Repository navigation
ci: add post-merge SCANOSS license & BOM check - #1184
Merged
Merged
Conversation
|
MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅ |
Contributor
|
@anhappdev please take care of this. |
anhappdev
approved these changes
Oct 1, 2026
anhappdev
left a comment
anhappdev
left a comment
Collaborator
There was a problem hiding this comment.
LGTM. For setting the SCANOSS_API_KEY please contact @mlcommons/admin
anhappdev
requested changes
Oct 3, 2026
anhappdev
left a comment
anhappdev
left a comment
Collaborator
There was a problem hiding this comment.
@arav-agarwal2 Please pin any Github actions to commit SHA.
Contributor
|
@arav-agarwal2 ping |
A floating tag is a moving target: whoever controls the action's repo can repoint v4 at any commit, and this job runs on master with the SCANOSS API key in scope. Pin each action to a full commit SHA with the version in a trailing comment, the same form the rest of .github/workflows uses. checkout and upload-artifact reuse the SHAs already pinned elsewhere in this repo (v6.0.3 / v7.0.1) rather than introducing a second pinned version of the same action; setup-python goes to v7.0.0, whose only removed input, pip-install, this workflow never used. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
anhappdev
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hello folks! As part of AI-code policy changes at MLC, we're trying to roll out AI-generated code checks to catch if licensed code from bad licenses ends up in the codebase.
This PR adds a SCANOSS license & BOM check that runs after merge to
master(and on manual dispatch). It's informational only and never blocks..github/workflows/scanoss.yml: scans only the files changed in the pushed range (before..sha), not the whole tree, usingscanoss-pyagainstapi.osskb.org. It then:continue-on-error)SCANOSS_API_KEYis setscanoss-reports/as an artifact that's kept for 30 days.github/scanoss.json: scan settings that skip tests, vendored and third-party dirs,node_modules, and generated protobuf files, and declarepkg:github/mlcommons/mobile_app_openin the BOM.Review feedback
@anhappdev — "Please pin any GitHub actions to commit SHA." Done in 901cd7a. All three actions are now pinned to a full commit SHA with the version in a trailing comment, matching the form used throughout
.github/workflows:actions/checkout@v4@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3actions/setup-python@v5@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0actions/upload-artifact@v4@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1checkoutandupload-artifactreuse the exact SHAs this repo already pins elsewhere, so there's one pinned version of each action across the tree rather than two.setup-pythonisn't used anywhere else here, so it's pinned at the current release; the only input v7 removed ispip-install, which this workflow never set.One thing still unpinned, and I'd like a steer: the
pip install scanossstep floats to whatever is current on PyPI. Pinning it (scanoss==<version>) would close the same supply-chain gap the SHA pins close, at the cost of needing a bump to pick up checker improvements. Happy to pin it if you'd prefer that — say the word.@anhappdev — "For setting the
SCANOSS_API_KEYplease contact @mlcommons/admin." Thanks — will do once this merges. Without the key the workflow still runs; it just falls back to the shared osskb rate limit and skips the per-key quota table in the Summary.