BSD-3-Clause and PSF.
LICENSE-wheel listed exactly one third-party work, so the binary
distribution's LICENSE did not reflect its contents.

Rather than maintain that list by hand, derive it from the build:
scripts/generate_wheel_license.py runs a sourcemap build, reads the
sources array to find every node_modules file compiled into the bundle,
resolves each to its owning package, and rewrites everything below the
generated marker in LICENSE-wheel. --check fails when the file is stale,
so CI can catch drift on dependency bumps.

None of the bundled packages ships a NOTICE file, so NOTICE is unchanged.

Generated-by: Claude Opus 5 (1M context)

* Skip the Bedrock tests instead of aborting collection without boto3

test_bip0042_bedrock.py imported botocore at module level, above the
pytest.importorskip("boto3") guard, which made the guard dead code:
botocore ships with boto3, so without the [bedrock] extra the import
raised and pytest reported a collection error rather than a skip. Since
a collection error interrupts the whole run, `pytest tests/` -- the
command scripts/README.md gives release voters -- executed no tests at
all on a plain `pip install -e ".[tests]"`.

CI did not catch this because the main test job passes
--ignore=tests/integrations/test_bip0042_bedrock.py.

Move the botocore import below the guard. Without boto3 the module now
skips and the rest of the suite runs; with it, the tests are unchanged.

Generated-by: Claude Opus 5 (1M context)

* Use importlib.metadata for /api/v0/version instead of pkg_resources

The version endpoint imported pkg_resources, which is a setuptools
module. setuptools is not a declared dependency of apache-burr, is not
present in a venv created by modern tooling, and dropped pkg_resources
entirely in 81.0. On a clean install of the 0.43.0 wheel the endpoint
therefore raised ModuleNotFoundError and returned 500.

importlib.metadata is in the standard library on every Python we
support. Behaviour is otherwise unchanged, including the fallback to
the legacy "burr" distribution and then to "unknown".

Generated-by: Claude Opus 5 (1M context)

* Fail release validation when LICENSE-wheel drifts from the UI bundle

RAT excludes burr/tracking/server/build/**, so the existing license step
never inspects the compiled UI -- the only content the wheel adds over
the sdist. That is exactly where the LICENSE gap went unnoticed, and it
is what silently drifts whenever a UI dependency is added or bumped.

Add a release-validation step that re-derives the bundled npm packages
from a sourcemap build and fails if LICENSE-wheel no longer matches. It
runs after the artifact build, which has already installed
telemetry/ui/node_modules.

Generated-by: Claude Opus 5 (1M context)

Report URL: https://github.com/apache/burr/actions/runs/30984266913

With regards,
GitHub Actions via GitBox