Exclude compiled frontend from UI source tarball

The UI sdist was including hamilton_ui/build/** (compiled JS/CSS from
npm build), which would require bundling third-party licenses.

Fix: build sdist first (without frontend), then npm build, then wheel.
- pyproject.toml: move hamilton_ui/build/** from include to exclude
- apache_release_helper.py: split UI build into 3 steps:
  1. flit build --format sdist (source-only)
  2. npm install + npm run build → copy to hamilton_ui/build/
  3. flit build --format wheel (includes frontend assets)
- test_build.py: update assertion to verify build/ is excluded from sdist

Author: skrawcz

scripts/apache_release_helper.py

@@ -338,8 +338,23 @@ def create_release_artifacts(package_config: dict, version, no_sign: bool = Fals
         if os.path.exists("dist"):
             shutil.rmtree("dist")
 
-        # For the UI package, build the frontend before packaging.
+        # For the UI package, build sdist first (without frontend assets),
+        # then build frontend, then build wheel (with frontend assets).
+        # This keeps compiled JS/CSS out of the source tarball (avoiding
+        # third-party license obligations) while including them in the wheel.
         if package_name == "apache-hamilton-ui":
+            # Step 1: Build sdist without frontend assets
+            try:
+                subprocess.run(
+                    ["flit", "build", "--no-use-vcs", "--format", "sdist"],
+                    check=True,
+                )
+                print("Source distribution created successfully (without frontend).")
+            except subprocess.CalledProcessError as e:
+                print(f"Error creating source distribution: {e}")
+                return None
+
+            # Step 2: Build frontend and copy to hamilton_ui/build/
             print("Building UI frontend (npm install + npm run build)...")
             frontend_dir = os.path.join(original_dir, "ui", "frontend")
             build_target = os.path.join("hamilton_ui", "build")
@@ -366,20 +381,27 @@ def create_release_artifacts(package_config: dict, version, no_sign: bool = Fals
                 print("Ensure Node.js and npm are installed.")
                 return None
 
-        # Use flit build to create the source distribution.
-        try:
-            subprocess.run(
-                [
-                    "flit",
-                    "build",
-                    "--no-use-vcs",
-                ],
-                check=True,
-            )
-            print("Source distribution created successfully.")
-        except subprocess.CalledProcessError as e:
-            print(f"Error creating source distribution: {e}")
-            return None
+            # Step 3: Build wheel (includes frontend assets via package data)
+            try:
+                subprocess.run(
+                    ["flit", "build", "--no-use-vcs", "--format", "wheel"],
+                    check=True,
+                )
+                print("Wheel created successfully (with frontend assets).")
+            except subprocess.CalledProcessError as e:
+                print(f"Error creating wheel: {e}")
+                return None
+        else:
+            # Non-UI packages: build both sdist and wheel in one step
+            try:
+                subprocess.run(
+                    ["flit", "build", "--no-use-vcs"],
+                    check=True,
+                )
+                print("Source distribution created successfully.")
+            except subprocess.CalledProcessError as e:
+                print(f"Error creating source distribution: {e}")
+                return None
 
         # Find the created tarball in the dist directory.
         # Convert package name with underscores for file naming

scripts/verify-sub-packages/verify_ui.sh

@@ -125,6 +125,16 @@ mkdir -p "$build_dir"
 tar xzf "$ARTIFACTS_DIR/$SRC_TAR" -C "$build_dir"
 src_dir=$(ls -d ${build_dir}/*/ | head -1)
 
+# Verify source tarball does NOT contain compiled frontend assets.
+# JS/CSS bundles would require third-party license auditing.
+if find "$src_dir" -path "*/build/assets/*.js" | grep -q .; then
+    echo "  ✗ Source tarball contains compiled frontend JS — must be excluded"
+    rm -rf "$build_dir"
+    exit 1
+else
+    echo "  ✓ Source tarball does not contain compiled frontend assets"
+fi
+
 # Note: The UI source tarball does not include compiled frontend assets.
 # The release script builds the frontend (npm run build) before flit build.
 # Here we verify the backend builds correctly; the wheel from SVN includes

ui/backend/pyproject.toml

@@ -75,10 +75,10 @@ include = [
     "LICENSE",
     "NOTICE",
     "DISCLAIMER",
-    "hamilton_ui/build/**",
     "tests/**",
 ]
 exclude = [
+    "hamilton_ui/build/**",
     "hamilton_ui/tests/**",
     ".git/**",
     "**/__pycache__/**",

ui/backend/tests/test_build.py

@@ -193,8 +193,13 @@ def test_pyproject_toml_exists(self):
         pyproject_file = get_ui_backend_dir() / "pyproject.toml"
         assert pyproject_file.exists(), f"pyproject.toml not found at {pyproject_file}"
 
-    def test_flit_sdist_includes_build_directory(self):
-        """Verify that pyproject.toml includes hamilton_ui/build/** in Flit sdist."""
+    def test_flit_sdist_excludes_build_directory(self):
+        """Verify that pyproject.toml excludes hamilton_ui/build/** from Flit sdist.
+
+        Compiled frontend assets (JS/CSS) must not be in the source tarball
+        to avoid third-party license obligations. The wheel includes them
+        via package data; the release script builds sdist before npm build.
+        """
         pyproject_file = get_ui_backend_dir() / "pyproject.toml"
 
         with open(pyproject_file, "rb") as f:
@@ -205,11 +210,11 @@ def test_flit_sdist_includes_build_directory(self):
         assert "flit" in config["tool"], "pyproject.toml missing [tool.flit] section"
         assert "sdist" in config["tool"]["flit"], "pyproject.toml missing [tool.flit.sdist] section"
 
-        # Check includes
-        includes = config["tool"]["flit"]["sdist"].get("include", [])
-        assert "hamilton_ui/build/**" in includes, (
-            "pyproject.toml [tool.flit.sdist] does not include 'hamilton_ui/build/**'. "
-            "Built assets will not be packaged in the distribution."
+        # Check excludes
+        excludes = config["tool"]["flit"]["sdist"].get("exclude", [])
+        assert "hamilton_ui/build/**" in excludes, (
+            "pyproject.toml [tool.flit.sdist] must exclude 'hamilton_ui/build/**'. "
+            "Compiled frontend assets should not be in the source tarball."
         )
 
     def test_flit_sdist_includes_tests(self):