apache / apache/texera

Edits to amber's LICENSE-binary and NOTICE-binary files skip the CI checks that validate them

Open
#8,294 2 comments 0 reactions 1 assignee Claimed by @anthonychengit View on GitHub
Dominant language
Scala
Stars
314
Forks
187
Avg merge
1d 21h
Merged PRs (30d)
214

Description

### What happened?

`.github/labeler.yml` has no glob that matches amber's binary-license
manifests, so a PR that edits one gets **no stack label**, `precheck` selects
no stacks, and the `build` job is skipped -- including the very check that
validates the file that changed.

The aggregate `Required Checks` gate treats `build: skipped` as passing, so such
a PR goes **green without running anything**:

```
edit amber/LICENSE-binary-python -> no stack label -> build: skipped -> Required Checks: success
```

Every other module is covered because its label uses a directory-wide glob
(`frontend/**`, `agent-service/**`, `access-control-service/**`, ...), so
e.g. `frontend/LICENSE-binary` is picked up by `frontend`. `amber/` is the
exception: it has no `amber/**`, and the `engine` / `pyamber` labels enumerate
specific paths instead.

Tracked files under `amber/` that currently match **no** labeler glob:

| File | Validated by | Stack that should fire |
| --- | --- | --- |
| `amber/LICENSE-binary-python` | `check_binary_deps.py python` (pyamber 3.12) | `pyamber` |
| `amber/LICENSE-binary-java` | `check_binary_deps.py jar` (amber) | `engine` |
| `amber/NOTICE-binary` | `generate_notice_binary.py` regen+diff (amber) | `engine` |
| `amber/NOTICE-binary-python` | same, via `--extras` (amber) | `engine` |
| `amber/DESCRIPTION` | -- | (unclear -- separate question) |
| `amber/src/bench/scala/**` | Benchmarks workflow | (unclear -- separate question) |

This is the same hole the `pyamber` label's own comment already warns about one
file over:

> Without this a bumped requirements.txt would only get `dependencies` (no stack
> mapping) and silently skip CI for the very deps it's changing.

It bites in practice: #8293 fixes a repo-wide `pyamber` 3.12 license failure by
adding one bullet to `amber/LICENSE-binary-python`, and its `build` job was
skipped -- the `pyamber` label had to be applied by hand for the fix to be
tested at all. The nightly exact-match refresh of those same pins would land the
same way.

```
Before: edit amber/LICENSE-binary-python -> build skipped -> green, untested
After: edit amber/LICENSE-binary-python -> pyamber stack runs -> license check actually gates it
```

Suggested fix: add the four manifests to the globs of the label whose stack owns
their check -- `amber/LICENSE-binary-python` under `pyamber`, and
`amber/LICENSE-binary-java` / `amber/NOTICE-binary*` under `engine`. Whether
`amber/DESCRIPTION` and `amber/src/bench/scala/**` want a mapping is a separate
call.

### How to reproduce?

1. Open a PR whose only change is a line in `amber/LICENSE-binary-python`
(e.g. #8293 before the `pyamber` label was added by hand).
2. `gh pr view --repo apache/texera --json labels` -- no stack label, only
the Conventional-Commit label from the title.
3. `gh pr checks --repo apache/texera` -- `build` reports `skipping`.
4. The `Required Checks` gate still reports success, because its
`results` loop accepts `skipped` alongside `success`.

### Version/Branch

1.3.0-incubating-SNAPSHOT (main)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.