You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ossie.apache.org by "sfc-gh-swalia (via GitHub)" <gi...@apache.org> on 2026/07/23 18:14:24 UTC
[PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
sfc-gh-swalia opened a new pull request, #258:
URL: https://github.com/apache/ossie/pull/258
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
## Summary
Adding community management workflows and compliance automation to bring GitHub infra in line with other ASF projects (modeled on Apache Iceberg's approach).
**Compliance:**
- Dependency license scanning on every PR - it blocks ASF Category X licenses (GPL, LGPL, AGPL, SSPL, EUPL) before merge
- Added Apache RAT integration for automated license header checks (prevents recurrence of the manual cleanup done in #242)
- ASF GitHub Actions allowlist verification ( now catches workflows that silently fail on apache/* repos)
- PR template updated with NOTICE/LICENSE obligation reminder for vendor code
**Community management:**
- Auto-label new issues `needs-triage`
- Path-based PR labeling with `sync-labels` (wildcard catch-all for `converters/**` + specific per-converter labels)
- First-time contributor welcome bot with ICLA reminder and Slack link
- Label state machine: `awaiting-response` flips to `needs-review` when author responds
- Stale issue/PR management (90-day issues, 60-day PRs — only targets items labeled `awaiting-response`, exempts anything assigned or milestoned)
**Governance:**
- PR title format enforcement (`Area: Description`) for clean squash-merge history
- Dependabot for GitHub Actions (weekly version updates, grouped)
All workflows include the ASF license header and are guarded with `if: github.repository_owner == 'apache'` so they do not fire on contributor forks.
Note: The labels referenced by these workflows (`needs-triage`, `awaiting-response`, `needs-review`, `stale`, `converter/*`, etc.) do not exist yet — GitHub creates them automatically on first use.
## Checklist
### Compliance
- [x] ASF license headers are present on all new source files
- [x] No third-party dependencies are added without PMC/IPMC approval
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "sfc-gh-swalia (via GitHub)" <gi...@apache.org>.
sfc-gh-swalia commented on PR #258:
URL: https://github.com/apache/ossie/pull/258#issuecomment-5062763637
> Can you please disclose any AI tool assistance?
Hey @jbonofre - Yes - I used Claude Opus 4.6 assistance for this PR. Primarily used it for researching ASF compliance patterns across workflow infrastructure, drafting workflow YAML andd validating configurations. I reviewed and validated the code before committing.
I propose we make AI tool disclosure a standard part of our contribution process i.e. a simple optional note in the PR template and a brief section in CONTRIBUTING.md. This keeps us transparent and aligned. Happy to include that in
this PR if people are on board.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on code in PR #258:
URL: https://github.com/apache/ossie/pull/258#discussion_r4110295771
##########
.github/workflows/auto-label-prs.yml:
##########
@@ -0,0 +1,63 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Auto Label PRs
+
+on:
+ pull_request_target:
+ types: [opened, synchronize, reopened]
+
+permissions:
+ contents: read
+ pull-requests: write
+ issues: write
+
+jobs:
+ label-by-files:
+ if: github.repository_owner == 'apache'
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+ - uses: actions/github-script@v7
+ with:
+ script: |
+ const fs = require('fs');
+ const yaml = require('js-yaml');
Review Comment:
I believe `require('js-yaml')` here will fail: `js-yaml` isn't a runtime dependency of `actions/github-script`. It only shows up in that package's dev/lint dependency tree (via `eslint`) and isn't bundled into the action's dist.
This will throw `Cannot find module 'js-yaml'` on every PR event before `actions/labeler@v5` even runs, so no PR will get auto-labeled.
I propose to either drop the YAML parsing (use `actions/labeler@v5` own config file support) or add `js-yaml` as an explicit dependency the script can actually resolve.
That is your call, but I think the auto-labeler won't work as it.
##########
.github/workflows/remove-awaiting-response.yml:
##########
@@ -0,0 +1,68 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Remove Awaiting Response Label
+
+on:
+ issue_comment:
+ types: [created]
+ pull_request_review_comment:
+ types: [created]
+ pull_request:
+ types: [synchronize]
+
+permissions:
+ issues: write
+ pull-requests: write
+
+jobs:
+ remove-awaiting-response:
+ if: github.repository_owner == 'apache'
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/github-script@v7
+ with:
+ script: |
+ const issue = context.issue || context.payload.pull_request;
+ const commenter = context.payload.comment?.user.login || context.payload.sender.login;
+ const issueAuthor = context.payload.issue?.user.login || context.payload.pull_request?.user.login;
+
+ if (commenter === issueAuthor) {
+ const { data: labels } = await github.rest.issues.listLabelsOnIssue({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ issue_number: issue.number
+ });
+
+ const hasLabel = labels.some(l => l.name === 'awaiting-response');
+
+ if (hasLabel) {
+ await github.rest.issues.removeLabel({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ issue_number: issue.number,
+ name: 'awaiting-response'
+ }).catch(() => {});
+
+ await github.rest.issues.addLabels({
Review Comment:
This `addLabels` call is unguarded, unlike `removeLabel` above it which has `.catch(() => {})`.
For `pull_request: synchronize` events from forked repos, GitHub issues a read-only `GITHUB_TOKEN` regardless of the `permissions:` block, so this call will 403 and fail the whole workflow run (which will happen on essentially every sync event from an external contributor fork).
I propose to wrap it in the same `.catch(() => {})` (or otherwise handle the 403) so a permissions failure doesn't take down the run.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre merged PR #258:
URL: https://github.com/apache/ossie/pull/258
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #258:
URL: https://github.com/apache/ossie/pull/258#issuecomment-5062591592
@sfc-gh-swalia Thanks for that! I will do the review. I saw some changes that are not required now and also to be clarified for release.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "sfc-gh-swalia (via GitHub)" <gi...@apache.org>.
sfc-gh-swalia commented on PR #258:
URL: https://github.com/apache/ossie/pull/258#issuecomment-5779624465
> Thanks for turning the rebase around within the hour. A header check that runs on every PR is what the dev@ thread was asking for, so I ran this branch through it locally.
>
> `dev/check-license` does not run as written. RAT 0.16.1 rejects the first option:
>
> ```
> ERROR: Unrecognized option: --input-exclude-file
> ```
>
> `--input-exclude-file`, `--input-exclude-std` and `--output-style` arrived in RAT 0.17. Setting `RAT_VERSION="0.18"` is enough; with that one change every option in the script is accepted. No workflow has run on this PR's head, which is why the checks here did not show it.
>
> With 0.18, on the pre-#416 tree the check flags 27 files: the 22 that #416 covered, plus five my grep there missed because it only looked at source extensions. Those five are still on main, so the check would go red on the first PR after this merges:
>
> * `converters/sigma/README.md` and `converters/sigma/LIMITATIONS.md` are the only Markdown files in the repo without the `<!-- -->` header.
> * `converters/microsoft/tests/fixtures/sales_model.bim` and `converters/microsoft/tests/test.ipynb` are JSON, so `**/*.bim` and `**/*.ipynb` belong in `.rat-excludes` next to `**/*.json`.
> * `converters/microsoft/tests/fixtures/sales_model.tmdl`: `tom.py` treats leading `///` lines as the description of the object below, so excluding the fixture is safer than a header.
>
> On the other workflows:
>
> * `community-pr-helper.yml`: `pulls.list` has no `creator` parameter, so the call returns the repo's PRs regardless of author (I checked against the live API), `prs.length` is always the page size, and the welcome never fires. `issues.listForRepo({ creator, state: 'all' })` filtered on `pull_request` would work. In the message itself, CONTRIBUTING.md now says an ICLA is only required at committer election (#339), and the Slack invite points to a different workspace than README and CONTRIBUTING.
> * `pr-title-check.yml`: over the last 60 merged PR titles the pattern passes 3. Parentheses are outside the character class, so `fix(dbt):`, `docs(core-spec):` and every dependabot `chore(deps):` title fail. Allowing `type(scope):` would avoid rejecting most incoming PRs on day one.
> * `labeler.yml`: `converters/` now also has `sigma`, `microsoft`, `nvidia` and `ontology`; the catch-all `converter` label still applies, so this is only the per-converter labels.
> * `dependency-review.yml`: the dependency graph is enabled on the repo, so this will run.
>
> The stale and awaiting-response workflows look fine to me; both only act on a label nothing here applies automatically.
>
> If it helps get the header check in before the release, `license-check.yml` plus `dev/` is independent of the rest and could land on its own. LGTM for that part once the RAT version is bumped and the five files above are handled.
Hey @kayemkim — thanks for the thorough review.
I addressed all the issues you raised: RAT bumped to 0.17, the five missing files added to `.rat-excludes` plus ASF headers added to the two sigma Markdown files, the community-pr-helper API fixed to use search.issuesAndPullRequests with total_count, ICLA wording corrected to match what (#339) updated in CONTRIBUTING.md, Slack link updated to the apache-ossie workspace, the PR title regex extended to allow type(scope): format, and the four missing converters added to labeler.yml.
While testing dev/check-license locally I also caught that the script had CRLF line endings, which would have broken it on any Linux runner. Fixed and locked in via .gitattributes.
I couldn't test dependency-review and stale locally as those depend on GitHub's dependency graph infrastructure and real aged issues. I am hoping CI will validate those once this merges.
Let me know what you think.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "sfc-gh-swalia (via GitHub)" <gi...@apache.org>.
sfc-gh-swalia commented on code in PR #258:
URL: https://github.com/apache/ossie/pull/258#discussion_r4106992392
##########
.github/workflows/stale.yml:
##########
@@ -0,0 +1,81 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Close Stale Issues and PRs
+
+on:
+ schedule:
+ - cron: '0 0 * * 0' # Weekly on Sunday midnight UTC
+ workflow_dispatch:
+
+permissions:
+ issues: write
+ pull-requests: write
+
+jobs:
+ stale:
+ if: github.repository_owner == 'apache'
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/stale@v9
+ with:
+ repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+ days-before-issue-stale: 90
+ days-before-issue-close: 14
Review Comment:
> For now, I would not close PRs/issues automatically. I'm fine to set the `stale` label.
Thanks @jbonofre — all feedback addressed in the latest commit. Disabled auto-close, added label bootstrapping for both issue and PR workflows, expanded the Category X license deny-list, and documented the fork PR limitation. Validated locally with actionlint.
runtime testing needs a maintainer to approve the workflow runs. I couldn't test past this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "sfc-gh-swalia (via GitHub)" <gi...@apache.org>.
sfc-gh-swalia commented on code in PR #258:
URL: https://github.com/apache/ossie/pull/258#discussion_r3641016211
##########
.github/workflows/asf-allowlist-check.yml:
##########
@@ -0,0 +1,36 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: ASF Allowlist Check
Review Comment:
thanks for the feedback @jbonofre . Will remove it. I originally added thinking as project grows and more folks edit workflow, it catches the infra issue. I see it might be premature for now. we can revisit later. will remove it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on code in PR #258:
URL: https://github.com/apache/ossie/pull/258#discussion_r4104548663
##########
.github/workflows/stale.yml:
##########
@@ -0,0 +1,81 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Close Stale Issues and PRs
+
+on:
+ schedule:
+ - cron: '0 0 * * 0' # Weekly on Sunday midnight UTC
+ workflow_dispatch:
+
+permissions:
+ issues: write
+ pull-requests: write
+
+jobs:
+ stale:
+ if: github.repository_owner == 'apache'
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/stale@v9
+ with:
+ repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+ days-before-issue-stale: 90
+ days-before-issue-close: 14
Review Comment:
For now, I would not close PRs/issues automatically. I'm fine to set the `stale` label.
##########
.github/workflows/auto-label-issues.yml:
##########
@@ -0,0 +1,40 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Auto Label New Issues
+
+on:
+ issues:
+ types: [opened]
+
+permissions:
+ issues: write
+
+jobs:
+ label:
+ if: github.repository_owner == 'apache'
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/github-script@v7
+ with:
+ script: |
+ await github.rest.issues.addLabels({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ issue_number: context.issue.number,
+ labels: ['needs-triage']
Review Comment:
I don't see `needs-triage` label created anywhere, and GitHub's addLabels endpoint requires the label to exist.
Since the PR description says these labels are initially absent, this step will fail for new issues.
Could we create the label during setup or have the workflow create it before adding it?
##########
.github/workflows/auto-label-prs.yml:
##########
@@ -0,0 +1,36 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Auto Label PRs
+
+on:
+ pull_request_target:
+ types: [opened, synchronize, reopened]
+
+permissions:
+ contents: read
+ pull-requests: write
Review Comment:
The labels in `labeler.yml` are also not seeded. `actions/labeler` needs `issues: write` to create missing labels, but this workflow grants only `pull-requests: write`.
Its initial run will fail when it tries to create those labels.
Could we grant `issues: write` or create the labels before enabling this workflow?
##########
.github/workflows/dependency-review.yml:
##########
@@ -0,0 +1,35 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Dependency Review
+
+on: [pull_request]
+
+permissions:
+ contents: read
+ pull-requests: write
+
+jobs:
+ dependency-review:
+ if: github.repository_owner == 'apache'
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+ - uses: actions/dependency-review-action@v4
+ with:
+ deny-licenses: GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later, SSPL-1.0, EUPL-1.1, EUPL-1.2
Review Comment:
This list misses ASF Category X license versions, including GPL 1 and LGPL 2.0.
For example, `GPL-1.0-only` and `LGPL-2.0-only` would not match the listed identifiers, so those dependencies could pass this policy check.
Could we include the remaining Category X identifiers?
##########
.github/workflows/stale.yml:
##########
@@ -0,0 +1,81 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Close Stale Issues and PRs
+
+on:
+ schedule:
+ - cron: '0 0 * * 0' # Weekly on Sunday midnight UTC
+ workflow_dispatch:
+
+permissions:
+ issues: write
+ pull-requests: write
+
+jobs:
+ stale:
+ if: github.repository_owner == 'apache'
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/stale@v9
+ with:
+ repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+ days-before-issue-stale: 90
+ days-before-issue-close: 14
+ stale-issue-label: 'stale'
+ only-issue-labels: 'awaiting-response'
+ stale-issue-message: >
+ This issue has been automatically marked as stale because it has been
+ waiting for a response for 90 days. It will be closed in 14 days if
+ no further activity occurs.
+
+ If this is still relevant, please provide the requested information or
+ comment to keep it open. You can also reach out on the dev@ossie.apache.org
+ mailing list.
+ close-issue-message: >
+ This issue has been automatically closed due to inactivity.
+
+ If this is still relevant, please feel free to:
+ - Reopen this issue with the requested information
+ - Create a new issue with complete details
+ - Discuss on the dev@ossie.apache.org mailing list
+
+ days-before-pr-stale: 60
+ days-before-pr-close: 14
Review Comment:
No close for now please.
##########
.github/workflows/dependency-review.yml:
##########
@@ -0,0 +1,35 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Dependency Review
+
+on: [pull_request]
+
+permissions:
+ contents: read
+ pull-requests: write
+
+jobs:
+ dependency-review:
+ if: github.repository_owner == 'apache'
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+ - uses: actions/dependency-review-action@v4
+ with:
+ deny-licenses: GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later, SSPL-1.0, EUPL-1.1, EUPL-1.2
Review Comment:
Fork-originated PRs run with a read-only `GITHUB_TOKEN`, even though `pull-requests: write` is declared here.
The dependency check can run, but the action cannot post this summary comment on those PRs.
Could we account for fork permissions or document that limitation?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #258:
URL: https://github.com/apache/ossie/pull/258#issuecomment-5788753049
Thanks! Let me do a review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on code in PR #258:
URL: https://github.com/apache/ossie/pull/258#discussion_r3640889650
##########
.github/workflows/asf-allowlist-check.yml:
##########
@@ -0,0 +1,36 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: ASF Allowlist Check
Review Comment:
That is not required. What's the purpose here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #258:
URL: https://github.com/apache/ossie/pull/258#issuecomment-5062609358
Can you please disclose any AI tool assistance?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #258:
URL: https://github.com/apache/ossie/pull/258#issuecomment-5777143848
@sfc-gh-swalia do you mind to rebase and resolve conflict? I think part of this PR is already implemented.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "kayemkim (via GitHub)" <gi...@apache.org>.
kayemkim commented on PR #258:
URL: https://github.com/apache/ossie/pull/258#issuecomment-5786559497
Re-ran on 0ad3a37 merged into current main (94a688c). `dev/check-license` with 0.17 passes clean, exit 0. On the pre-#416 tree the same script still flags the 22 files from #416 plus the two sigma Markdown files, so the new excludes do not hide anything that should carry a header. The revised title pattern passes 29 of the same 60 merged titles; the rest have no prefix at all (`Fix ...`, `Add ...`), which is the convention the check is there to introduce. The search query returns 5 for you and 1 for a single-PR author, so the first-time check works now. Everything from my earlier comment is addressed, so LGTM from me.
Two small notes, neither needs a change. The committed `dev/check-license` at 0561546 already had LF endings (zero CR bytes), so the CRLF was on the checkout side; the `.gitattributes` guard is fine to keep. And on `opened` the search index can lag a few seconds behind the new PR, so a second-time contributor might see `total_count` of 1 and get greeted again. Harmless.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "sfc-gh-swalia (via GitHub)" <gi...@apache.org>.
sfc-gh-swalia commented on PR #258:
URL: https://github.com/apache/ossie/pull/258#issuecomment-5063096538
> Can you please disclose any AI tool assistance?
@jbonofre https://github.com/apache/ossie/pull/259 - I added this PR asking contributors to disclose AI usage
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "sfc-gh-swalia (via GitHub)" <gi...@apache.org>.
sfc-gh-swalia commented on PR #258:
URL: https://github.com/apache/ossie/pull/258#issuecomment-5777954768
> @sfc-gh-swalia do you mind to rebase and resolve conflict? I think part of this PR is already implemented.
Hey @jbonofre - Done! ready for your review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Infra: Add community workflows, compliance automation, and dependency review [ossie]
Posted by "sfc-gh-swalia (via GitHub)" <gi...@apache.org>.
sfc-gh-swalia commented on code in PR #258:
URL: https://github.com/apache/ossie/pull/258#discussion_r4111206895
##########
.github/workflows/auto-label-prs.yml:
##########
@@ -0,0 +1,63 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Auto Label PRs
+
+on:
+ pull_request_target:
+ types: [opened, synchronize, reopened]
+
+permissions:
+ contents: read
+ pull-requests: write
+ issues: write
+
+jobs:
+ label-by-files:
+ if: github.repository_owner == 'apache'
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+ - uses: actions/github-script@v7
+ with:
+ script: |
+ const fs = require('fs');
+ const yaml = require('js-yaml');
Review Comment:
> I believe `require('js-yaml')` here will fail: `js-yaml` isn't a runtime dependency of `actions/github-script`. It only shows up in that package's dev/lint dependency tree (via `eslint`) and isn't bundled into the action's dist.
>
> This will throw `Cannot find module 'js-yaml'` on every PR event before `actions/labeler@v5` even runs, so no PR will get auto-labeled.
>
> I propose to either drop the YAML parsing (use `actions/labeler@v5` own config file support) or add `js-yaml` as an explicit dependency the script can actually resolve.
>
> That is your call, but I think the auto-labeler won't work as it.
Thanks @jbonofre. I replaced js-yaml with plain text parsing in the label bootstrap (no runtime dependency needed), and guarded the addLabels call in remove-awaiting-response.yml with .catch() to handle read-only tokens on fork PRs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org