(skywalking-horizon-ui) 01/01: fix(release): pin license-eye instead of taking it from PATH

[wu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

wu-sheng pushed a commit to branch fix/pin-license-eye-in-release
in repository https://gitbox.apache.org/repos/asf/skywalking-horizon-ui.git

commit 8ff32105d2079d00ad09f4d11acbc6e74c771751
Author: Wu Sheng <wu...@foxmail.com>
AuthorDate: Tue Aug 25 08:29:39 2026 +0800

    fix(release): pin license-eye instead of taking it from PATH
    
    The release generates the binary LICENSE with license-eye, so a different
    build of the tool produces a different file and the drift gate fails on a
    difference that is the TOOL's, not the dependency tree's. That is what stopped
    the 1.0.0 run: the machine had Homebrew's 0.8.0 on PATH, released before the
    pnpm resolver, so every package resolved through npm's layout and came out as
    a `node_modules/.pnpm/…` path rather than its name — 2,976 such rows, plus
    duplicates and a `SEE LICENSE IN LICENSE` group that the same release fixed.
    
    CI already installed a pinned commit; only the release script did not, and it
    merely checked that SOME license-eye existed. Both now read the SHA from
    `.license-eye-version`, so the two cannot drift apart again. The release
    installs it into `scripts/.release-tools` — deliberately NOT under the work
    directory, which is wiped when the clone is made, halfway through the run.
    
    `go` joins the required-tool check, since the install needs it, and
    license-eye leaves it: a version from PATH is no longer used at all.
---
 .github/workflows/ci.yaml |  2 +-
 .gitignore                |  2 ++
 .license-eye-version      |  1 +
 .licenserc.yaml           |  3 +++
 scripts/release.sh        | 20 +++++++++++++++++++-
 5 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 33f4185c..07457935 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -136,7 +136,7 @@ jobs:
 
       - name: Verify binary LICENSE is current
         run: |
-          go install github.com/apache/skywalking-eyes/cmd/license-eye@ab60c97524d4fe73142b27055a262cf1520f66a4
+          go install "github.com/apache/skywalking-eyes/cmd/license-eye@$(tr -d '[:space:]' < .license-eye-version)"
           pnpm licenses:bin:check
 
       - name: Compare source vs. binary LICENSE/NOTICE shape
diff --git a/.gitignore b/.gitignore
index c16ef09d..f64d0a67 100644
--- a/.gitignore
+++ b/.gitignore
@@ -63,6 +63,8 @@ horizon-wire.jsonl
 
 # Release
 scripts/.release-work
+# Pinned license-eye installed by release.sh (see .license-eye-version).
+scripts/.release-tools
 scripts/.finalize-work
 # e2e failure diagnostics — collected on a red run, never committed.
 e2e-logs/
diff --git a/.license-eye-version b/.license-eye-version
new file mode 100644
index 00000000..e1aa69a6
--- /dev/null
+++ b/.license-eye-version
@@ -0,0 +1 @@
+ab60c97524d4fe73142b27055a262cf1520f66a4
diff --git a/.licenserc.yaml b/.licenserc.yaml
index d9396845..5ac322d3 100644
--- a/.licenserc.yaml
+++ b/.licenserc.yaml
@@ -62,6 +62,9 @@ header:
     # renders the binary tarball's LICENSE from. A license-header comment on it
     # would bleed straight into that output.
     - 'dist-material/release-docs/**/*.tpl'
+    # A bare pinned commit SHA read by both release.sh and CI — a comment
+    # header would have to be stripped by every reader.
+    - '.license-eye-version'
 
   comment: on-failure
 
diff --git a/scripts/release.sh b/scripts/release.sh
index 0bf54dc0..3ace66f8 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -103,16 +103,34 @@ echo "GPG signing OK — signatures verify back to ${GPG_KEY_ID}."
 note "Step 2 — Tool check"
 
 MISSING=()
-for t in gpg svn shasum git gh node pnpm tar license-eye; do
+for t in gpg svn shasum git gh node pnpm tar go; do
     command -v "$t" >/dev/null || MISSING+=("$t")
 done
 if [ ${#MISSING[@]} -gt 0 ]; then
     err "Missing required tools: ${MISSING[*]}"
     exit 1
 fi
+
+# license-eye is PINNED, not taken from PATH. The binary LICENSE is generated
+# by it, so a different build produces a different file and the drift gate
+# fails on a difference that is the tool's, not the dependency tree's — which
+# is exactly what a released 0.8.0 on PATH did: no pnpm resolver, so every
+# package came out as a `node_modules/.pnpm/…` path instead of its name.
+# Same commit CI installs; both read `.license-eye-version`.
+LICENSE_EYE_VERSION="$(tr -d '[:space:]' < "${PROJECT_DIR}/.license-eye-version")"
+# NOT under WORK_DIR — that is wiped when the release clone is made, which
+# would delete this binary in the middle of the run.
+export GOBIN="${SCRIPT_DIR}/.release-tools"
+mkdir -p "${GOBIN}"
+echo "Installing license-eye @ ${LICENSE_EYE_VERSION}…"
+go install "github.com/apache/skywalking-eyes/cmd/license-eye@${LICENSE_EYE_VERSION}"
+export PATH="${GOBIN}:${PATH}"
+command -v license-eye >/dev/null || { err "license-eye install failed."; exit 1; }
+
 echo "All tools present."
 echo "node: $(node --version)"
 echo "pnpm: $(pnpm --version)"
+echo "license-eye: $(license-eye --version 2>&1 | head -1) (pinned ${LICENSE_EYE_VERSION})"
 
 # ========================== Step 3: Detect version ==========================
 note "Step 3 — Detect version"