feat: Include dependency check before release

.github/actions/generate-and-check-dependencies/action.yml

@@ -0,0 +1,59 @@
+#################################################################################
+#  Copyright (c) 2025 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
+#
+#  See the NOTICE file(s) distributed with this work for additional
+#  information regarding copyright ownership.
+#
+#  This program and the accompanying materials are made available under the
+#  terms of the Apache License, Version 2.0 which is available at
+#  https://www.apache.org/licenses/LICENSE-2.0.
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#################################################################################
+
+
+name: "Generate and validate DEPENDENCIES file"
+description: "Generate and checks DEPENDENCIES file"
+
+inputs:
+  run:
+    description: how the dependencies check must applied. "standard" will fail only for 'rejected' deps, "strict" will fail also for 'restricted' ones
+    required: false
+    default: standard
+
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/setup-java
+
+    - name: Generate dependency list
+      shell: bash
+      run: |
+        ./gradlew allDependencies | grep -Poh "(?<=\s)[\w.-]+:[\w.-]+:[^:\s\[\]]+" | sort | uniq > dependency-list
+        cat dependency-list
+
+    - name: Run dash
+      id: run-dash
+      uses: eclipse-tractusx/sig-infra/.github/actions/run-dash@main
+      with:
+        dash_input: dependency-list
+        dependencies_file: DEPENDENCIES
+        fail_on_out_of_date: true
+        fail_on_rejected: true
+        fail_on_restricted: ${{ inputs.run == 'strict' }}
+
+    - name: Print file
+      shell: bash
+      if: failure()
+      run: |
+        echo "=== Please copy the following content back to DEPENDENCIES ==="
+        cat DEPENDENCIES
+        echo "=== end of content ==="
+        exit 1

.github/workflows/draft-release.yaml

@@ -84,6 +84,12 @@ jobs:
         run: |
           git config user.name "eclipse-tractusx-bot"
           git config user.email "tractusx-bot@eclipse.org"
+
+      - uses: ./.github/workflows/generate-and-publish-dependencies.yaml
+
+      - name: Replace published DEPENDENCIES file link in NOTICE with the one just created
+        run: sed -i "s#\[DEPENDENCIES\]\(.*\)#\[DEPENDENCIES\]\(DEPENDENCIES\)#g" NOTICE.md
+
       - uses: ./.github/actions/setup-java
       - name: Bump version in gradle.properties
         run: |-
@@ -109,7 +115,7 @@ jobs:
       - name: Commit manifest files
         id: make-commit
         run: |
-          git add gradle.properties $(find charts -name Chart.yaml) $(find charts -name README.md)
+          git add DEPENDENCIES NOTICE.md gradle.properties $(find charts -name Chart.yaml) $(find charts -name README.md)
           git commit --message "Prepare release ${{ inputs.version }}"
 
           echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT

.github/workflows/dash-scan.yml → .github/workflows/generate-and-publish-dependencies.yaml

@@ -18,45 +18,40 @@
 #################################################################################
 
 
-name: "3rd Party dependency check (Eclipse Dash)"
+name: "Generate DEPENDENCIES file and publish to GitHub pages"
 
 on:
+  schedule:
+    - cron: '0 0 * * *'
   workflow_dispatch:
   push:
     branches:
       - main
-  pull_request:
-    branches:
-      - main
 
 permissions:
   contents: write
 
 jobs:
   check-dependencies:
     runs-on: ubuntu-latest
+
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-java
 
-      - name: generate dependency list
+      - uses: .github/actions/generate-and-check-dependencies
+        with:
+          run: strict
+
+      - name: Prepare to publish
+        shell: bash
         run: |
-          ./gradlew allDependencies | grep -Poh "(?<=\s)[\w.-]+:[\w.-]+:[^:\s\[\]]+" | sort | uniq > dependency-list
-          cat dependency-list
+          mkdir public
+          cp DEPENDENCIES public/
 
-      - name: Run dash
-        id: run-dash
-        uses: eclipse-tractusx/sig-infra/.github/actions/run-dash@main
+      - name: Publish to GitHub Pages
+        uses: peaceiris/actions-gh-pages@v4
         with:
-          dash_input: dependency-list
-          dependencies_file: DEPENDENCIES
-          fail_on_out_of_date: true
-          fail_on_rejected: true
-          fail_on_restricted: false
-
-      - name: print generated file
-        if: failure()
-        run: |
-          echo "=== Please copy the following content back to DEPENDENCIES ==="
-          cat DEPENDENCIES
-          echo "=== end of content ==="
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: public
+          keep_files: true