ORT Workflow

.github/ort-config.yml

@@ -0,0 +1,37 @@
+ort:
+  analyzer:
+    skip_excluded: true
+    allowDynamicVersions: true
+    enabledPackageManagers: [Cargo, Bundler]
+  excludes:
+    paths:
+    - pattern: "ort/**"
+      reason: "BUILD_TOOL_OF"
+      comment: "ORT tool directory, not part of the Ruby project"
+    - pattern: "**/funTest/**"
+      reason: "BUILD_TOOL_OF"
+      comment: "ORT functional test files should be excluded"
+    - pattern: "**/synthetic/**"
+      reason: "BUILD_TOOL_OF"
+      comment: "ORT synthetic test projects should be excluded"
+    - pattern: "valkey-glide/java/**"
+      reason: "DOCUMENTATION_OF"
+      comment: "Java client bindings, not core Rust dependencies"
+    - pattern: "valkey-glide/node/**"
+      reason: "DOCUMENTATION_OF"
+      comment: "Node.js client bindings, not core Rust dependencies"
+    - pattern: "valkey-glide/python/**"
+      reason: "DOCUMENTATION_OF"
+      comment: "Python client bindings, not core Rust dependencies"
+    - pattern: "valkey-glide/go/**"
+      reason: "DOCUMENTATION_OF"
+      comment: "Go client bindings, not core Rust dependencies"
+    - pattern: "valkey-glide/csharp/**"
+      reason: "DOCUMENTATION_OF"
+      comment: "C# client bindings, not core Rust dependencies"
+    - pattern: "valkey-glide/benchmarks/**"
+      reason: "DOCUMENTATION_OF"
+      comment: "Benchmark code, not core dependencies"
+    - pattern: "**/cpp/**"
+      reason: "BUILD_TOOL_OF"
+      comment: "C++ bindings directory should not be analyzed by ORT"

.github/workflows/ort.yml

@@ -0,0 +1,286 @@
+name: OSS Review Toolkit (ORT)
+
+permissions:
+    contents: read
+
+on:
+    pull_request:
+
+    workflow_dispatch:
+        inputs:
+            branch_name:
+                description: "The branch to run against the ORT tool"
+                required: true
+                default: "main"
+
+concurrency:
+    group: ORT-${{ github.head_ref || github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    generate:
+        name: Generate attribution file
+        runs-on: ubuntu-latest
+
+        permissions:
+            contents: read
+            actions: read
+
+        # 1. For workflow_dispatch, always allow
+        # 2. For pull_request, run if branch is not autogenerated ort-diff-for- branches
+        if: >
+            github.repository_owner == 'valkey-io' &&
+            (github.event_name == 'workflow_dispatch' ||
+            (github.event_name == 'pull_request' && !startsWith(github.head_ref, 'ort-diff-for-')))
+
+        env:
+            RUBY_ATTRIBUTIONS: "THIRD_PARTY_LICENSES_RUBY"
+            INPUT_TARGET_BRANCH: ${{ github.event.inputs.branch_name }}
+            EVENT_NAME: ${{ github.event_name }}
+            HEAD_REF: ${{ github.head_ref }}
+            ORT_VERSION: "59.0.0"
+
+        outputs:
+            target_branch: ${{ env.TARGET_BRANCH }}
+            target_commit: ${{ env.TARGET_COMMIT }}
+            licenses_list: ${{ env.LICENSES_LIST }}
+            found_diff: ${{ steps.diff.outputs.found_diff }}
+
+        steps:
+            - name: Setup target branch and commit
+              run: |
+                  if [ "$EVENT_NAME" == 'workflow_dispatch' ]; then
+                    echo "TARGET_BRANCH=$INPUT_TARGET_BRANCH" >> $GITHUB_ENV
+                  elif [ "$EVENT_NAME" == 'pull_request' ]; then
+                    echo "TARGET_BRANCH=$HEAD_REF" >> $GITHUB_ENV
+                  fi
+
+            - name: Checkout target branch
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              with:
+                  ref: ${{ env.TARGET_BRANCH }}
+                  repository: ${{ github.event.pull_request.head.repo.full_name }}
+                  token: ${{ secrets.GITHUB_TOKEN }}
+                  fetch-depth: 0 # Fetch all history for all branches and tags
+                  submodules: recursive
+
+            - name: Setup target commit
+              run: |
+                  echo "TARGET_COMMIT=`git rev-parse HEAD`" >> $GITHUB_ENV
+
+            - name: Set up JDK 11 for the ORT package
+              uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+              with:
+                  distribution: "temurin"
+                  java-version: 11
+
+            - name: Cache ORT and Gradle packages
+              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+              id: cache-ort
+              with:
+                  path: |
+                      ./ort
+                      ~/.gradle/caches
+                      ~/.gradle/wrapper
+                  key: ${{ runner.os }}-ort-${{ env.ORT_VERSION }}
+
+            - name: Checkout ORT Repository
+              if: steps.cache-ort.outputs.cache-hit != 'true'
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              with:
+                  repository: "oss-review-toolkit/ort"
+                  path: "./ort"
+                  ref: ${{ env.ORT_VERSION }}
+                  submodules: recursive
+
+            - name: Install Rust toolchain
+              uses: dtolnay/rust-toolchain@c56a35af9328d0bc581dc86c05e58f97f7c38a0e # 1.85
+
+            - name: Build and install ORT
+              if: steps.cache-ort.outputs.cache-hit != 'true'
+              working-directory: ./ort/
+              run: |
+                  export JAVA_OPTS="$JAVA_OPTS -Xmx8g"
+                  ./gradlew installDist
+
+            - name: Create ORT config file
+              run: |
+                  mkdir -p ~/.ort/config
+                  cp .github/ort-config.yml ~/.ort/config/config.yml
+                  cat ~/.ort/config/config.yml
+
+            ### Rust glide-core ###
+            - name: Run ORT tools for glide-core
+              uses: ./valkey-glide/.github/workflows/run-ort-tools
+              with:
+                  folder_path: "${{ github.workspace }}/valkey-glide/glide-core"
+
+            ### Rust FFI ###
+            - name: Run ORT tools for FFI
+              uses: ./valkey-glide/.github/workflows/run-ort-tools
+              with:
+                  folder_path: "${{ github.workspace }}/valkey-glide/ffi"
+
+            ### Ruby ###
+            - name: Set up Ruby
+              uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
+              with:
+                  ruby-version: "3.3"
+                  bundler-cache: false
+
+            - name: Install Ruby dependencies
+              run: |
+                  bundle install
+                  echo "Bundle install completed. Checking for Gemfile.lock:"
+                  ls -la Gemfile.lock || echo "Warning: Gemfile.lock not found"
+
+              # Temporarily move ORT's own checkout out of the workspace before scanning the
+              # Ruby project root. run-ort-tools needs ./ort/ present (relative to github.workspace)
+              # as its working directory, but scanning the whole workspace (folder_path is
+              # github.workspace) would otherwise also walk into ./ort and crash trying to
+              # resolve ORT's own bundled test fixtures against an unrelated git repository.
+            - name: Move ORT out of the workspace before scanning Ruby
+              run: mv ./ort /tmp/ort
+
+            - name: Run ORT tools for Ruby
+              uses: ./valkey-glide/.github/workflows/run-ort-tools
+              with:
+                  folder_path: "${{ github.workspace }}"
+
+              # Restore ./ort in case a later cache-save step or re-run expects it in place
+            - name: Restore ORT into the workspace
+              if: always()
+              run: mv /tmp/ort ./ort
+
+              ### Get licenses ###
+            - name: Retrieve licenses list
+              working-directory: ./valkey-glide/utils
+              run: |
+                  {
+                    echo 'LICENSES_LIST<<EOF'
+                    python3 get_licenses_from_ort.py
+                    echo EOF
+                  } >> "$GITHUB_ENV"
+
+              ### Upload licenses ###
+            - name: Get current date
+              id: date
+              run: |
+                  CURR_DATE=$(date +'%Y-%m-%d-%H')
+                  echo "date=${CURR_DATE}" >> $GITHUB_OUTPUT
+
+            - name: Upload the final package list
+              continue-on-error: true
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              with:
+                  name: final-package-list-${{ steps.date.outputs.date }}
+                  path: |
+                      valkey-glide/utils/final_package_list.txt
+                  retention-days: 30
+
+            - name: Upload the skipped package list
+              continue-on-error: true
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              with:
+                  name: skipped-package-list-${{ steps.date.outputs.date }}
+                  path: |
+                      valkey-glide/utils/skipped_package_list.txt
+                  retention-days: 30
+
+            - name: Upload the unknown/unapproved package list
+              continue-on-error: true
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              with:
+                  name: unapproved-package-list-${{ steps.date.outputs.date }}
+                  path: |
+                      valkey-glide/utils/unapproved_package_list.txt
+                  retention-days: 30
+
+            - name: Check for unapproved packages
+              run: |
+                  if [ -s valkey-glide/utils/unapproved_package_list.txt ]; then
+                    echo "::error::Found unapproved packages. Please review valkey-glide/utils/unapproved_package_list.txt"
+                    cat valkey-glide/utils/unapproved_package_list.txt
+                    exit 1
+                  else
+                    echo "No unapproved packages found."
+                  fi
+
+              ### Merge FFI attributions into the Ruby attributions, since the gem ships libglide_ffi ###
+            - name: Build merged attribution file
+              run: |
+                  cp ort_results/NOTICE_DEFAULT $RUBY_ATTRIBUTIONS
+                  cat valkey-glide/ffi/ort_results/NOTICE_DEFAULT >> $RUBY_ATTRIBUTIONS
+
+            - name: Upload generated attribution file
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              with:
+                  name: ruby-attributions
+                  path: ${{ env.RUBY_ATTRIBUTIONS }}
+                  retention-days: 30
+
+              ### Check for attributions diff ###
+            - name: Set found_diff
+              id: diff
+              run: |
+                  if [ -n "$(git status --porcelain "$RUBY_ATTRIBUTIONS")" ]; then
+                    echo "found_diff=true" >> "$GITHUB_OUTPUT"
+                  else
+                    echo "found_diff=false" >> "$GITHUB_OUTPUT"
+                  fi
+
+            - name: Fail if attributions are outdated
+              if: ${{ steps.diff.outputs.found_diff == 'true' }}
+              run: |
+                  echo "::error::The attribution file '$RUBY_ATTRIBUTIONS' is outdated. Please run this workflow manually to update it."
+                  exit 1
+
+    create-pr:
+        name: Create PR for updated attribution file
+        needs: generate
+        runs-on: ubuntu-latest
+        if: needs.generate.outputs.found_diff == 'true'
+
+        permissions:
+            contents: write
+            pull-requests: write
+
+        env:
+            RUBY_ATTRIBUTIONS: "THIRD_PARTY_LICENSES_RUBY"
+            TARGET_BRANCH: ${{ needs.generate.outputs.target_branch }}
+            TARGET_COMMIT: ${{ needs.generate.outputs.target_commit }}
+            LICENSES_LIST: ${{ needs.generate.outputs.licenses_list }}
+
+        steps:
+            - name: Checkout attribution file only
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              with:
+                  ref: ${{ env.TARGET_BRANCH }}
+                  repository: ${{ github.event.pull_request.head.repo.full_name }}
+                  token: ${{ secrets.GITHUB_TOKEN }}
+                  fetch-depth: 1
+                  submodules: false
+                  sparse-checkout: |
+                      ${{ env.RUBY_ATTRIBUTIONS }}
+                  sparse-checkout-cone-mode: false
+
+            - name: Download generated attribution file
+              uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+              with:
+                  name: ruby-attributions
+
+              ### Create or update PR, note a potential race on the source branch ###
+            - name: Create or update pull request
+              if: ${{ github.event_name != 'pull_request' }}
+              id: create-pr
+              uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+              with:
+                  token: ${{ secrets.GITHUB_TOKEN }}
+                  sign-commits: true
+                  commit-message: "Updated attribution files\n\nSigned-off-by: ort-bot <valkey-glide@lists.valkey.io>"
+                  branch: "ort-diff-for-${{ env.TARGET_BRANCH }}"
+                  base: ${{ env.TARGET_BRANCH }}
+                  title: "Updated attribution files for commit ${{ env.TARGET_COMMIT }}"
+                  body: "Created by GitHub action. ${{ env.LICENSES_LIST }}"
+                  add-paths: |
+                      ${{ env.RUBY_ATTRIBUTIONS }}