License check in "auto-review" mode: the Gitlab token will soon expire #14127
Comments
marcdumais-work
added a commit
that referenced
this issue
Sep 6, 2024
Related issue: #14127 The Eclipse Foundation Gitlab token, required for dash-licenses to automatically open IP ticket for suspicious license in dependencies. is about to expire. Until it's replaced, we can have the workflow use the basic mode, where dependecies with suspicious licenses are only listed, and have to be handled offline [1]. [1]: To have dash-licenses help with opening IP tickets automatically e.g. after a PR license check workflow failure. Any committer can generate a token from EF Gitlab at the link below and set it in an environment variable, and then use it when running dash-licenses from their laptop. e.g. theia$ git checkout <PR branch> && yarn theia$ export DASH_LICENSES_PAT="<token>" theia$ yarn license:check:review https://gitlab.eclipse.org/-/user_settings/personal_access_tokens Signed-off-by: Marc Dumais <marc.dumais@ericsson.com>
1 task
marcdumais-work
added a commit
that referenced
this issue
Nov 22, 2024
Related issue: #14127 The Eclipse Foundation Gitlab token, required for dash-licenses to automatically open IP ticket for suspicious license in dependencies. is about to expire. Until it's replaced, we can have the workflow use the basic mode, where dependecies with suspicious licenses are only listed, and have to be handled offline [1]. [1]: To have dash-licenses help with opening IP tickets automatically e.g. after a PR license check workflow failure. Any committer can generate a token from EF Gitlab at the link below and set it in an environment variable, and then use it when running dash-licenses from their laptop. e.g. theia$ git checkout <PR branch> && yarn theia$ export DASH_LICENSES_PAT="<token>" theia$ yarn license:check:review https://gitlab.eclipse.org/-/user_settings/personal_access_tokens Signed-off-by: Marc Dumais <marc.dumais@ericsson.com>
1 task
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Bug Description:
In this repo, the license check that's run in CI uses
dash-license'sso-called auto-review mode. In that mode,dash-licenseswill try to automatically open IP ticket, on the Eclipse Foundation Gitlab, for all dependencies found to require extra scrutiny from the IP team. This requires an EF Gitlab token to work, currently set as a secret in this repo and exposed during CI as an environment variable.I set the "secrets.DASH_LICENSES_PAT" secret a few years ago, using a token generated using my own Eclipse Gitlab account. I was recently notified that this token is expiring in 2 days, on September 6. AFAIK this should not cause too much disturbance in Theia's CI, but it will mean that committer's PR, using the main repo as source, will no longer trigger automatic opening of IP tickets for newly added dependencies. If it's desired to keep having automatic IP tickets creation, a new Gitlab token should be set as a secret, overwriting the current soon-to-be-expired one. Maybe webmaster can generate a token using an appropriately named bot account and set it up in this repo? Else a normal user token would also work.
Alternatively, "yarn license:check" could be used in CI to report dependencies that need be analysed, but not attempt to open the IP tickets automatically. Then a committer can run the "review" mode locally on their laptop, when the license check CI fails (I do that in cdt.cloud repos I work-on). This still requires a token, but then it does not need to be setup in the repo as a secret.
Steps to Reproduce:
N/A
Additional Information
I simulated what the log will look-like when the token expires, when there are dependencies to open IP tickets about (after performing a local "yarn upgrade") - there is a runtime exception "org.gitlab4j.api.GitLabApiException: 401 Unauthorized" but the results still list the packages that need to be analysed by the IP team:
The text was updated successfully, but these errors were encountered: