Skip to content

Conversation

wchomik
Copy link
Contributor

@wchomik wchomik commented Sep 18, 2025

No description provided.

@@ -0,0 +1,151 @@
@actions/core
MIT
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wchomik is this file necessary and does it have the correct content? We have a license file here

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is generated every time during packaging phase by the npm. Contents depends on used npm packages. This is the same case as in existing helm-chart packages.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -0,0 +1,151 @@
@actions/core
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wchomik is this file necessary and does it have the correct content? We have a license file here

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is generated every time during packaging phase by the npm. Contents depends on used npm packages. This is the same case as in existing helm-chart packages.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -0,0 +1,170 @@
@actions/core
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wchomik is this file necessary and does it have the correct content? We have a license file here

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is generated every time during packaging phase by the npm. Contents depends on used npm packages. This is the same case as in existing helm-chart packages.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -0,0 +1,30 @@
# Kustomize Listing Document which contains all found Kustomize projects with kustomization.yaml or kustomization.yml

test_kustomize_helloWorld:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wchomik i don't think its good to have a pre-filled file committed & pushed. Pls remove yaml content

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I still see content committed. Please remove yaml content.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed the contents of the listing file but forgot to add it to the .gitignore so it got commited back in CI. Fixed

@wchomik
Copy link
Contributor Author

wchomik commented Oct 7, 2025

During the build process for our TypeScript-based GitHub Actions, a license.txt file is generated for each compiled package. These files aggregate the licenses of all npm dependencies used by the package.

Currently, the repository is managed under Apache-2.0 via REUSE. However, because REUSE tracks licensing on a per-file basis, it does not easily accommodate dynamically generated artifacts that include multiple third-party licenses. The result is that each dependancy (and all its files) may not be properly tracked or declared in a way that maintains REUSE compliance.

Addressing this properly would likely require:

  • A post-build step or script to automatically update REUSE metadata for each generated artifact.
  • A review of how REUSE can or should treat compiled outputs and bundled dependency licenses.

To avoid blocking the current PR, I recommend creating a separate backlog issue dedicated to defining a reliable and automated approach for REUSE compliance of compiled artifacts.

@wchomik
Copy link
Contributor Author

wchomik commented Oct 7, 2025

#90

@@ -0,0 +1,30 @@
# Kustomize Listing Document which contains all found Kustomize projects with kustomization.yaml or kustomization.yml

test_kustomize_helloWorld:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I still see content committed. Please remove yaml content.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants