build(bindings): package complete legal metadata

.gitattributes

@@ -1,2 +1,10 @@
-# Auto-generated dependency files — collapse in GitHub diffs
-*.tsv linguist-generated=true
+# Generated TSVs keep trailing empty columns.
+*.tsv text eol=lf linguist-generated=true whitespace=-blank-at-eol
+
+# Legal files are verified byte-for-byte.
+LICENSE text eol=lf
+NOTICE text eol=lf
+**/LICENSE text eol=lf
+**/NOTICE text eol=lf
+**/THIRD-PARTY-LICENSES*.html text eol=lf linguist-generated=true
+third-party-licenses/* text eol=lf

.github/workflows/ci.yml

@@ -47,18 +47,54 @@ jobs:
         uses: apache/skywalking-eyes/header@v0.8.0
 
       - name: Install cargo-deny
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9 # v2.84.0
         with:
-          tool: cargo-deny@0.19.0
+          tool: cargo-deny@0.19.6
 
-      - name: Check dependency licenses (Apache-compatible)
-        run: cargo deny check licenses
+      - name: Install cargo-about
+        uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9 # v2.84.0
+        with:
+          tool: cargo-about@0.9.1
+
+      - name: Fetch locked dependencies
+        run: cargo fetch --locked
+
+      - name: Check dependency policy
+        run: cargo deny --locked --all-features check --warn unmaintained advisories licenses
+
+      - name: Verify dependency reports
+        run: python3 scripts/dependencies.py verify
+
+      - name: Verify release license files
+        run: python3 scripts/release_licenses.py --check
 
       - name: Format
         run: cargo fmt --all -- --check
 
       - name: Clippy
-        run: cargo clippy --all-targets --workspace --features fulltext,vortex -- -D warnings
+        run: cargo clippy --locked --all-targets --workspace --features fulltext,vortex -- -D warnings
+
+  msrv:
+    runs-on: ubuntu-latest
+    env:
+      PYO3_PYTHON: python3.11
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install Rust 1.91.0
+        run: rustup toolchain install 1.91.0 --profile minimal
+
+      - name: Validate workspace MSRV metadata
+        run: |
+          cargo +1.91.0 metadata --locked --format-version 1 --no-deps |
+            jq -e '.packages | all(.rust_version == "1.91.0")' >/dev/null
+
+      - name: Check workspace at MSRV
+        run: cargo +1.91.0 check --locked --workspace --all-targets --all-features
 
   build:
     runs-on: ${{ matrix.os }}
@@ -71,7 +107,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Build
-        run: cargo build --features fulltext,vortex
+        run: cargo build --locked --features fulltext,vortex
 
   unit:
     runs-on: ${{ matrix.os }}
@@ -85,7 +121,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Test
-        run: cargo test -p paimon --all-targets --features fulltext,vortex
+        run: cargo test --locked -p paimon --all-targets --features fulltext,vortex
         env:
           RUST_LOG: DEBUG
           RUST_BACKTRACE: full
@@ -95,7 +131,7 @@ jobs:
       # catalog tests are likewise gated with `#[cfg(not(windows))]`).
       - name: Test paimon-rest-server
         if: runner.os != 'Windows'
-        run: cargo test -p paimon-rest-server --all-targets
+        run: cargo test --locked -p paimon-rest-server --all-targets
         env:
           RUST_LOG: DEBUG
           RUST_BACKTRACE: full
@@ -150,7 +186,7 @@ jobs:
 
       - name: Rust Integration Test
         if: matrix.suite == 'rust'
-        run: cargo test -p paimon-integration-tests --all-targets
+        run: cargo test --locked -p paimon-integration-tests --all-targets
 
       - name: Install lumina native library
         if: matrix.needs_lumina == true
@@ -161,26 +197,26 @@ jobs:
       - name: Core Lumina Native Build Test
         if: matrix.suite == 'lumina'
         run: >
-          cargo test -p paimon
+          cargo test --locked -p paimon
           table::lumina_index_build_builder::tests::test_execute_writes_lumina_index_manifest
           --features fulltext,vortex
           -- --ignored --exact
 
       - name: DataFusion Lumina Build Query E2E Test
         if: matrix.suite == 'lumina'
         run: >
-          cargo test -p paimon-datafusion
+          cargo test --locked -p paimon-datafusion
           --features vortex
           vector_search_tests::test_lumina_build_then_vector_search_query
           -- --ignored --exact
 
       - name: DataFusion Integration Test
         if: matrix.suite == 'datafusion'
-        run: cargo test -p paimon-datafusion --all-targets
+        run: cargo test --locked -p paimon-datafusion --all-targets
 
       - name: DataFusion Vortex Integration Test
         if: matrix.suite == 'datafusion'
-        run: cargo test -p paimon-datafusion --features vortex --test vortex_tables
+        run: cargo test --locked -p paimon-datafusion --features vortex --test vortex_tables
 
       - name: Install uv
         if: matrix.needs_uv == true

.github/workflows/release-go-binding.yml

@@ -103,12 +103,20 @@ jobs:
         include:
           - runner: ubuntu-latest
             expected_file: libpaimon_c.linux.amd64.so.zst
+            rust_target: x86_64-unknown-linux-gnu
+            license_file: THIRD-PARTY-LICENSES.linux.amd64.html
           - runner: ubuntu-24.04-arm
             expected_file: libpaimon_c.linux.arm64.so.zst
+            rust_target: aarch64-unknown-linux-gnu
+            license_file: THIRD-PARTY-LICENSES.linux.arm64.html
           - runner: macos-15-intel
             expected_file: libpaimon_c.darwin.amd64.dylib.zst
+            rust_target: x86_64-apple-darwin
+            license_file: THIRD-PARTY-LICENSES.darwin.amd64.html
           - runner: macos-14
             expected_file: libpaimon_c.darwin.arm64.dylib.zst
+            rust_target: aarch64-apple-darwin
+            license_file: THIRD-PARTY-LICENSES.darwin.arm64.html
 
     steps:
       - uses: actions/checkout@v7
@@ -143,17 +151,23 @@ jobs:
         working-directory: bindings/go
         run: make build
 
-      - name: Verify packaged library
-        working-directory: bindings/go
+      - name: Stage and verify packaged library
         shell: bash
         run: |
-          test -s '${{ matrix.expected_file }}'
+          mkdir -p release/go
+          cp 'bindings/go/${{ matrix.expected_file }}' release/go/
+          cp 'bindings/go/${{ matrix.license_file }}' release/go/
+          python3 scripts/verify_go_release_artifacts.py \
+            --artifacts-dir release/go \
+            --target '${{ matrix.rust_target }}'
 
       - name: Upload packaged library
         uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.expected_file }}
-          path: bindings/go/${{ matrix.expected_file }}
+          path: |
+            release/go/${{ matrix.expected_file }}
+            release/go/${{ matrix.license_file }}
           if-no-files-found: error
 
   publish:
@@ -167,24 +181,30 @@ jobs:
           fetch-depth: 0
           ref: ${{ needs.validate.outputs.source_sha }}
 
+      - name: Install cargo-about
+        uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9 # v2.84.0
+        with:
+          tool: cargo-about@0.9.1
+
+      - name: Verify generated release licenses
+        run: |
+          cargo fetch --locked
+          python3 scripts/release_licenses.py --check
+
+      - name: Install artifact verification tools
+        run: sudo apt-get update && sudo apt-get install -y file zstd
+
       - name: Download packaged libraries
         uses: actions/download-artifact@v8
         with:
-          path: bindings/go
+          path: release/go
           merge-multiple: true
 
       - name: Verify embedded assets
-        working-directory: bindings/go
         shell: bash
         run: |
-          for file in \
-            libpaimon_c.linux.amd64.so.zst \
-            libpaimon_c.linux.arm64.so.zst \
-            libpaimon_c.darwin.amd64.dylib.zst \
-            libpaimon_c.darwin.arm64.dylib.zst
-          do
-            test -s "$file"
-          done
+          cp bindings/go/LICENSE bindings/go/NOTICE release/go/
+          python3 scripts/verify_go_release_artifacts.py --artifacts-dir release/go
 
       - name: Create release tag commit
         env:
@@ -197,7 +217,12 @@ jobs:
           git config user.name 'github-actions[bot]'
           git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
 
-          git add bindings/go/libpaimon_c.*.zst
+          cp release/go/libpaimon_c.*.zst bindings/go/
+          git add \
+            bindings/go/libpaimon_c.*.zst \
+            bindings/go/LICENSE \
+            bindings/go/NOTICE \
+            bindings/go/THIRD-PARTY-LICENSES.*.html
 
           if ! git diff --cached --quiet; then
             git commit -m "bindings/go: release ${VERSION} (from ${SOURCE_REF}@${SOURCE_SHA})"
@@ -211,12 +236,18 @@ jobs:
           TAG: ${{ needs.validate.outputs.tag }}
           VERSION: ${{ needs.validate.outputs.version }}
           GH_TOKEN: ${{ github.token }}
-        working-directory: bindings/go
+        working-directory: release/go
         run: |
           gh release create "$TAG" \
             --title "Release Go binding $VERSION" \
             --generate-notes \
+            LICENSE \
+            NOTICE \
             libpaimon_c.linux.amd64.so.zst \
             libpaimon_c.linux.arm64.so.zst \
             libpaimon_c.darwin.amd64.dylib.zst \
-            libpaimon_c.darwin.arm64.dylib.zst
+            libpaimon_c.darwin.arm64.dylib.zst \
+            THIRD-PARTY-LICENSES.linux.amd64.html \
+            THIRD-PARTY-LICENSES.linux.arm64.html \
+            THIRD-PARTY-LICENSES.darwin.amd64.html \
+            THIRD-PARTY-LICENSES.darwin.arm64.html