(fluss) branch main updated: [license] Compare packaged wheel licenses with generated files (#4404)

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

wuchong pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/fluss.git


The following commit(s) were added to refs/heads/main by this push:
     new 2c1e356818 [license] Compare packaged wheel licenses with generated files (#4404)
2c1e356818 is described below

commit 2c1e3568183477091e709804159a136a8234c77d
Author: Jark Wu <ja...@apache.org>
AuthorDate: Fri Sep 18 12:14:15 2026 +0800

    [license] Compare packaged wheel licenses with generated files (#4404)
    
    Hardcoded attribution checks can fail after a dependency is legitimately
    removed, and only verify selected strings. Upload each target's generated
    LICENSE-bin and NOTICE-bin with its wheels and compare the packaged files
    against those originals. Keep artifacts separated by target and collect
    only wheel and sdist archives for publishing.
    
    Address the non-blocking review feedback on PR #4397. Validated with
    actionlint and 12 local workflow executions, including a real wheel and
    sdist, target separation, and missing or mismatched license files.
    
    
    AI-Model: gpt-6
    AI-Contributed/Feature: 33/33
    AI-Contributed/UT: 0/0
    
    Co-authored-by: Codex <no...@openai.com>
---
 .github/workflows/python-release.yml | 33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml
index 294c4e854b..dc58d892e6 100644
--- a/.github/workflows/python-release.yml
+++ b/.github/workflows/python-release.yml
@@ -120,7 +120,10 @@ jobs:
         uses: actions/upload-artifact@v7
         with:
           name: wheels-${{ matrix.os }}-${{ matrix.target || 'native' }}
-          path: fluss-rust/bindings/python/dist
+          path: |
+            fluss-rust/bindings/python/dist/*.whl
+            fluss-rust/bindings/python/LICENSE-bin
+            fluss-rust/bindings/python/NOTICE-bin
 
   verify-license:
     name: Verify LICENSE and NOTICE
@@ -130,13 +133,13 @@ jobs:
       - uses: actions/download-artifact@v8
         with:
           pattern: wheels-*
-          merge-multiple: true
-          path: dist
+          merge-multiple: false
+          path: artifacts
 
       # maturin ships these only when [project].license-files lists them.
       - name: Check the sdist and every wheel
         run: |
-          SDIST=$(ls dist/*.tar.gz)
+          SDIST=$(ls artifacts/wheels-sdist/*.tar.gz)
           PREFIX=$(basename "$SDIST" .tar.gz)
           for f in LICENSE NOTICE LICENSE-bin NOTICE-bin; do
             if [ -z "$(tar -xzOf "$SDIST" "${PREFIX}/${f}" 2>/dev/null)" ]; then
@@ -144,23 +147,20 @@ jobs:
               exit 1
             fi
           done
-          for whl in dist/*.whl; do
+          for whl in artifacts/wheels-*/dist/*.whl; do
+            artifact_dir=$(dirname "$(dirname "$whl")")
             for f in LICENSE NOTICE LICENSE-bin NOTICE-bin; do
               if ! unzip -p "$whl" "*.dist-info/licenses/${f}" 2>/dev/null | grep . >/dev/null; then
                 echo "Error: ${f} is missing or empty in ${whl}"
                 exit 1
               fi
             done
-            for text in "Tokio Contributors" "Carl Lerche" "Meta Platforms" "1991-2018 Unicode"; do
-              if ! unzip -p "$whl" "*.dist-info/licenses/LICENSE-bin" | grep -F "$text" >/dev/null; then
-                echo "Error: $text attribution is missing in $whl"
+            for f in LICENSE-bin NOTICE-bin; do
+              if ! unzip -p "$whl" "*.dist-info/licenses/${f}" | diff -u "${artifact_dir}/${f}" -; then
+                echo "Error: packaged ${f} differs from the generated file in ${whl}"
                 exit 1
               fi
             done
-            if ! unzip -p "$whl" "*.dist-info/licenses/NOTICE-bin" | grep -F "Apache Arrow" >/dev/null; then
-              echo "Error: Arrow NOTICE is missing in $whl"
-              exit 1
-            fi
           done
 
   release:
@@ -175,8 +175,13 @@ jobs:
       - uses: actions/download-artifact@v8
         with:
           pattern: wheels-*
-          merge-multiple: true
-          path: fluss-rust/bindings/python/dist
+          merge-multiple: false
+          path: artifacts
+
+      - name: Collect distributions for publishing
+        run: |
+          mkdir -p fluss-rust/bindings/python/dist
+          cp artifacts/wheels-sdist/*.tar.gz artifacts/wheels-*/dist/*.whl fluss-rust/bindings/python/dist/
 
       - name: Publish to TestPyPI
         if: contains(github.ref, '-')