From 440c1eaf51509804b7a3df2b5c6235849237ce4d Mon Sep 17 00:00:00 2001 From: Sahil Walia Date: Thu, 23 Jul 2026 13:49:18 -0400 Subject: [PATCH 1/6] Infra: Add community workflows, compliance automation, and dependency review --- .github/PULL_REQUEST_TEMPLATE.md | 4 +- .github/labeler.yml | 96 +++++++++++++++++++ .github/workflows/asf-allowlist-check.yml | 36 +++++++ .github/workflows/auto-label-issues.yml | 40 ++++++++ .github/workflows/auto-label-prs.yml | 36 +++++++ .github/workflows/community-pr-helper.yml | 67 +++++++++++++ .github/workflows/dependency-review.yml | 35 +++++++ .github/workflows/license-check.yml | 35 +++++++ .github/workflows/pr-title-check.yml | 51 ++++++++++ .../workflows/remove-awaiting-response.yml | 68 +++++++++++++ .github/workflows/stale.yml | 81 ++++++++++++++++ .gitignore | 3 + dev/.rat-excludes | 62 ++++++++++++ dev/check-license | 52 ++++++++++ 14 files changed, 665 insertions(+), 1 deletion(-) create mode 100644 .github/labeler.yml create mode 100644 .github/workflows/asf-allowlist-check.yml create mode 100644 .github/workflows/auto-label-issues.yml create mode 100644 .github/workflows/auto-label-prs.yml create mode 100644 .github/workflows/community-pr-helper.yml create mode 100644 .github/workflows/dependency-review.yml create mode 100644 .github/workflows/license-check.yml create mode 100644 .github/workflows/pr-title-check.yml create mode 100644 .github/workflows/remove-awaiting-response.yml create mode 100644 .github/workflows/stale.yml create mode 100644 dev/.rat-excludes create mode 100755 dev/check-license diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 0f72f9fe..626e6235 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -39,6 +39,7 @@ ### Converters - [ ] Converter logic in `converters/` is updated to reflect spec or ontology changes - [ ] New converters include tests under the converter's test directory +- [ ] If adding a new converter, `.github/labeler.yml` is updated with the new path ### Validation - [ ] Validation rules in `validation/` are updated if the spec changed @@ -58,4 +59,5 @@ ### Compliance - [ ] ASF license headers are present on all new source files -- [ ] No third-party dependencies are added without PMC/IPMC approval \ No newline at end of file +- [ ] No third-party dependencies are added without PMC/IPMC approval +- [ ] If third-party source code is vendored/copied (not just declared as a dependency), `NOTICE` and/or `LICENSE` have been updated per [ASF policy](https://infra.apache.org/licensing-howto.html) diff --git a/.github/labeler.yml b/.github/labeler.yml new file mode 100644 index 00000000..25109bb3 --- /dev/null +++ b/.github/labeler.yml @@ -0,0 +1,96 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Catch-all: any converter change gets this label (including new converters) +converter: + - changed-files: + - any-glob-to-any-file: 'converters/**' + +# Specific converter labels +converter/dbt: + - changed-files: + - any-glob-to-any-file: 'converters/dbt/**' + +converter/databricks: + - changed-files: + - any-glob-to-any-file: 'converters/databricks/**' + +converter/gooddata: + - changed-files: + - any-glob-to-any-file: 'converters/gooddata/**' + +converter/honeydew: + - changed-files: + - any-glob-to-any-file: 'converters/honeydew/**' + +converter/omni: + - changed-files: + - any-glob-to-any-file: 'converters/omni/**' + +converter/orionbelt: + - changed-files: + - any-glob-to-any-file: 'converters/orionbelt/**' + +converter/polaris: + - changed-files: + - any-glob-to-any-file: 'converters/polaris/**' + +converter/salesforce: + - changed-files: + - any-glob-to-any-file: 'converters/salesforce/**' + +converter/snowflake: + - changed-files: + - any-glob-to-any-file: 'converters/snowflake/**' + +converter/wisdom: + - changed-files: + - any-glob-to-any-file: 'converters/wisdom/**' + +# Other areas +cli: + - changed-files: + - any-glob-to-any-file: 'cli/**' + +spec: + - changed-files: + - any-glob-to-any-file: 'core-spec/**' + +ontology: + - changed-files: + - any-glob-to-any-file: 'ontology/**' + +docs: + - changed-files: + - any-glob-to-any-file: 'docs/**' + +validation: + - changed-files: + - any-glob-to-any-file: 'validation/**' + +examples: + - changed-files: + - any-glob-to-any-file: 'examples/**' + +infra: + - changed-files: + - any-glob-to-any-file: + - '.github/**' + - '.asf.yaml' + - 'Makefile' + - '.pre-commit-config.yaml' + - 'ruff.toml' diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml new file mode 100644 index 00000000..f8ced8bd --- /dev/null +++ b/.github/workflows/asf-allowlist-check.yml @@ -0,0 +1,36 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: ASF Allowlist Check + +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +jobs: + asf-allowlist-check: + if: github.repository_owner == 'apache' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - uses: apache/infrastructure-actions/allowlist-check@main diff --git a/.github/workflows/auto-label-issues.yml b/.github/workflows/auto-label-issues.yml new file mode 100644 index 00000000..027f7064 --- /dev/null +++ b/.github/workflows/auto-label-issues.yml @@ -0,0 +1,40 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Auto Label New Issues + +on: + issues: + types: [opened] + +permissions: + issues: write + +jobs: + label: + if: github.repository_owner == 'apache' + runs-on: ubuntu-latest + steps: + - uses: actions/github-script@v7 + with: + script: | + await github.rest.issues.addLabels({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.issue.number, + labels: ['needs-triage'] + }); diff --git a/.github/workflows/auto-label-prs.yml b/.github/workflows/auto-label-prs.yml new file mode 100644 index 00000000..fc46257a --- /dev/null +++ b/.github/workflows/auto-label-prs.yml @@ -0,0 +1,36 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Auto Label PRs + +on: + pull_request_target: + types: [opened, synchronize, reopened] + +permissions: + contents: read + pull-requests: write + +jobs: + label-by-files: + if: github.repository_owner == 'apache' + runs-on: ubuntu-latest + steps: + - uses: actions/labeler@v5 + with: + repo-token: ${{ secrets.GITHUB_TOKEN }} + sync-labels: true diff --git a/.github/workflows/community-pr-helper.yml b/.github/workflows/community-pr-helper.yml new file mode 100644 index 00000000..ffcff322 --- /dev/null +++ b/.github/workflows/community-pr-helper.yml @@ -0,0 +1,67 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Community PR Helper + +on: + pull_request_target: + types: [opened] + +permissions: + pull-requests: write + +jobs: + welcome: + if: github.repository_owner == 'apache' + runs-on: ubuntu-latest + steps: + - uses: actions/github-script@v7 + with: + script: | + // Only greet first-time contributors + const { data: prs } = await github.rest.pulls.list({ + owner: context.repo.owner, + repo: context.repo.repo, + state: 'all', + creator: context.payload.pull_request.user.login + }); + + if (prs.length > 1) { + console.log('Not a first-time contributor, skipping welcome.'); + return; + } + + await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.payload.pull_request.number, + body: [ + 'Thank you for your first contribution to Apache Ossie (incubating)!', + '', + 'A committer will review your PR. In the meantime, please ensure:', + '', + '- All CI checks pass', + '- ASF license headers are present on new source files', + '- Tests cover new functionality', + '', + '**Before your contribution can be merged**, you need an [Individual Contributor License Agreement (ICLA)](https://www.apache.org/licenses/contributor-agreements.html) on file with the ASF.', + '', + '**Questions?** Ask in the PR comments or on our [Slack](https://join.slack.com/t/ossaboratories/shared_invite/zt-38v10kmo4-TZXFfGCPwPEM4SPhKrAHUw).', + '', + 'We appreciate your contribution!' + ].join('\n') + }); diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 00000000..47b54cbd --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,35 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Dependency Review + +on: [pull_request] + +permissions: + contents: read + pull-requests: write + +jobs: + dependency-review: + if: github.repository_owner == 'apache' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/dependency-review-action@v4 + with: + deny-licenses: GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later, SSPL-1.0, EUPL-1.1, EUPL-1.2 + comment-summary-in-pr: always diff --git a/.github/workflows/license-check.yml b/.github/workflows/license-check.yml new file mode 100644 index 00000000..f9764689 --- /dev/null +++ b/.github/workflows/license-check.yml @@ -0,0 +1,35 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: License Header Check + +on: + pull_request: + +permissions: + contents: read + +jobs: + rat: + if: github.repository_owner == 'apache' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - name: Run Apache RAT + run: dev/check-license diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml new file mode 100644 index 00000000..17ba8541 --- /dev/null +++ b/.github/workflows/pr-title-check.yml @@ -0,0 +1,51 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: PR Title Check + +on: + pull_request: + types: [opened, edited, reopened] + +permissions: + contents: read + +jobs: + check-pr-title: + if: github.repository_owner == 'apache' + runs-on: ubuntu-latest + env: + PR_TITLE: ${{ github.event.pull_request.title }} + steps: + - name: Check PR title format + run: | + # Enforce "Area: Description" format + # Examples: "Converter/dbt: Add metric support", "CLI: Fix plugin listing", "Spec: Update entity schema" + PATTERN='^(Revert ")?[A-Za-z][A-Za-z0-9._+/&,-]*( [A-Za-z0-9][A-Za-z0-9._+/&,-]*)*: .+' + if ! echo "$PR_TITLE" | grep -Eq "$PATTERN"; then + echo "::error::PR title must follow 'Area: Description' format." + echo "" + echo "Examples:" + echo " Converter/dbt: Add metric support" + echo " CLI: Fix plugin listing" + echo " Spec: Update entity schema" + echo " Infra: Add community workflows" + echo " Docs: Update contributing guide" + echo "" + echo "Valid area prefixes include: Converter/, CLI, Spec, Ontology, Docs, Infra, Validation, Examples" + exit 1 + fi diff --git a/.github/workflows/remove-awaiting-response.yml b/.github/workflows/remove-awaiting-response.yml new file mode 100644 index 00000000..3b23a7c0 --- /dev/null +++ b/.github/workflows/remove-awaiting-response.yml @@ -0,0 +1,68 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Remove Awaiting Response Label + +on: + issue_comment: + types: [created] + pull_request_review_comment: + types: [created] + pull_request: + types: [synchronize] + +permissions: + issues: write + pull-requests: write + +jobs: + remove-awaiting-response: + if: github.repository_owner == 'apache' + runs-on: ubuntu-latest + steps: + - uses: actions/github-script@v7 + with: + script: | + const issue = context.issue || context.payload.pull_request; + const commenter = context.payload.comment?.user.login || context.payload.sender.login; + const issueAuthor = context.payload.issue?.user.login || context.payload.pull_request?.user.login; + + if (commenter === issueAuthor) { + const { data: labels } = await github.rest.issues.listLabelsOnIssue({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: issue.number + }); + + const hasLabel = labels.some(l => l.name === 'awaiting-response'); + + if (hasLabel) { + await github.rest.issues.removeLabel({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: issue.number, + name: 'awaiting-response' + }).catch(() => {}); + + await github.rest.issues.addLabels({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: issue.number, + labels: ['needs-review'] + }); + } + } diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml new file mode 100644 index 00000000..59b2e827 --- /dev/null +++ b/.github/workflows/stale.yml @@ -0,0 +1,81 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Close Stale Issues and PRs + +on: + schedule: + - cron: '0 0 * * 0' # Weekly on Sunday midnight UTC + workflow_dispatch: + +permissions: + issues: write + pull-requests: write + +jobs: + stale: + if: github.repository_owner == 'apache' + runs-on: ubuntu-latest + steps: + - uses: actions/stale@v9 + with: + repo-token: ${{ secrets.GITHUB_TOKEN }} + + days-before-issue-stale: 90 + days-before-issue-close: 14 + stale-issue-label: 'stale' + only-issue-labels: 'awaiting-response' + stale-issue-message: > + This issue has been automatically marked as stale because it has been + waiting for a response for 90 days. It will be closed in 14 days if + no further activity occurs. + + If this is still relevant, please provide the requested information or + comment to keep it open. You can also reach out on the dev@ossie.apache.org + mailing list. + close-issue-message: > + This issue has been automatically closed due to inactivity. + + If this is still relevant, please feel free to: + - Reopen this issue with the requested information + - Create a new issue with complete details + - Discuss on the dev@ossie.apache.org mailing list + + days-before-pr-stale: 60 + days-before-pr-close: 14 + stale-pr-label: 'stale' + only-pr-labels: 'awaiting-response' + stale-pr-message: > + This pull request has been marked as stale because the requested + changes or feedback have not been addressed for 60 days. It will be + closed in 14 days if no activity occurs. + + To keep this PR active, please address the review comments or respond + to questions from reviewers. + close-pr-message: > + This pull request has been automatically closed due to inactivity. + + If you would like to continue this work, please reopen the PR and + address the outstanding feedback. We appreciate your contribution! + + exempt-issue-labels: 'priority:critical,security,good-first-issue,in-progress,needs-review,needs-triage' + exempt-pr-labels: 'priority:critical,security,in-progress,needs-review' + exempt-all-issue-assignees: true + exempt-all-pr-assignees: true + exempt-all-issue-milestones: true + exempt-all-pr-milestones: true + operations-per-run: 100 diff --git a/.gitignore b/.gitignore index 136e4e9a..f6a84d9c 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,6 @@ cli/dist/ cli/ossie cli/.tool-versions + +# Apache RAT (downloaded by dev/check-license) +dev/lib/ diff --git a/dev/.rat-excludes b/dev/.rat-excludes new file mode 100644 index 00000000..c0fb61fa --- /dev/null +++ b/dev/.rat-excludes @@ -0,0 +1,62 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Files excluded from Apache RAT license header checks. +# Keep this list minimal — only exclude files where a license header +# is impossible or inappropriate (binary, generated, third-party). + +# Binary and generated files +**/*.png +**/*.jpg +**/*.ico +**/*.woff +**/*.woff2 + +# Lock files and dependency manifests +**/*.lock +**/go.sum + +# Data/config files that cannot contain comments +**/*.json +**/*.csv + +# Snapshot/fixture test files +**/snapshots/** +**/__snapshots__/** + +# Git and IDE +.git/** +.idea/** +.vscode/** +**/.gitignore + +# Build output +**/build/** +**/dist/** +**/*.egg-info/** +**/__pycache__/** +**/node_modules/** +**/.venv/** +**/target/** + +# Files that are themselves license/notice +**/LICENSE +**/NOTICE + +# Specific project files +.editorconfig +.python-version diff --git a/dev/check-license b/dev/check-license new file mode 100755 index 00000000..0b63b872 --- /dev/null +++ b/dev/check-license @@ -0,0 +1,52 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Checks that all source files contain the ASF license header +# using Apache RAT (Release Audit Tool). + +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)" +RAT_VERSION="0.16.1" +RAT_JAR="$SCRIPT_DIR/lib/apache-rat-${RAT_VERSION}.jar" +RAT_URL="https://repo1.maven.org/maven2/org/apache/rat/apache-rat/${RAT_VERSION}/apache-rat-${RAT_VERSION}.jar" + +# Download RAT if not cached +if [ ! -f "$RAT_JAR" ]; then + echo "Downloading Apache RAT ${RAT_VERSION}..." + mkdir -p "$SCRIPT_DIR/lib" + curl -sSfL -o "$RAT_JAR" "$RAT_URL" +fi + +# Ensure Java is available +if ! command -v java &> /dev/null; then + echo "ERROR: Java is required to run Apache RAT." + echo "Install Java 11+ and ensure it is on PATH." + exit 1 +fi + +echo "Running Apache RAT license header check..." +java -jar "$RAT_JAR" \ + --input-exclude-file "$SCRIPT_DIR/.rat-excludes" \ + --input-exclude-std GIT IDEA MAC \ + --output-style missing-headers \ + --log-level ERROR \ + -- "$REPO_DIR" + +echo "License header check passed." From 05615461d1b5f85054df56235a1672f78fce9952 Mon Sep 17 00:00:00 2001 From: Sahil Walia Date: Thu, 23 Jul 2026 16:09:59 -0400 Subject: [PATCH 2/6] Removing allowlist check yaml --- .github/workflows/asf-allowlist-check.yml | 36 ----------------------- 1 file changed, 36 deletions(-) delete mode 100644 .github/workflows/asf-allowlist-check.yml diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml deleted file mode 100644 index f8ced8bd..00000000 --- a/.github/workflows/asf-allowlist-check.yml +++ /dev/null @@ -1,36 +0,0 @@ -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, -# software distributed under the License is distributed on an -# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -# KIND, either express or implied. See the License for the -# specific language governing permissions and limitations -# under the License. - -name: ASF Allowlist Check - -on: - pull_request: - push: - branches: [main] - -permissions: - contents: read - -jobs: - asf-allowlist-check: - if: github.repository_owner == 'apache' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false - - uses: apache/infrastructure-actions/allowlist-check@main From 0ad3a37964cd86509eaab107c9b009416b0a24c8 Mon Sep 17 00:00:00 2001 From: Sahil Walia Date: Tue, 22 Sep 2026 11:46:29 -0400 Subject: [PATCH 3/6] Addressing review feedback from @kayemkim - Bumped RAT version 0.16.1 to 0.17 ( since 0.17 is the minimum with ```--input-exclude-file``` and ```--output-style;```) - Added missing entries to .rat-excludes: *.bim, *.ipynb, sales_model.tmdl - Added ASF license headers to converters/sigma/README.md and LIMITATIONS.md - Fixed CRLF line endings in ```dev/check-license``` (it was breaking on Linux runners) lock in LF via new .gitattributes rule - Fixed community-pr-helper and replaceed pulls.list (no creator param) with search.issuesAndPullRequests; correct ICLA wording per #339; fix Slack link to apache-ossie workspace (was pointing to ossaboratories) - Fixed pr-title-check regex to allow type(scope): format; parentheses were missing from the character class, rejecting fix(dbt): chore(deps): etc. - Add converter/sigma, converter/microsoft, converter/nvidia, converter/ontology labels to labeler.yml Tested locally: dev/check-license passes clean (zero flagged files), pr-title regex validated against last 60 merged PR titles. --- .gitattributes | 19 +++++++++++++++++++ .github/labeler.yml | 16 ++++++++++++++++ .github/workflows/community-pr-helper.yml | 16 +++++++--------- .github/workflows/pr-title-check.yml | 14 +++++++------- converters/sigma/LIMITATIONS.md | 19 +++++++++++++++++++ converters/sigma/README.md | 19 +++++++++++++++++++ dev/.rat-excludes | 5 +++++ dev/check-license | 2 +- 8 files changed, 93 insertions(+), 17 deletions(-) create mode 100644 .gitattributes diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 00000000..c6997a88 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,19 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Shell scripts must use LF line endings to run on Linux CI runners +dev/check-license eol=lf diff --git a/.github/labeler.yml b/.github/labeler.yml index 25109bb3..513dc7b3 100644 --- a/.github/labeler.yml +++ b/.github/labeler.yml @@ -61,6 +61,22 @@ converter/wisdom: - changed-files: - any-glob-to-any-file: 'converters/wisdom/**' +converter/sigma: + - changed-files: + - any-glob-to-any-file: 'converters/sigma/**' + +converter/microsoft: + - changed-files: + - any-glob-to-any-file: 'converters/microsoft/**' + +converter/nvidia: + - changed-files: + - any-glob-to-any-file: 'converters/nvidia/**' + +converter/ontology: + - changed-files: + - any-glob-to-any-file: 'converters/ontology/**' + # Other areas cli: - changed-files: diff --git a/.github/workflows/community-pr-helper.yml b/.github/workflows/community-pr-helper.yml index ffcff322..ad08e080 100644 --- a/.github/workflows/community-pr-helper.yml +++ b/.github/workflows/community-pr-helper.yml @@ -32,15 +32,13 @@ jobs: - uses: actions/github-script@v7 with: script: | - // Only greet first-time contributors - const { data: prs } = await github.rest.pulls.list({ - owner: context.repo.owner, - repo: context.repo.repo, - state: 'all', - creator: context.payload.pull_request.user.login + // Only greet first-time contributors — search for prior PRs by this author + const author = context.payload.pull_request.user.login; + const { data: result } = await github.rest.search.issuesAndPullRequests({ + q: `is:pr repo:${context.repo.owner}/${context.repo.repo} author:${author}` }); - if (prs.length > 1) { + if (result.total_count > 1) { console.log('Not a first-time contributor, skipping welcome.'); return; } @@ -58,9 +56,9 @@ jobs: '- ASF license headers are present on new source files', '- Tests cover new functionality', '', - '**Before your contribution can be merged**, you need an [Individual Contributor License Agreement (ICLA)](https://www.apache.org/licenses/contributor-agreements.html) on file with the ASF.', + 'No ICLA is required to contribute. If you are elected as a committer in the future, you will need an [Individual Contributor License Agreement (ICLA)](https://www.apache.org/licenses/contributor-agreements.html) on file with the ASF.', '', - '**Questions?** Ask in the PR comments or on our [Slack](https://join.slack.com/t/ossaboratories/shared_invite/zt-38v10kmo4-TZXFfGCPwPEM4SPhKrAHUw).', + '**Questions?** Ask in the PR comments or join us on [Slack](https://join.slack.com/t/apache-ossie/shared_invite/zt-42zw4rflt-Gpve8_NFJq7AsdAQTY~SCg).', '', 'We appreciate your contribution!' ].join('\n') diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml index 17ba8541..4bf68c68 100644 --- a/.github/workflows/pr-title-check.yml +++ b/.github/workflows/pr-title-check.yml @@ -33,19 +33,19 @@ jobs: steps: - name: Check PR title format run: | - # Enforce "Area: Description" format - # Examples: "Converter/dbt: Add metric support", "CLI: Fix plugin listing", "Spec: Update entity schema" - PATTERN='^(Revert ")?[A-Za-z][A-Za-z0-9._+/&,-]*( [A-Za-z0-9][A-Za-z0-9._+/&,-]*)*: .+' + # Enforce "Area: Description" or "type(scope): description" format + # Examples: "Converter/dbt: Add metric support", "fix(dbt): correct round-trip", "CLI: Fix plugin listing" + PATTERN='^(Revert ")?[A-Za-z][A-Za-z0-9._+/&,()-]*( [A-Za-z0-9][A-Za-z0-9._+/&,()-]*)*: .+' if ! echo "$PR_TITLE" | grep -Eq "$PATTERN"; then - echo "::error::PR title must follow 'Area: Description' format." + echo "::error::PR title must follow 'Area: Description' or 'type(scope): description' format." echo "" echo "Examples:" echo " Converter/dbt: Add metric support" + echo " fix(dbt): correct round-trip for PERCENTILE" + echo " docs(core-spec): clarify operator precedence" echo " CLI: Fix plugin listing" - echo " Spec: Update entity schema" echo " Infra: Add community workflows" - echo " Docs: Update contributing guide" echo "" - echo "Valid area prefixes include: Converter/, CLI, Spec, Ontology, Docs, Infra, Validation, Examples" + echo "Valid patterns: Area:, Area/sub:, type(scope):" exit 1 fi diff --git a/converters/sigma/LIMITATIONS.md b/converters/sigma/LIMITATIONS.md index 3270be40..b8558085 100644 --- a/converters/sigma/LIMITATIONS.md +++ b/converters/sigma/LIMITATIONS.md @@ -1,3 +1,22 @@ + + # Limitations and design tradeoffs What `converters/sigma` does not map onto a portable Ossie concept, and why. Every diff --git a/converters/sigma/README.md b/converters/sigma/README.md index d4fb117c..26d81cfc 100644 --- a/converters/sigma/README.md +++ b/converters/sigma/README.md @@ -1,3 +1,22 @@ + + # apache-ossie-sigma Converts between [Sigma Computing](https://www.sigmacomputing.com/) Data Models (the diff --git a/dev/.rat-excludes b/dev/.rat-excludes index c0fb61fa..49b26fb7 100644 --- a/dev/.rat-excludes +++ b/dev/.rat-excludes @@ -34,6 +34,11 @@ **/*.json **/*.csv +# Microsoft BI fixture formats (TOM/BIM/TMDL treat leading lines as object descriptions) +**/*.bim +**/*.ipynb +converters/microsoft/tests/fixtures/sales_model.tmdl + # Snapshot/fixture test files **/snapshots/** **/__snapshots__/** diff --git a/dev/check-license b/dev/check-license index 0b63b872..9c30d4d0 100755 --- a/dev/check-license +++ b/dev/check-license @@ -23,7 +23,7 @@ set -euo pipefail SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)" -RAT_VERSION="0.16.1" +RAT_VERSION="0.17" RAT_JAR="$SCRIPT_DIR/lib/apache-rat-${RAT_VERSION}.jar" RAT_URL="https://repo1.maven.org/maven2/org/apache/rat/apache-rat/${RAT_VERSION}/apache-rat-${RAT_VERSION}.jar" From 559748e20f220ad9d45eefd957a2b90b64ec07ad Mon Sep 17 00:00:00 2001 From: Sahil Walia Date: Fri, 25 Sep 2026 13:16:32 -0400 Subject: [PATCH 4/6] Addressing review feedback from JB - stale.yml: disabled auto-close for issues and PRs (days-before-*-close: -1) - auto-label-issues.yml: bootstrap needs-triage label before applying - auto-label-prs.yml: added issues:write, bootstrap labels from labeler.yml - dependency-review.yml: added missing ASF Category X SPDX identifiers - dependency-review.yml: documented fork PR comment limitation --- .github/workflows/auto-label-issues.yml | 22 +++++++++++++++++++- .github/workflows/auto-label-prs.yml | 27 +++++++++++++++++++++++++ .github/workflows/dependency-review.yml | 4 +++- .github/workflows/stale.yml | 22 ++++---------------- 4 files changed, 55 insertions(+), 20 deletions(-) diff --git a/.github/workflows/auto-label-issues.yml b/.github/workflows/auto-label-issues.yml index 027f7064..be2ff404 100644 --- a/.github/workflows/auto-label-issues.yml +++ b/.github/workflows/auto-label-issues.yml @@ -32,9 +32,29 @@ jobs: - uses: actions/github-script@v7 with: script: | + const label = 'needs-triage'; + try { + await github.rest.issues.getLabel({ + owner: context.repo.owner, + repo: context.repo.repo, + name: label + }); + } catch (e) { + if (e.status === 404) { + await github.rest.issues.createLabel({ + owner: context.repo.owner, + repo: context.repo.repo, + name: label, + color: 'e11d48', + description: 'Issue needs triage by a maintainer' + }); + } else { + throw e; + } + } await github.rest.issues.addLabels({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, - labels: ['needs-triage'] + labels: [label] }); diff --git a/.github/workflows/auto-label-prs.yml b/.github/workflows/auto-label-prs.yml index fc46257a..7249231b 100644 --- a/.github/workflows/auto-label-prs.yml +++ b/.github/workflows/auto-label-prs.yml @@ -24,12 +24,39 @@ on: permissions: contents: read pull-requests: write + issues: write jobs: label-by-files: if: github.repository_owner == 'apache' runs-on: ubuntu-latest steps: + - uses: actions/checkout@v4 + - uses: actions/github-script@v7 + with: + script: | + const fs = require('fs'); + const yaml = require('js-yaml'); + const content = fs.readFileSync('.github/labeler.yml', 'utf8'); + const labels = Object.keys(yaml.load(content)); + for (const name of labels) { + try { + await github.rest.issues.getLabel({ + owner: context.repo.owner, + repo: context.repo.repo, + name + }); + } catch (e) { + if (e.status === 404) { + await github.rest.issues.createLabel({ + owner: context.repo.owner, + repo: context.repo.repo, + name, + color: '0e8a16' + }); + } + } + } - uses: actions/labeler@v5 with: repo-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 47b54cbd..c9e96095 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -17,6 +17,8 @@ name: Dependency Review +# Note: For fork-originated PRs, the GITHUB_TOKEN is read-only. +# The dependency scan still runs but the PR summary comment will be skipped. on: [pull_request] permissions: @@ -31,5 +33,5 @@ jobs: - uses: actions/checkout@v4 - uses: actions/dependency-review-action@v4 with: - deny-licenses: GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later, SSPL-1.0, EUPL-1.1, EUPL-1.2 + deny-licenses: GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, AGPL-1.0-only, AGPL-1.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later, SSPL-1.0, EUPL-1.1, EUPL-1.2 comment-summary-in-pr: always diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 59b2e827..446a618e 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -36,41 +36,27 @@ jobs: repo-token: ${{ secrets.GITHUB_TOKEN }} days-before-issue-stale: 90 - days-before-issue-close: 14 + days-before-issue-close: -1 stale-issue-label: 'stale' only-issue-labels: 'awaiting-response' stale-issue-message: > This issue has been automatically marked as stale because it has been - waiting for a response for 90 days. It will be closed in 14 days if - no further activity occurs. + waiting for a response for 90 days. If this is still relevant, please provide the requested information or comment to keep it open. You can also reach out on the dev@ossie.apache.org mailing list. - close-issue-message: > - This issue has been automatically closed due to inactivity. - - If this is still relevant, please feel free to: - - Reopen this issue with the requested information - - Create a new issue with complete details - - Discuss on the dev@ossie.apache.org mailing list days-before-pr-stale: 60 - days-before-pr-close: 14 + days-before-pr-close: -1 stale-pr-label: 'stale' only-pr-labels: 'awaiting-response' stale-pr-message: > This pull request has been marked as stale because the requested - changes or feedback have not been addressed for 60 days. It will be - closed in 14 days if no activity occurs. + changes or feedback have not been addressed for 60 days. To keep this PR active, please address the review comments or respond to questions from reviewers. - close-pr-message: > - This pull request has been automatically closed due to inactivity. - - If you would like to continue this work, please reopen the PR and - address the outstanding feedback. We appreciate your contribution! exempt-issue-labels: 'priority:critical,security,good-first-issue,in-progress,needs-review,needs-triage' exempt-pr-labels: 'priority:critical,security,in-progress,needs-review' From 9ef3f7805f4d35592adc31e5bafa0d383ddf8786 Mon Sep 17 00:00:00 2001 From: Sahil Walia Date: Sat, 26 Sep 2026 07:13:10 -0400 Subject: [PATCH 5/6] - auto-label-prs.yml: replaced js-yaml require with plain text parsing - remove-awaiting-response.yml: addLabels call with .catch for fork PRs --- .github/workflows/auto-label-prs.yml | 5 +++-- .github/workflows/remove-awaiting-response.yml | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/auto-label-prs.yml b/.github/workflows/auto-label-prs.yml index 7249231b..d80918b4 100644 --- a/.github/workflows/auto-label-prs.yml +++ b/.github/workflows/auto-label-prs.yml @@ -36,9 +36,10 @@ jobs: with: script: | const fs = require('fs'); - const yaml = require('js-yaml'); const content = fs.readFileSync('.github/labeler.yml', 'utf8'); - const labels = Object.keys(yaml.load(content)); + const labels = content.split('\n') + .filter(line => /^\S.*:/.test(line) && !line.startsWith('#')) + .map(line => line.split(':')[0].trim()); for (const name of labels) { try { await github.rest.issues.getLabel({ diff --git a/.github/workflows/remove-awaiting-response.yml b/.github/workflows/remove-awaiting-response.yml index 3b23a7c0..30e663ff 100644 --- a/.github/workflows/remove-awaiting-response.yml +++ b/.github/workflows/remove-awaiting-response.yml @@ -63,6 +63,6 @@ jobs: repo: context.repo.repo, issue_number: issue.number, labels: ['needs-review'] - }); + }).catch(() => {}); } } From 1fe95c1f0f9a38da1c54dae02275a98d6b70c585 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?JB=20Onofr=C3=A9?= Date: Sun, 27 Sep 2026 07:12:56 +0200 Subject: [PATCH 6/6] fix(cube): add missing ASF license header to databricks_ossie fixture --- .../cube/tests/fixtures/databricks_ossie.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/converters/cube/tests/fixtures/databricks_ossie.yaml b/converters/cube/tests/fixtures/databricks_ossie.yaml index bc571635..0e8c607b 100644 --- a/converters/cube/tests/fixtures/databricks_ossie.yaml +++ b/converters/cube/tests/fixtures/databricks_ossie.yaml @@ -1,4 +1,19 @@ # Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. # An Ossie model as the Databricks converter emits one, which differs from a # Cube-authored document in two ways that matter here: #