From 47df57a359165429a85505fc631df4ac7e8afdad Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Fri, 30 Oct 2026 09:05:34 +0100 Subject: [PATCH] :construction_worker: ci: allow four package-scoped licence exceptions Renovate #500 (certifi, MPL-2.0, docs build only), #512 (sonarqube-scan-action, LGPL-3.0, CI only) and #513 (golang.org/x/sys and x/tools, Go PATENTS ref like x/net) fail dependency-review. Scope each exception to its package, as for the existing ones. --- .github/workflows/ci.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 0e6fd482..c1a9885f 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -228,7 +228,11 @@ jobs: # downloads the Task binary on runners. It is never linked, vendored or shipped in the # kollect binary, image or chart, and every workflow already uses it at the same pinned # sha. Scoped to the package, not the licence, so another GPL action still fails. - allow-dependencies-licenses: pkg:golang/golang.org/x/net, pkg:pypi/cairosvg, pkg:githubactions/go-task/setup-task + # Added 2026-10-30 (operator): golang.org/x/sys and golang.org/x/tools now carry the same Go + # PATENTS ref as x/net above. certifi (MPL-2.0) is the CA bundle the docs-site build's + # requests stack uses; docs only, never shipped. SonarSource/sonarqube-scan-action + # (reported LGPL-3.0) is a CI-only action like setup-task. All scoped to the package. + allow-dependencies-licenses: pkg:golang/golang.org/x/net, pkg:golang/golang.org/x/sys, pkg:golang/golang.org/x/tools, pkg:pypi/cairosvg, pkg:pypi/certifi, pkg:githubactions/go-task/setup-task, pkg:githubactions/SonarSource/sonarqube-scan-action verify: name: verify