Add version and upstream license links to THIRD_PARTY_NOTICES.md

.github/workflows/third-party-notices-check.yaml

@@ -13,7 +13,11 @@
 # limitations under the License.
 
 # Regenerates THIRD_PARTY_NOTICES.md and fails if it differs from the committed
-# copy, so a dependency change cannot land without refreshed attribution.
+# copy, so a dependency change cannot land without refreshed attribution. The
+# generator also fails when a license file has no verified URL in
+# tools/license-urls.tsv, which catches a bump that skipped
+# 'make third-party-notices-urls'. Link rot is caught separately by
+# third-party-notices-links.yaml.
 
 name: Third-Party Notices Check
 

.github/workflows/third-party-notices-links.yaml

@@ -0,0 +1,61 @@
+# Copyright NVIDIA CORPORATION
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Re-verifies every license URL against the vendored bytes. Links are proven
+# correct when written, but upstream can retag, rename or archive a repository
+# afterwards, and no offline gate can see that. This runs on a schedule rather
+# than per pull request so link rot does not block unrelated work.
+
+name: Third-Party Notices Link Check
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-links:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Get Golang version
+        run: |
+          GOLANG_VERSION=$( grep "GOLANG_VERSION ?=" versions.mk )
+          echo "GOLANG_VERSION=${GOLANG_VERSION##GOLANG_VERSION ?= }" >> "${GITHUB_ENV}"
+
+      - name: Install Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version: ${{ env.GOLANG_VERSION }}
+
+      - name: Re-verify every license URL
+        env:
+          URLS_OUTPUT: /tmp/license-urls-fresh.tsv
+        run: make install-tools && bash tools/verify-license-urls.sh
+
+      - name: Compare against the committed map
+        run: |
+          if ! diff -u <(LC_ALL=C grep -v '^#' tools/license-urls.tsv) \
+                       <(LC_ALL=C grep -v '^#' /tmp/license-urls-fresh.tsv); then
+            echo "::error::A license URL no longer serves the vendored bytes. Upstream may have retagged or moved."
+            exit 1
+          fi

Makefile

@@ -144,7 +144,7 @@ push-bundle-image: build-bundle-image
 CMDS := $(patsubst ./cmd/%/,%,$(sort $(dir $(wildcard ./cmd/*/))))
 CMD_TARGETS := $(patsubst %,cmd-%, $(CMDS))
 
-CHECK_TARGETS := lint license-check validate-modules validate-generated-assets
+CHECK_TARGETS := lint license-check validate-modules validate-generated-assets test-tools
 MAKE_TARGETS := build check coverage cmds $(CMD_TARGETS) $(CHECK_TARGETS)
 DOCKER_TARGETS := $(patsubst %,docker-%, $(MAKE_TARGETS))
 .PHONY: $(MAKE_TARGETS) $(DOCKER_TARGETS)
@@ -203,6 +203,24 @@ check-third-party-notices: third-party-notices
 	@git diff --exit-code -- THIRD_PARTY_NOTICES.md \
 		|| { echo "ERROR: THIRD_PARTY_NOTICES.md is stale. Run 'make third-party-notices' and commit the change."; exit 1; }
 
+# Needs network. Rarely run: keyed by module, so a version bump does not
+# invalidate it. Only a new dependency does.
+.PHONY: third-party-notices-repos
+third-party-notices-repos:
+	@bash tools/resolve-module-repos.sh
+
+# Needs network. Every URL is content-verified against the vendored copy before
+# it is written, so re-run this whenever a dependency version changes.
+.PHONY: third-party-notices-urls
+third-party-notices-urls: third-party-notices-repos
+	@bash tools/verify-license-urls.sh
+
+.PHONY: test-tools
+test-tools:
+	@for t in tools/*_test.sh; do \
+		bash "$$t" || exit 1; \
+	done
+
 # Apply go fmt to the codebase
 fmt:
 	go list -f '{{.Dir}}' $(MODULE)/... \