Skip to content

license_check: action_scancode and docker_scancode are incompatible with scancode-toolkit v32+ #108148

@billwatersiii

Description

@billwatersiii

Describe the bug

The docker_scancode repository's main branch was updated to SCANCODE_RELEASE=32.5.0, but the ghcr.io/zephyrproject-rtos/scancode:v1.0.0 container image on GHCR was never rebuilt from it — that tag still contains the original ~4-year-old scancode v31.x binary. Because action_scancode's Dockerfile references FROM ghcr.io/zephyrproject-rtos/scancode:v1.0.0, and action_scancode's entrypoint.sh and license_check.py were also never updated for v32's breaking changes (the --license-policy flag now requires a file argument, and the per-file licenses JSON key was replaced by license_detections), the two repos are already incompatible with each other — but nobody has noticed because the stale v1.0.0 image masks the problem entirely. The moment that image is rebuilt or re-tagged from the current main branch Dockerfile, the Scan code for licenses CI job will fail for every Zephyr pull request.

Regression

  • This is a regression.

Steps to reproduce

  1. Go to the docker_scancode repository and note that the main branch Dockerfile sets SCANCODE_RELEASE=32.5.0.
  2. Rebuild and push the ghcr.io/zephyrproject-rtos/scancode:v1.0.0 image from that main branch Dockerfile.
  3. Open any Zephyr pull request that adds a new source file (to ensure the scan has files to process).
  4. Observe the Scan code for licenses CI job fail at the scancode invocation step with: Error: Invalid value for '--license-policy': policy file is not a regular file — caused by entrypoint.sh passing --license-policy without a file argument, which is no longer valid in v32+.
  5. Fix step 4 by removing --license-policy from entrypoint.sh, then re-run.
  6. Observe the job now fail at the license_check.py step with: KeyError: 'licenses' — caused by license_check.py accessing file['licenses'], a key that was removed in scancode v32 and replaced with file['license_detections'].

Relevant log output

Impact

Functional Limitation – Some features not working as expected, but system usable.

Environment

GitHub pull request ci

Additional Context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugThe issue is a bug, or the PR is fixing a bug

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions