Add version and upstream license links to THIRD_PARTY_NOTICES.md

.github/workflows/third-party-notices-check.yaml

@@ -12,6 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Regenerates THIRD_PARTY_NOTICES.md and fails if it differs from the committed
+# copy, so a dependency change cannot land without refreshed attribution. The
+# generator also fails when a license file has no verified URL in
+# hack/license-urls.tsv, which catches a bump that skipped
+# 'make third-party-notices-urls'. Link rot is caught separately by
+# third-party-notices-links.yaml.
 
 name: Third-Party Notices
 

.github/workflows/third-party-notices-links.yaml

@@ -0,0 +1,62 @@
+# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Re-verifies every license URL against the vendored bytes. Links are proven
+# correct when written, but upstream can retag, rename or archive a repository
+# afterwards, and no offline gate can see that. This runs on a schedule rather
+# than per pull request so link rot does not block unrelated work.
+
+name: Third-Party Notices Link Check
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-links:
+    name: Re-verify license URLs against upstream
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+
+      - name: Get Golang Version
+        id: golang_version
+        run: |
+          GOLANG_VERSION=$(./hack/golang-version.sh)
+          echo "Detected $GOLANG_VERSION"
+          echo "golang_version=${GOLANG_VERSION}" >> $GITHUB_OUTPUT
+
+      - name: Install Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: ${{ steps.golang_version.outputs.golang_version }}
+
+      - name: Re-verify every license URL
+        env:
+          URLS_OUTPUT: /tmp/license-urls-fresh.tsv
+        run: make bin/go-licenses && bash hack/verify-license-urls.sh
+
+      - name: Compare against the committed map
+        run: |
+          if ! diff -u <(LC_ALL=C grep -v '^#' hack/license-urls.tsv) \
+                       <(LC_ALL=C grep -v '^#' /tmp/license-urls-fresh.tsv); then
+            echo "::error::A license URL no longer serves the vendored bytes. Upstream may have retagged or moved."
+            exit 1
+          fi

Makefile

@@ -29,8 +29,8 @@ EXAMPLE_TARGETS := $(patsubst %,example-%, $(EXAMPLES))
 CMDS := $(patsubst ./cmd/%/,%,$(sort $(dir $(wildcard ./cmd/*/))))
 CMD_TARGETS := $(patsubst %,cmd-%, $(CMDS))
 
-CHECK_TARGETS := lint
-MAKE_TARGETS := binaries build check fmt lint-internal test examples cmds coverage generate vendor check-modules third-party-notices check-third-party-notices $(CHECK_TARGETS)
+CHECK_TARGETS := lint test-tools
+MAKE_TARGETS := binaries build check fmt lint-internal test examples cmds coverage generate vendor check-modules third-party-notices check-third-party-notices third-party-notices-repos third-party-notices-urls $(CHECK_TARGETS)
 
 TARGETS := $(MAKE_TARGETS) $(EXAMPLE_TARGETS) $(CMD_TARGETS)
 
@@ -129,6 +129,21 @@ check-third-party-notices: third-party-notices
 	@git diff --exit-code -- THIRD_PARTY_NOTICES.md \
 		|| { echo "ERROR: THIRD_PARTY_NOTICES.md is stale. Run 'make third-party-notices' and commit the change."; exit 1; }
 
+# Needs network. Rarely run: keyed by module, so a version bump does not
+# invalidate it. Only a new dependency does.
+third-party-notices-repos:
+	@bash hack/resolve-module-repos.sh
+
+# Needs network. Every URL is content-verified against the vendored copy before
+# it is written, so re-run this whenever a dependency version changes.
+third-party-notices-urls: bin/go-licenses third-party-notices-repos
+	@bash hack/verify-license-urls.sh
+
+test-tools:
+	@for t in hack/*_test.sh; do \
+		bash "$$t" || exit 1; \
+	done
+
 COVERAGE_FILE := coverage.out
 test: build cmds
 	go test -coverprofile=$(COVERAGE_FILE) $(MODULE)/cmd/... $(MODULE)/internal/... $(MODULE)/api/...