xiongyuanwen-byted e57381ae5c ci(license): narrow Apache Arrow workaround with a follow-up assertion ...

The dependency-license check still has to --ignore Apache Arrow wholesale
because go-licenses' classifier parses its LICENSE.txt as a single license
and mis-reports the module as LicenseRef-C-Ares / Unknown (Arrow inlines
the c-ares 3rdparty notice alongside its own Apache-2.0). Re-classifying
on our side isn't possible without changing go-licenses itself.

The CR concern was that --ignore is too wide — a future Arrow re-license
or new inlined dep would silently sail through. Add a follow-up step that
re-checks Arrow's LICENSE.txt independently: it must still open with
"Apache License" AND must still inline the c-ares 3rdparty notice (the
two facts that make the --ignore safe today). If either invariant breaks,
CI fails here and forces a human to re-evaluate the ignore.

Verified locally — both assertions pass against the current pinned
Arrow v17.

2026-06-24 16:02:54 +08:00

..

workflows

ci(license): narrow Apache Arrow workaround with a follow-up assertion

2026-06-24 16:02:54 +08:00

CODEOWNERS

chore: add CODEOWNERS for internal/ and new skills domains (#1420)

2026-06-12 11:19:25 +08:00

pull_request_template.md

docs: clarify contributor guidance (#1096)

2026-05-26 15:51:00 +08:00