Skip to content

refactor: update check-licenses to exclude non-runtime dependencies during checks - #1535

Merged
jorgepiloto merged 7 commits into
mainfrom
refactor/check-vulnerabilities
Sep 16, 2026
Merged

jorgepiloto merged 7 commits into
mainfrom
refactor/check-vulnerabilities

Conversation

@moe-ad

@moe-ad moe-ad commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Closes #1066.

Note

Whoever reviews this PR should also check #1563.

Poetry-related changes

So, when the issue was originally opened, pymaterials-manager was still using poetry, however, the project has since migrated to uv, which really complicated my life as there was no way to easily reproduce anymore... :)

Nonetheless, I looked into it and the main issue stems from the fact that poetry automatically installs all non-optional groups (check this section to find out more about "optional groups" in poetry lingo) when executing poetry install (see this section). To install only runtime dependencies, we need to pass --only main as I have done.

UV-related changes

uv also behaves similarly, in that it automatically syncs with the dev group included. Fine, we already pass --no-dev but I have updated that to --no-default-groups to make things more robust. This is because uv actually reads the default-groups setting to determine what groups to automatically include during a sync (and dev just happens to be the default value). So if a project reconfigures this setting to include other groups, --no-dev will no longer be sufficient.

Others

Given that an external virtual environment can be passed to the check-licenses action via the activate-venv input (which we have no control over), I have added a warning log to inform users about their role in ensuring the provided virtual environment contains only the packages whose licenses need to be checked.

@moe-ad moe-ad changed the title chore: check-vulnerabilities refactor: update check-vulnerabilities to exclude non-runtime dependencies during checks Sep 2, 2026
@moe-ad moe-ad changed the title refactor: update check-vulnerabilities to exclude non-runtime dependencies during checks refactor: update check-licenses to exclude non-runtime dependencies during checks Sep 15, 2026
@moe-ad
moe-ad force-pushed the refactor/check-vulnerabilities branch from 1ea7653 to 5275251 Compare September 15, 2026 10:20
@moe-ad
moe-ad force-pushed the refactor/check-vulnerabilities branch from 5275251 to b89702c Compare September 15, 2026 10:20
@moe-ad moe-ad self-assigned this Sep 15, 2026
@moe-ad
moe-ad marked this pull request as ready for review September 15, 2026 11:50
@moe-ad
moe-ad requested a review from a team as a code owner September 15, 2026 11:50

@SMoraisAnsys SMoraisAnsys left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the changes @moe-ad ! LGTM, please let others also review the PR and do not merge it too fast (see this comment)

Comment thread check-licenses/action.yml Outdated

@jorgepiloto jorgepiloto left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adding this, @moe-ad

Co-authored-by: Sébastien Morais <146729917+SMoraisAnsys@users.noreply.github.com>
@jorgepiloto
jorgepiloto merged commit aad91db into main Sep 16, 2026
91 checks passed
@jorgepiloto
jorgepiloto deleted the refactor/check-vulnerabilities branch September 16, 2026 06:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

License checker is not doing the right thing

6 participants