chore(repo): drop DEPENDENCIES.md per ASF policy (#3222)

Author: hubcio

.dockerignore

@@ -11,7 +11,16 @@
 /licenses
 /local_data
 /performance_results
-/scripts
+# Selectively exclude scripts/ subdirs not needed in container builds.
+# scripts/ci/third-party-licenses.sh + render-node-licenses.mjs are
+# required by the convenience-binary Dockerfiles to render LICENSE-binary
+# at build time.
+/scripts/dashboard
+/scripts/performance
+/scripts/*.sh
+/scripts/ci/*
+!/scripts/ci/third-party-licenses.sh
+!/scripts/ci/render-node-licenses.mjs
 **/target
 /target
 !/target/debug/iggy

.github/actions/utils/docker-buildx/action.yml

@@ -331,12 +331,7 @@ runs:
       id: ctx
       shell: bash
       run: |
-        # For web-ui, the context should be the web directory
-        if [ "${{ inputs.component }}" = "web-ui" ]; then
-          context="web"
-        else
-          context="${{ inputs.context }}"
-        fi
+        context="${{ inputs.context }}"
         echo "context=$context" >> "$GITHUB_OUTPUT"
         echo "📁 Build context: $context"
 

.github/actions/utils/validate-third-party-licenses/action.yml

@@ -0,0 +1,79 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Run the per-artifact third-party license validation matrix that ASF
+# release policy requires for convenience binaries (Docker images, PyPI
+# wheels). Single source of truth shared by the pre-merge gate
+# (.github/workflows/_common.yml) and the release gate
+# (.github/workflows/publish.yml). Adding a new convenience artifact
+# means adding ONE step here, never two.
+
+name: validate-third-party-licenses
+description: Validate every published artifact's bundled third-party licenses against the ASF accept list.
+inputs:
+  node-version:
+    description: "Node.js version used by the npm path"
+    required: false
+    default: "23"
+
+runs:
+  using: composite
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: ${{ inputs.node-version }}
+
+    - name: Setup Rust with cache
+      uses: ./.github/actions/utils/setup-rust-with-cache
+      with:
+        read-cache: "false"
+
+    - name: Install cargo-about
+      shell: bash
+      run: |
+        TARGET="$(uname -m)-unknown-linux-musl"
+        curl -sSfL "https://github.com/EmbarkStudios/cargo-about/releases/download/0.9.0/cargo-about-0.9.0-${TARGET}.tar.gz" \
+          | tar -xz -C "$HOME/.cargo/bin" --strip-components=1 \
+              "cargo-about-0.9.0-${TARGET}/cargo-about"
+
+    - name: Validate apache/iggy bundle (server + CLI + embedded web)
+      shell: bash
+      run: ./scripts/ci/third-party-licenses.sh --validate
+           --manifest core/server/Cargo.toml
+           --manifest core/cli/Cargo.toml
+           --manifest web
+
+    - name: Validate iggy-mcp bundle
+      shell: bash
+      run: ./scripts/ci/third-party-licenses.sh --validate --manifest core/ai/mcp/Cargo.toml
+
+    - name: Validate iggy-bench-dashboard bundle
+      shell: bash
+      run: ./scripts/ci/third-party-licenses.sh --validate --manifest core/bench/dashboard/server/Cargo.toml
+
+    - name: Validate iggy-connect bundle
+      shell: bash
+      run: ./scripts/ci/third-party-licenses.sh --validate --manifest core/connectors/runtime/Cargo.toml
+
+    - name: Validate Python wheel bundle
+      shell: bash
+      run: ./scripts/ci/third-party-licenses.sh --validate --manifest foreign/python/Cargo.toml
+
+    - name: Validate web UI bundle
+      shell: bash
+      run: ./scripts/ci/third-party-licenses.sh --validate --manifest web

.github/workflows/_build_python_wheels.yml

@@ -87,6 +87,13 @@ jobs:
       - name: Setup Rust with cache
         uses: ./.github/actions/utils/setup-rust-with-cache
 
+      - name: Generate third-party license manifest
+        run: |
+          TARGET="$(uname -m)-unknown-linux-musl"
+          curl -sSfL "https://github.com/EmbarkStudios/cargo-about/releases/download/0.9.0/cargo-about-0.9.0-${TARGET}.tar.gz" \
+            | tar -xz -C "$HOME/.cargo/bin" --strip-components=1 "cargo-about-0.9.0-${TARGET}/cargo-about"
+          ./scripts/ci/third-party-licenses.sh --generate --manifest foreign/python/Cargo.toml --output foreign/python/LICENSE-binary
+
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:
@@ -139,6 +146,24 @@ jobs:
         with:
           python-version: "3.11"
 
+      - name: Setup Rust with cache
+        uses: ./.github/actions/utils/setup-rust-with-cache
+
+      - name: Generate third-party license manifest
+        run: |
+          # Embark Studios releases an aarch64-apple-darwin tarball but
+          # NOT x86_64-apple-darwin (404 as of 0.9.0). Intel macOS
+          # falls back to compiling cargo-about from source.
+          ARCH="$(uname -m | sed 's/arm64/aarch64/')"
+          if [ "$ARCH" = "aarch64" ]; then
+            TARGET="aarch64-apple-darwin"
+            curl -sSfL "https://github.com/EmbarkStudios/cargo-about/releases/download/0.9.0/cargo-about-0.9.0-${TARGET}.tar.gz" \
+              | tar -xz -C "$HOME/.cargo/bin" --strip-components=1 "cargo-about-0.9.0-${TARGET}/cargo-about"
+          else
+            cargo install cargo-about --locked --version 0.9.0 --features cli
+          fi
+          ./scripts/ci/third-party-licenses.sh --generate --manifest foreign/python/Cargo.toml --output foreign/python/LICENSE-binary
+
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:

.github/workflows/_common.yml

@@ -154,21 +154,12 @@ jobs:
       - name: Check Apache license headers
         run: ./scripts/ci/license-headers.sh --check
 
-  license-list:
-    name: Check licenses list
+  third-party-licenses:
+    name: Validate third-party licenses
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-
-      - name: Setup Rust toolchain
-        uses: ./.github/actions/utils/setup-rust-with-cache
-        with:
-          read-cache: "false"
-
-      - name: Install cargo-license
-        run: cargo install cargo-license
-
-      - run: ./scripts/ci/licenses-list.sh --check
+      - uses: ./.github/actions/utils/validate-third-party-licenses
 
   markdown:
     name: Markdown lint
@@ -280,7 +271,7 @@ jobs:
         version-consistency,
         pr-title,
         license-headers,
-        license-list,
+        third-party-licenses,
         markdown,
         shellcheck,
         trailing-whitespace,
@@ -320,7 +311,7 @@ jobs:
           PYTHON_VERSIONS="${{ needs.python-versions.result }}"
           VERSION_CONSISTENCY="${{ needs.version-consistency.result }}"
           LICENSE_HEADERS="${{ needs.license-headers.result }}"
-          LICENSE_LIST="${{ needs.license-list.result }}"
+          THIRD_PARTY_LICENSES="${{ needs.third-party-licenses.result }}"
           MARKDOWN="${{ needs.markdown.result }}"
 
           if [ "$RUST_VERSIONS" = "success" ]; then
@@ -355,12 +346,12 @@ jobs:
             echo "| ⏭️ License Headers | $LICENSE_HEADERS | Check skipped |" >> $GITHUB_STEP_SUMMARY
           fi
 
-          if [ "$LICENSE_LIST" = "success" ]; then
-            echo "| ✅ License List | success | Dependencies licenses validated |" >> $GITHUB_STEP_SUMMARY
-          elif [ "$LICENSE_LIST" = "failure" ]; then
-            echo "| ❌ License List | failure | License list needs update |" >> $GITHUB_STEP_SUMMARY
+          if [ "$THIRD_PARTY_LICENSES" = "success" ]; then
+            echo "| ✅ Third-Party Licenses | success | All deps in about.toml accept list |" >> $GITHUB_STEP_SUMMARY
+          elif [ "$THIRD_PARTY_LICENSES" = "failure" ]; then
+            echo "| ❌ Third-Party Licenses | failure | Disallowed license detected (see job log) |" >> $GITHUB_STEP_SUMMARY
           else
-            echo "| ⏭️ License List | $LICENSE_LIST | Check skipped |" >> $GITHUB_STEP_SUMMARY
+            echo "| ⏭️ Third-Party Licenses | $THIRD_PARTY_LICENSES | Check skipped |" >> $GITHUB_STEP_SUMMARY
           fi
 
           if [ "$MARKDOWN" = "success" ]; then

.github/workflows/publish.yml

@@ -235,9 +235,25 @@ jobs:
           echo "Commit details:"
           git log -1 --pretty=format:"  Author: %an <%ae>%n  Date: %ad%n  Subject: %s" "$COMMIT"
 
+  validate-licenses:
+    name: Validate third-party licenses (release gate)
+    needs: validate
+    runs-on: ubuntu-latest
+    # Re-runs the same per-artifact validation that pre-merge enforces,
+    # against the resolved release commit. Tags can point at commits
+    # older than the pre-merge gate, or be created via direct push that
+    # bypassed PR review, so a release-time gate is required to keep the
+    # policy contract intact. Composite action is shared with
+    # .github/workflows/_common.yml.
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.validate.outputs.commit }}
+      - uses: ./.github/actions/utils/validate-third-party-licenses
+
   plan:
     name: Build publish plan
-    needs: validate
+    needs: [validate, validate-licenses]
     if: needs.validate.outputs.has_targets == 'true'
     runs-on: ubuntu-latest
     outputs:
@@ -1294,6 +1310,7 @@ jobs:
     needs:
       [
         validate,
+        validate-licenses,
         plan,
         check-tags,
         build-python-wheels,

.gitignore

@@ -40,3 +40,5 @@ foreign/node/.npm
 *.out
 go.work
 core/bench/dashboard/frontend/dist
+LICENSE-binary
+**/LICENSE-binary

.pre-commit-config.yaml

@@ -63,14 +63,6 @@ repos:
         language: system
         pass_filenames: false
 
-      - id: licenses-list
-        name: licenses list
-        entry: ./scripts/ci/licenses-list.sh
-        args: ["--fix"]
-        language: system
-        files: ^Cargo\.lock$
-        pass_filenames: false
-
       - id: rust-version-sync
         name: rust version sync
         entry: ./scripts/ci/sync-rust-version.sh