continuous-delivery-scripts 4.2.0__tar.gz → 4.4.0__tar.gz

{continuous_delivery_scripts-4.2.0/continuous_delivery_scripts.egg-info → continuous_delivery_scripts-4.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: continuous-delivery-scripts
-Version: 4.2.0
+Version: 4.4.0
 Summary: Git-based CI/CD tools for releases, changelogs, SPDX SBOMs and licence reporting
 Home-page: https://github.com/ARMmbed/continuous-delivery-scripts
 Author: Arm
@@ -239,17 +239,18 @@ same commands whichever CI system the team chooses.
 
 | Command | What it does | Key arguments | Typical environment |
 | --- | --- | --- | --- |
-| `cd-assert-news` | Validates a branch's news files; can add a missing file for a configured dependency-update branch. | `--current-branch` (`-b`), `--local` (`-l`) | CI; `--local` for developer checks |
-| `cd-create-news-file` | Creates a one-line news fragment in the configured news directory. | Required news text; `--type` (`-t`), `--ref-number` (`-n`) | Developer |
-| `cd-determine-version` | Calculates and prints the **project's prospective release version** without generating a changelog. | Required `--release-type` (`-t`) | Developer preview or CI |
-| `cd-generate-news` | Updates the project version and, for beta or production releases, builds the changelog from news fragments; prints the resulting version. | Required `--release-type` (`-t`) | CI release flow |
-| `cd-get-config` | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
-| `cd-tag-and-release` | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
-| `cd-generate-docs` | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
-| `cd-generate-spdx` | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); create the directory first | CI audit; developer review also possible |
-| `cd-license-files` | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
-| `cd-record-secrets` | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
-| `cd-detect-secrets` | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |
+| [`cd-assert-news`](./guides/checking-news-fragments.md) | Validates a branch's news files; can add a missing file for a configured dependency-update branch. | `--current-branch` (`-b`), `--local` (`-l`) | CI; `--local` for developer checks |
+| [`cd-create-news-file`](./guides/creating-news-fragments.md) | Creates a one-line news fragment in the configured news directory. | Required news text; `--type` (`-t`), `--ref-number` (`-n`) | Developer |
+| [`cd-determine-version`](./guides/previewing-versions.md) | Calculates and prints the **project's prospective release version** without generating a changelog. | Required `--release-type` (`-t`) | Developer preview or CI |
+| [`cd-generate-news`](./guides/managing-changelogs.md) | Updates the project version and, for beta or production releases, builds the changelog from news fragments; prints the resulting version. | Required `--release-type` (`-t`) | CI release flow |
+| [`cd-get-config`](./guides/reading-project-configuration.md) | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
+| [`cd-tag-and-release`](./guides/automating-releases.md) | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
+| [`cd-generate-docs`](./guides/generating-code-documentation.md) | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
+| [`cd-generate-spdx`](./guides/generating-an-spdx-sbom.md) | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); optional `--lookup-scancode` | CI audit; developer review also possible |
+| [`cd-check-licence-compliance`](./guides/checking-licence-compliance.md) | Checks project and dependency licences without creating SPDX documents; optionally writes third-party IP summaries. | Optional `--output-dir` (`-o`) for reports, `--lookup-scancode` | CI gate or developer review |
+| [`cd-license-files`](./guides/licence-header-management.md) | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
+| [`cd-record-secrets`](./guides/recording-secrets.md) | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
+| [`cd-detect-secrets`](./guides/checking-for-secrets.md) | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |
 
 For example, `cd-create-news-file "Fix dependency resolution" --type bugfix`
 adds a news fragment. For release workflow details, see the

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.4.0}/README.md

@@ -178,17 +178,18 @@ same commands whichever CI system the team chooses.
 
 | Command | What it does | Key arguments | Typical environment |
 | --- | --- | --- | --- |
-| `cd-assert-news` | Validates a branch's news files; can add a missing file for a configured dependency-update branch. | `--current-branch` (`-b`), `--local` (`-l`) | CI; `--local` for developer checks |
-| `cd-create-news-file` | Creates a one-line news fragment in the configured news directory. | Required news text; `--type` (`-t`), `--ref-number` (`-n`) | Developer |
-| `cd-determine-version` | Calculates and prints the **project's prospective release version** without generating a changelog. | Required `--release-type` (`-t`) | Developer preview or CI |
-| `cd-generate-news` | Updates the project version and, for beta or production releases, builds the changelog from news fragments; prints the resulting version. | Required `--release-type` (`-t`) | CI release flow |
-| `cd-get-config` | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
-| `cd-tag-and-release` | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
-| `cd-generate-docs` | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
-| `cd-generate-spdx` | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); create the directory first | CI audit; developer review also possible |
-| `cd-license-files` | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
-| `cd-record-secrets` | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
-| `cd-detect-secrets` | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |
+| [`cd-assert-news`](./guides/checking-news-fragments.md) | Validates a branch's news files; can add a missing file for a configured dependency-update branch. | `--current-branch` (`-b`), `--local` (`-l`) | CI; `--local` for developer checks |
+| [`cd-create-news-file`](./guides/creating-news-fragments.md) | Creates a one-line news fragment in the configured news directory. | Required news text; `--type` (`-t`), `--ref-number` (`-n`) | Developer |
+| [`cd-determine-version`](./guides/previewing-versions.md) | Calculates and prints the **project's prospective release version** without generating a changelog. | Required `--release-type` (`-t`) | Developer preview or CI |
+| [`cd-generate-news`](./guides/managing-changelogs.md) | Updates the project version and, for beta or production releases, builds the changelog from news fragments; prints the resulting version. | Required `--release-type` (`-t`) | CI release flow |
+| [`cd-get-config`](./guides/reading-project-configuration.md) | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
+| [`cd-tag-and-release`](./guides/automating-releases.md) | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
+| [`cd-generate-docs`](./guides/generating-code-documentation.md) | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
+| [`cd-generate-spdx`](./guides/generating-an-spdx-sbom.md) | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); optional `--lookup-scancode` | CI audit; developer review also possible |
+| [`cd-check-licence-compliance`](./guides/checking-licence-compliance.md) | Checks project and dependency licences without creating SPDX documents; optionally writes third-party IP summaries. | Optional `--output-dir` (`-o`) for reports, `--lookup-scancode` | CI gate or developer review |
+| [`cd-license-files`](./guides/licence-header-management.md) | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
+| [`cd-record-secrets`](./guides/recording-secrets.md) | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
+| [`cd-detect-secrets`](./guides/checking-for-secrets.md) | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |
 
 For example, `cd-create-news-file "Fix dependency resolution" --type bugfix`
 adds a news fragment. For release workflow details, see the

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.4.0}/continuous_delivery_scripts/_version.py

@@ -11,8 +11,8 @@ References
 This file is autogenerated, do not modify by hand.
 """
 
-__version__ = "4.2.0"
-COMMIT = "757dd096956394de1185aa8f7bb169dc0d0fc982"
+__version__ = "4.4.0"
+COMMIT = "b480ded441705a4dda9e7d2d3e7a3e1b45729688"
 MAJOR = 4
-MINOR = 2
+MINOR = 4
 PATCH = 0

continuous_delivery_scripts-4.4.0/continuous_delivery_scripts/check_licence_compliance.py

@@ -0,0 +1,68 @@
+#
+# Copyright (C) 2020-2026 Arm Limited or its affiliates and Contributors. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+"""Check project and dependency licences without generating SPDX documents."""
+
+import argparse
+import logging
+import sys
+from pathlib import Path
+
+from continuous_delivery_scripts.language_specifics import get_language_specifics
+from continuous_delivery_scripts.spdx_report.licence_assessment import LicenceAssessment
+from continuous_delivery_scripts.utils.logging import log_exception, set_log_level
+
+logger = logging.getLogger(__name__)
+
+
+def main() -> int:
+    """Check licence compliance and optionally write third-party IP summaries."""
+    parser = argparse.ArgumentParser(description="Check project and dependency licence compliance.")
+    parser.add_argument(
+        "-o",
+        "--output-dir",
+        type=Path,
+        help="Write third-party IP summaries to this existing directory (no SPDX documents).",
+    )
+    parser.add_argument(
+        "--lookup-scancode",
+        action="store_true",
+        help="Consult ScanCode LicenseDB for unclassified licences or missing assessment rules.",
+    )
+    parser.add_argument("-v", "--verbose", action="count", default=0, help="Increase logging verbosity.")
+    args = parser.parse_args()
+    set_log_level(args.verbose)
+
+    try:
+        plugin = get_language_specifics()
+        if not plugin.can_get_project_metadata():
+            raise ValueError("The selected language plugin cannot provide metadata for licence compliance checks.")
+        project = plugin.get_current_spdx_project()
+        if project is None:
+            raise ValueError("The selected language plugin did not return a project for licence compliance checks.")
+        if args.lookup_scancode:
+            project.enable_scancode_lookup()
+        if args.output_dir is not None:
+            project.generate_licensing_summary(args.output_dir)
+        counts = {
+            status.value: sum(result.status is status for result in project.licence_assessments.values())
+            for status in LicenceAssessment
+        }
+        print("Dependency licence assessment: " + ", ".join(f"{name}: {count}" for name, count in counts.items()))
+        if args.lookup_scancode:
+            for name, result in project.licence_assessments.items():
+                for info in result.scancode_licences:
+                    print(f"{name}: ScanCode LicenseDB: {info.identifier} ({info.category}): {info.url}")
+        project.check_licence_compliance()
+        if args.lookup_scancode:
+            for warning in project.scancode_follow_up_warnings():
+                print(f"WARNING: {warning}", file=sys.stderr)
+        return 0
+    except Exception as error:
+        log_exception(logger, error)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.4.0}/continuous_delivery_scripts/report_third_party_ip.py

@@ -36,11 +36,13 @@ def generate_spdx_project_reports(project: "SpdxProject", output_directory: Path
     return project
 
 
-def generate_spdx_reports(output_directory: Path) -> Optional["SpdxProject"]:
+def generate_spdx_reports(output_directory: Path, lookup_scancode: bool = False) -> Optional["SpdxProject"]:
     """Generates all the SPDX reports for the current project."""
     project = get_language_specifics().get_current_spdx_project()
     if not project:
         return None
+    if lookup_scancode:
+        project.enable_scancode_lookup()
     return generate_spdx_project_reports(project, output_directory)
 
 
@@ -59,6 +61,11 @@ def main() -> int:
         required=True,
         type=convert_to_path,
     )
+    parser.add_argument(
+        "--lookup-scancode",
+        action="store_true",
+        help="Consult ScanCode LicenseDB for unclassified licences or missing assessment rules.",
+    )
 
     parser.add_argument(
         "-v",
@@ -72,9 +79,12 @@ def main() -> int:
 
     try:
         if get_language_specifics().can_get_project_metadata():
-            project = generate_spdx_reports(args.output_dir)
+            project = generate_spdx_reports(args.output_dir, lookup_scancode=args.lookup_scancode)
             if project:
                 project.check_licence_compliance()
+                if args.lookup_scancode:
+                    for warning in project.scancode_follow_up_warnings():
+                        print(f"WARNING: {warning}", file=sys.stderr)
         return 0
     except Exception as e:
         log_exception(logger, e)

continuous_delivery_scripts-4.4.0/continuous_delivery_scripts/spdx_report/data/licence_assessment.toml

@@ -0,0 +1,105 @@
+#
+# Copyright (C) 2020-2026 Arm Limited or its affiliates and Contributors. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+
+# Default screening policy. These are review priorities, not legal conclusions.
+# Project overrides are merged by licence ID and rule ID.
+schema_version = 1
+
+[settings]
+# Keep existing compliance exit codes unchanged unless a project opts in.
+fail_on = []
+
+[classifications]
+MIT = "PERMISSIVE"
+"MIT-0" = "PERMISSIVE"
+"0BSD" = "PERMISSIVE"
+"BSD-2-Clause" = "PERMISSIVE"
+"BSD-3-Clause" = "PERMISSIVE"
+ISC = "PERMISSIVE"
+"Apache-2.0" = "PERMISSIVE"
+"Python-2.0" = "PERMISSIVE"
+"PSF-2.0" = "PERMISSIVE"
+"MPL-2.0" = "WEAK_COPYLEFT"
+"LGPL-2.1-only" = "WEAK_COPYLEFT"
+"LGPL-2.1-or-later" = "WEAK_COPYLEFT"
+"LGPL-3.0-only" = "WEAK_COPYLEFT"
+"LGPL-3.0-or-later" = "WEAK_COPYLEFT"
+"GPL-2.0-only" = "STRONG_COPYLEFT"
+"GPL-2.0-or-later" = "STRONG_COPYLEFT"
+"GPL-3.0-only" = "STRONG_COPYLEFT"
+"GPL-3.0-or-later" = "STRONG_COPYLEFT"
+"AGPL-3.0-only" = "NETWORK_COPYLEFT"
+"AGPL-3.0-or-later" = "NETWORK_COPYLEFT"
+"CC0-1.0" = "PUBLIC_DOMAIN"
+Unlicense = "PUBLIC_DOMAIN"
+"LicenseRef-Proprietary" = "PROPRIETARY"
+
+# Map LicenseDB's own vocabulary to screening categories. Unmapped categories
+# remain review-only; these are not legal compatibility decisions.
+[scancode_categories]
+Permissive = "PERMISSIVE"
+"Copyleft Limited" = "WEAK_COPYLEFT"
+Copyleft = "STRONG_COPYLEFT"
+"Public Domain" = "PUBLIC_DOMAIN"
+"Proprietary Free" = "PROPRIETARY"
+Commercial = "PROPRIETARY"
+"Free Restricted" = "PROPRIETARY"
+"Non-Commercial" = "PROPRIETARY"
+
+[[rules]]
+id = "permissive-dependency"
+project_category = "*"
+dependency_category = "PERMISSIVE"
+status = "ALLOW"
+reason = "A permissive dependency generally permits redistribution; retain its notices and conditions."
+
+[[rules]]
+id = "public-domain-dependency"
+project_category = "*"
+dependency_category = "PUBLIC_DOMAIN"
+status = "ALLOW"
+reason = "No copyleft obligation is identified for this public-domain dependency; check its notices."
+
+[[rules]]
+id = "apache-2-to-gpl-2-only"
+project_licence = "GPL-2.0-only"
+dependency_licence = "Apache-2.0"
+status = "REVIEW"
+reason = "Apache-2.0 and GPL-2.0-only have a known directional compatibility concern for combined works."
+
+[[rules]]
+id = "apache-2-to-gpl-2-or-later"
+project_licence = "GPL-2.0-or-later"
+dependency_licence = "Apache-2.0"
+status = "REVIEW"
+reason = "Review the GPL version selected for a combined work before incorporating Apache-2.0 code."
+
+[[rules]]
+id = "weak-copyleft-dependency"
+project_category = "*"
+dependency_category = "WEAK_COPYLEFT"
+status = "REVIEW"
+reason = "Weak copyleft obligations depend on modification, linking and how the work is distributed."
+
+[[rules]]
+id = "strong-copyleft-dependency"
+project_category = "*"
+dependency_category = "STRONG_COPYLEFT"
+status = "REVIEW"
+reason = "Strong copyleft obligations may affect a combined or redistributed work; review the usage."
+
+[[rules]]
+id = "network-copyleft-dependency"
+project_category = "*"
+dependency_category = "NETWORK_COPYLEFT"
+status = "REVIEW"
+reason = "Network copyleft obligations may apply to network use as well as distribution; review the usage."
+
+[[rules]]
+id = "proprietary-dependency"
+project_category = "*"
+dependency_category = "PROPRIETARY"
+status = "REVIEW"
+reason = "A proprietary licence reference does not reveal its terms; consult the rights holder."