Fix license validation CI and improve developer docs#187
Merged
leoromanovsky merged 5 commits intomainfrom Feb 27, 2026
Merged
Conversation
The Validate Licenses workflow has been failing on every commit since Feb 19 due to a stale yarn.lock entry introduced by an automated bot. The validation script itself also had a logic flaw (line-count comparison only) and all workflows used the deprecated --frozen-lockfile flag.
Run yarn licenses:generate to bring the file up to date with current dependencies.
dd-license-attribution produces different output on macOS vs Linux (different copyright strings and even license identifiers), making regenerate-and-diff validation inherently unreliable across environments. Replace with a lightweight check that verifies every npm package in yarn.lock has a corresponding entry in LICENSE-3rdparty.csv. This needs no external tools (Python, Go, dd-license-attribution, GITHUB_TOKEN) and runs identically on all platforms. The CI workflow is simplified from 7 steps to 2 (checkout + validate). Full regeneration remains a local dev workflow for when deps change.
greghuels
reviewed
Feb 27, 2026
|
|
||
| - name: Install dependencies | ||
| run: yarn install --frozen-lockfile | ||
| run: yarn install --immutable |
Collaborator
There was a problem hiding this comment.
This should be the same thing as frozen-lockfile, but it's the newer terminology for it, so probably good to keep it.
greghuels
approved these changes
Feb 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The Validate Licenses CI workflow has been failing on every commit since Feb 19 (commit #182). This blocks all PRs from getting a green license check.
Two root causes:
yarn.lockentry introduced by an automated bot that edited the lockfile by hand instead of runningyarn install.dd-license-attributionto regenerate and compare, but that tool produces different output on macOS vs Linux (different copyright strings and even license identifiers liketar: ISC → BlueOak-1.0.0). This made the regenerate-and-diff approach inherently unreliable across environments.Changes
yarn.lock: Removed a stale combined resolution key (@datadog/flagging-core@npm:1.0.0) that no dependency references anymore. The automated bot changed the dependency from1.0.0to0.3.3but only edited one line, leaving the resolution key dangling.licenses-validate.sh: Now a lightweight check that verifies every npm package inyarn.lockhas a corresponding entry inLICENSE-3rdparty.csv. No external tools needed — no Python, Go, dd-license-attribution, or GITHUB_TOKEN.--frozen-lockfilewith--immutablein all three CI workflows (ci.yaml,licenses.yaml,release.yaml). Yarn 4.x deprecated--frozen-lockfileand prints a warning on every run;--immutableis the correct equivalent.LICENSE-3rdparty.csvto bring it up to date with current dependencies.gh auth tokenshortcut, step-by-step instructions for generating and validating licenses locally, and links to internal docs.Decisions
dd-license-attributionis non-deterministic across OS (macOS vs Linux CI). Checked how dd-sdk-ios and dd-sdk-android handle this — both use simpler approaches (source header checks and a Gradle plugin respectively). The new script checks that every lockfile package has a CSV entry, which catches the main failure case (deps added without updating licenses) without any external tooling.dd-license-attributionfor generation: Auto-generation from the lockfile is the right trade-off for a JS monorepo where transitive dependency churn is high. Generation remains a local dev workflow; validation is what runs in CI.gh auth token: Most contributors already have GitHub CLI authenticated — this avoids needing to create and manage a separate fine-grained PAT.