Merge branch 'main' into hf/06b-audio-upload

Author: ELin2025

.github/welcome-first-time-contributor.txt

@@ -0,0 +1,11 @@
+👋 Thanks for your first contribution to Texera, @{{author}}!
+
+If you're looking for a good place to start, browse issues labeled [`starter-task`](https://github.com/{{owner}}/{{repo}}/issues?q=is%3Aissue+is%3Aopen+label%3Astarter-task); they're scoped to be approachable for newcomers.
+
+You can drive common housekeeping yourself by commenting one of these commands on its own line:
+
+- **Issues.** Comment `/take` to assign an open issue to yourself, or `/untake` to release it. You can find unclaimed work with the search filter `is:issue is:open no:assignee`.
+- **Sub-issues.** To link issues into a parent/child hierarchy, comment `/sub-issue #5166 #5222` on the parent to attach those children (or `/unsub-issue #5166 #5222` to detach them). From a child issue, comment `/parent-issue #5166` to set its parent, or `/unparent-issue` to clear it (the current parent is detected automatically). References may be written as `#5166` or as a bare `5166`; cross-repository references are not supported.
+- **Pull requests (author only).** Comment `/request-review @user` to request a review from someone, or `/unrequest-review @user` to withdraw that request.
+
+Each command must match exactly: `/take this` will not work, only `/take` does. For the full contribution flow, see [CONTRIBUTING.md](https://github.com/{{owner}}/{{repo}}/blob/main/CONTRIBUTING.md).

.github/workflows/build.yml

@@ -229,12 +229,17 @@ jobs:
           sbt scalafmtCheckAll \
               "scalafixAll --check" \
               WorkflowExecutionService/dist
-      - name: Unzip amber dist and check binary licenses
-        # Per-module LICENSE-binary files live at the repo root after #4668;
-        # the amber JVM dist is checked against amber/LICENSE-binary-java.
-        # The audit always runs (mirroring the previous 'if: always()' on its
-        # own step) and never fails the step; the binding check's exit code
-        # drives it.
+      - name: Unzip amber dist and check binary LICENSE + NOTICE
+        # Per-module LICENSE-binary files live at the repo root after #4668.
+        # One step covers the amber dist's third-party content end to end:
+        #   * LICENSE-binary-java  — check bundled jars against the claimed
+        #     licenses (audit always runs and never fails the step);
+        #   * NOTICE-binary        — regenerate from the same unzipped lib dir
+        #     via generate_notice_binary.py (plus amber/NOTICE-binary-python for
+        #     the non-jar python attributions) and diff against the committed
+        #     file. Drift means a dep changed without rerunning the generator —
+        #     fix by running:
+        #       ./bin/licensing/generate_notice_binary.py amber/NOTICE-binary /tmp/dists/amber-*/lib --extras amber/NOTICE-binary-python
         run: |
           set -euo pipefail
           mkdir -p /tmp/dists
@@ -245,6 +250,12 @@ jobs:
             --license-binary amber/LICENSE-binary-java \
             /tmp/dists/amber-*/lib || check_exit=$?
           ./bin/licensing/audit_jar_licenses.py /tmp/dists/amber-*/lib || true
+
+          ./bin/licensing/generate_notice_binary.py /tmp/notice-amber.txt /tmp/dists/amber-*/lib --extras amber/NOTICE-binary-python
+          if ! diff -u amber/NOTICE-binary /tmp/notice-amber.txt; then
+            echo "::error::amber/NOTICE-binary differs from generator output. Regenerate with bin/licensing/generate_notice_binary.py and commit."
+            check_exit=1
+          fi
           exit "$check_exit"
       - name: Create texera_db_for_test_cases
         run: psql -h localhost -U postgres -v DB_NAME=texera_db_for_test_cases -f sql/texera_ddl.sql
@@ -589,9 +600,16 @@ jobs:
         # Single sbt invocation so dist + test share compiled state. Use
         # `jacoco` so the codecov upload step has a report to pick up.
         run: sbt "${{ matrix.sbt_project }}/dist" "${{ matrix.sbt_project }}/jacoco"
-      - name: Unzip ${{ matrix.service }} dist and check binary licenses
-        # Each platform service has its own LICENSE-binary at the repo root
-        # after #4668; check this service's dist against just its own file.
+      - name: Unzip ${{ matrix.service }} dist and check binary LICENSE + NOTICE
+        # Each platform service has its own LICENSE-binary / NOTICE-binary at
+        # the repo root after #4668. One step covers both for this service's
+        # dist:
+        #   * LICENSE-binary  — check bundled jars against the claimed licenses
+        #     (audit always runs and never fails the step);
+        #   * NOTICE-binary   — regenerate from the same unzipped lib dir via
+        #     generate_notice_binary.py and diff against the committed file.
+        #     Drift means a dep changed without rerunning the generator — fix:
+        #       ./bin/licensing/generate_notice_binary.py ${{ matrix.service }}/NOTICE-binary /tmp/dists/${{ matrix.service }}-*/lib
         run: |
           set -euo pipefail
           mkdir -p /tmp/dists
@@ -602,6 +620,12 @@ jobs:
             --license-binary ${{ matrix.service }}/LICENSE-binary \
             /tmp/dists/${{ matrix.service }}-*/lib || check_exit=$?
           ./bin/licensing/audit_jar_licenses.py /tmp/dists/${{ matrix.service }}-*/lib || true
+
+          ./bin/licensing/generate_notice_binary.py /tmp/notice-${{ matrix.service }}.txt /tmp/dists/${{ matrix.service }}-*/lib
+          if ! diff -u ${{ matrix.service }}/NOTICE-binary /tmp/notice-${{ matrix.service }}.txt; then
+            echo "::error::${{ matrix.service }}/NOTICE-binary differs from generator output. Regenerate with bin/licensing/generate_notice_binary.py and commit."
+            check_exit=1
+          fi
           exit "$check_exit"
       - name: Upload ${{ matrix.service }} coverage to Codecov
         # Per-service flag so each matrix entry has its own Codecov view

.github/workflows/welcome-first-time-contributor.yml

@@ -44,6 +44,16 @@ jobs:
     if: github.event.sender.type != 'Bot'
     runs-on: ubuntu-latest
     steps:
+      # Check out the base ref (pull_request_target / issues both resolve to
+      # the trusted base branch, never the fork head) so we can read the
+      # welcome message template below. The template lives in its own .txt
+      # file so editing the wording does not trigger a full CI run; see the
+      # `ci` label exclusion in .github/labeler.yml.
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/welcome-first-time-contributor.txt
+          sparse-checkout-cone-mode: false
       - uses: actions/github-script@v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -104,46 +114,17 @@ jobs:
               return;
             }
 
-            const body = [
-              MARKER,
-              `👋 Thanks for your first contribution to Texera, @${author}!`,
-              ``,
-              `You can drive common housekeeping tasks just by leaving a comment. Type the command on its own line.`,
-              ``,
-              `### On issues`,
-              ``,
-              `| Command | What it does |`,
-              `|---|---|`,
-              `| \`/take\` | Assign the issue to yourself (self-claim it) |`,
-              `| \`/untake\` | Remove yourself as assignee |`,
-              ``,
-              `To find unclaimed work, search \`is:issue is:open no:assignee\` — there's no "triage" label; the search filter *is* the triage state.`,
-              ``,
-              `### Linking sub-issues`,
-              ``,
-              `| Command | Where to run it | What it does |`,
-              `|---|---|---|`,
-              `| \`/sub-issue #12 #13\` | On the **parent** | Links #12 and #13 as children of this issue |`,
-              `| \`/unsub-issue #12 #13\` | On the **parent** | Unlinks those children |`,
-              `| \`/parent-issue #5\` | On the **child** | Sets #5 as this issue's parent |`,
-              `| \`/unparent-issue\` | On the **child** | Removes this issue's parent (auto-detected) |`,
-              `| \`/unparent-issue #5\` | On the **child** | Removes parent #5 explicitly |`,
-              ``,
-              `You can write references as \`#12\` or bare \`12\`. Cross-repo references like \`owner/repo#12\` aren't supported and are ignored.`,
-              ``,
-              `### On pull requests (author only)`,
-              ``,
-              `| Command | What it does |`,
-              `|---|---|`,
-              `| \`/request-review @user [@user ...]\` | Request reviews from those users |`,
-              `| \`/unrequest-review @user [@user ...]\` | Cancel those review requests |`,
-              ``,
-              `You can mention teams as \`@org/team\`, and \`@copilot\` works too. Only the PR **author** can use these commands.`,
-              ``,
-              `> **Note:** Commands must match exactly — \`/take this\` won't work, only \`/take\`. Bots are ignored, and you can't self-link an issue or set an issue as its own parent.`,
-              ``,
-              `For the full contribution flow, see [CONTRIBUTING.md](https://github.com/${owner}/${repo}/blob/main/CONTRIBUTING.md).`,
-            ].join('\n');
+            // Message body lives in .github/welcome-first-time-contributor.txt
+            // so wording edits skip CI. Substitute the runtime placeholders
+            // and prepend the idempotency marker.
+            const fs = require('fs');
+            const template = fs.readFileSync(
+              '.github/welcome-first-time-contributor.txt', 'utf8',
+            );
+            const body = MARKER + '\n' + template
+              .replaceAll('{{author}}', author)
+              .replaceAll('{{owner}}', owner)
+              .replaceAll('{{repo}}', repo);
 
             try {
               await github.rest.issues.createComment({

.licenserc.yaml

@@ -20,6 +20,7 @@ header:
     - '**/LICENSE-binary'
     - '**/LICENSE-binary-*'
     - '**/NOTICE-binary'
+    - '**/NOTICE-binary-*'
     - '.dockerignore'
     - '.gitattributes'
     - '.github/PULL_REQUEST_TEMPLATE'